hxxp://212[.]112[.]19[.]163[:]443

Analysis

user interaction
yes
max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/08/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://212.112.19.163:443
Sample260818-e2k83swzew

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5856	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315007987176281"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{D2F1731C-379E-4DDD-AB8D-9123E533C062}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2240	1336	msedge.exe	80
PID 1336 wrote to memory of 4700	1336	msedge.exe	82
PID 1336 wrote to memory of 5856	1336	msedge.exe	81
PID 1336 wrote to memory of 4700	1336	msedge.exe	82
PID 1336 wrote to memory of 4700	1336	msedge.exe	82
PID 1336 wrote to memory of 3964	1336	msedge.exe	83
PID 1336 wrote to memory of 3964	1336	msedge.exe	83
PID 1336 wrote to memory of 5704	1336	msedge.exe	85
PID 1336 wrote to memory of 5704	1336	msedge.exe	85
PID 1336 wrote to memory of 3012	1336	msedge.exe	86
PID 1336 wrote to memory of 5704	1336	msedge.exe	85
PID 1336 wrote to memory of 3012	1336	msedge.exe	86
PID 1336 wrote to memory of 3012	1336	msedge.exe	86
PID 1336 wrote to memory of 5364	1336	msedge.exe	88
PID 1336 wrote to memory of 5364	1336	msedge.exe	88
PID 1336 wrote to memory of 5364	1336	msedge.exe	88
PID 1336 wrote to memory of 1592	1336	msedge.exe	89
PID 1336 wrote to memory of 1592	1336	msedge.exe	89
PID 1336 wrote to memory of 1592	1336	msedge.exe	89
PID 1336 wrote to memory of 5488	1336	msedge.exe	91
PID 1336 wrote to memory of 3904	1336	msedge.exe	92
PID 1336 wrote to memory of 4616	1336	msedge.exe	94
PID 1336 wrote to memory of 5968	1336	msedge.exe	93
PID 1336 wrote to memory of 3904	1336	msedge.exe	92
PID 1336 wrote to memory of 4616	1336	msedge.exe	94
PID 5968 wrote to memory of 2728	5968	msedge.exe	95
PID 1336 wrote to memory of 4696	1336	msedge.exe	98
PID 1336 wrote to memory of 4696	1336	msedge.exe	98
PID 1336 wrote to memory of 4696	1336	msedge.exe	98
PID 1336 wrote to memory of 2276	1336	msedge.exe	99
PID 1336 wrote to memory of 2276	1336	msedge.exe	99
PID 1336 wrote to memory of 2276	1336	msedge.exe	99
PID 1336 wrote to memory of 3036	1336	msedge.exe	100
PID 1336 wrote to memory of 3036	1336	msedge.exe	100
PID 1336 wrote to memory of 3036	1336	msedge.exe	100
PID 1336 wrote to memory of 784	1336	msedge.exe	101
PID 1336 wrote to memory of 784	1336	msedge.exe	101
PID 1336 wrote to memory of 784	1336	msedge.exe	101
PID 1336 wrote to memory of 5588	1336	msedge.exe	102
PID 1336 wrote to memory of 5588	1336	msedge.exe	102
PID 1336 wrote to memory of 5588	1336	msedge.exe	102
PID 1336 wrote to memory of 4224	1336	msedge.exe	103
PID 1336 wrote to memory of 4224	1336	msedge.exe	103
PID 1336 wrote to memory of 4224	1336	msedge.exe	103
PID 1336 wrote to memory of 4360	1336	msedge.exe	104
PID 1336 wrote to memory of 4312	1336	msedge.exe	105
PID 1336 wrote to memory of 4344	1336	msedge.exe	106
PID 1336 wrote to memory of 2364	1336	msedge.exe	107
PID 1336 wrote to memory of 2364	1336	msedge.exe	107
PID 1336 wrote to memory of 2364	1336	msedge.exe	107
PID 1336 wrote to memory of 3172	1336	msedge.exe	108
PID 1336 wrote to memory of 3172	1336	msedge.exe	108
PID 1336 wrote to memory of 3172	1336	msedge.exe	108
PID 1336 wrote to memory of 6072	1336	msedge.exe	109
PID 1336 wrote to memory of 6072	1336	msedge.exe	109
PID 1336 wrote to memory of 6072	1336	msedge.exe	109
PID 1336 wrote to memory of 5060	1336	msedge.exe	110
PID 1336 wrote to memory of 5060	1336	msedge.exe	110
PID 1336 wrote to memory of 5060	1336	msedge.exe	110
PID 1336 wrote to memory of 4512	1336	msedge.exe	111
PID 1336 wrote to memory of 4512	1336	msedge.exe	111
PID 1336 wrote to memory of 4552	1336	msedge.exe	113
PID 1336 wrote to memory of 4552	1336	msedge.exe	113
PID 1336 wrote to memory of 4552	1336	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://212.112.19.163:443
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7fff9e2cc188,0x7fff9e2cc194,0x7fff9e2cc1a0
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1696,i,1967874640127582003,2727507754943851647,524288 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,13358210046949152246,6476475519513525412,262144 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,3388661907681248921,15498035394650079621,524288 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:13
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,10201040195656440771,11274089725818060023,2097152 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,9438756141903983202,7244749745161040283,2097152 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4936,i,6885886076793450975,12967708178106991157,2097152 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3568,i,16952902108452496823,7989423660469928466,2097152 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,3077385770051364983,14899266101169664807,524288 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,3077385770051364983,14899266101169664807,524288 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,13744889013292512526,16625680560287885256,524288 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,12648708614172563989,11379445614449853376,524288 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,3236726203147928965,14840464144960278114,524288 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6252,i,5457578658970123816,1640746619243683590,2097152 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5644,i,17778808992504237486,14218132112928028712,2097152 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6256,i,9303139225093282901,7925221128263872231,2097152 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3592,i,11142574016987570187,12046183658641821502,2097152 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6324,i,9179994463664712197,7886727427812998629,2097152 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5664,i,6376826212488749294,15924018125097428294,2097152 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,5710299409022524762,14058331417886005541,524288 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,4808784601689422607,12691441952295537655,524288 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,3855601469298819755,3758540342480671134,524288 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5156,i,7123280779174362987,13396939196667206734,2097152 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5932,i,6039172755632882410,1669994484382195455,2097152 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5904,i,16540670871703236041,494873445557548734,2097152 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6420,i,11164920092606174966,9927628642976267101,2097152 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,18005243741369774766,6324739485890382660,524288 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6548,i,628028956143456173,16384284870486977730,2097152 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5144,i,5340010434222013038,7284003972602828783,2097152 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5732,i,18334897777007478494,15753706575476943430,2097152 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6472,i,7454718573680659590,13789246163656392522,2097152 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5732,i,11767877472624398271,3828671755167048916,262144 --field-trial-handle=2156,i,7593361049440043762,7200481744356097897,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

2ae9d2cf-120e-4f08-afb5-3a236609ef09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2ae9d2cf-120e-4f08-afb5-3a236609ef09.tmp
Size 414B
SHA256 03f1c3f6d71a019680f7a40cd726e9cf3659527a1ec9767690cda66613a3601a
MD5 9bf729106b287ead3c4ff9736acdc6da
SHA1 d01935925413404190c3d7c1c6b3084ae0ce0de0
SHA512 b8a00a5bd2714b66c223ae6872e889c8884eb336fecb2324e114324f2987ef78e33d873502e21b0a66159b85480718f7d9fedbd10e91ede2bf6a91ad4f338797
TLSH
T1F4E02BE5C822BC2B1DFD0B5965500646E71123362A40890F3A3D910D8FB867B099A91C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d1f77e96ec9aed65cf1955cb9659df442de020b07b40f855b3f62a21b0e0ea7f
MD5 c8d30c33bf5f4483882c8f1eb2470c55
SHA1 fee70bc8c2e93324b4c34c949e5af0cfdac9f6e8
SHA512 9995ed71729814a31a37013ad002c6fb5163594ebba29e8c83ef1a5748af9c45c0b13ba716c2d90cceb208115927e5e51f97e36162462b44baea0f455d8f7052
TLSH
T13B31DFF783E4856E8A0196F0BA18BE2FCE2D0514432C3D9AC5E4AF1B93E3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 46894ae3ecd0845a1ed55fd3aea8fa4023f067411e798e2951e064b611360ecf
MD5 992c7f1e7b70a6569b294db3fadce539
SHA1 7c37097d722d161d88343ab765a529878000e0dc
SHA512 161a58e86d79748ebdd536e23249fa676554b1c10628731a0d2564a8eeb77ba88735b5375166d06efd4c3bd036602359aac9aa5c5612329dd307c4ef3028233d
TLSH
T12131C2F783F4856EC91196F0AA18BE2FCE2D0511431C7D9989E4EE5BD3E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 0c9b756c19aaffbcc5e4c5d9117debe87e9efe1850ece39d84db8773cab8de7f
MD5 8a97d0b9b0356b2cd994e7bb9d8612c6
SHA1 079ef0b55d51172086d3f68721c6a94ef725e702
SHA512 fea41e69500acf354756a04023f7f2f4955da7ea1d0e67355670861a9d0e77db14e228a7d5bbda5fb2fe0219a55df7280890fefe2710355f0abf5b8a707d743b
TLSH
T1DAD023771300707555AD3D85C455ECCFC33A005104C1DED418E0E499063145C4557145
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 eb76092f9b9ee8624ffb11af11bf64569e7d0200264e60daaf4c6f5a6d6f0fed
MD5 0816b9e12e0a611b24d8ac990a039510
SHA1 c583fa39253063778647105a0711f7d979521087
SHA512 6704db8cbbd24cf5e0714fdb1a1d4e8478675b87cc4d5d6f7bd6e28d3d7039dce5f9ff368893b5ddd6e98476b0093aed89063a8491a5f82d3c3e7163a6fde65a
SSDEEP 192:sxZvRzyMqZjK1Ml8UQeIFs/ftsQWKQ7PV0izodp8JAK/rZ6+WNbbW4H/Y0ZIkOoA:sxZvYqLs/ftsQWV7d0Zk/efR/5JXJQ1
TLSH
T14F72D7166A3859778CDBD619FA45BB53D3F55563D1804E44AAFC8A1C00E6ADD3203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e21ab1d8416e303c1cfc03e6b6adab43ad611bd9630a9816abcd9eabad63f524
MD5 255749eda2b867b1af0215fd205ff167
SHA1 2923b2d88478c25784842cf3449ddc41c9fa3efc
SHA512 bdac22c9767270fc4f12465c739177c1c9fe43c93f64aec70cb84a5c02e850328e5c4820fde12a3c391ba070cb55783822b853cd3541b451db7650938fa1915d
SSDEEP 192:sxZ4RzyMqZjK1Ml8MFs/ftsQkKQ7Ph0izodpAl/rl6+WNGY0ZYk9oIg5VJQDJ:sxZ44ds/ftsQkV7Z0Z4/yG5YXJQ1
TLSH
T1A562E8166A386977CCDBD719FA457B93D3F95523D1804E44AAFC8A1C00E6ADD2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d2a1fd3b130b9e29525cbae0498d7cb62e5be9377f2e39c672f6a2dc98c93c68
MD5 96457b40aa385138386cf657b39368b7
SHA1 1d60fe2c8b337e57cad1c3204daba473b69e39dc
SHA512 1ce0e89b020859b9b043900c885fef8827a12c2e0f297311a0c47e5b103c5a844e7666d98b5029424764cafa55a1bfc16f1d08b7838d78a7501757d4710fab42
SSDEEP 192:sxZSRzyMqZjK1Ml8MFs/ftsqkKQ7Ph0izodpAF/W6+WNGY0ZYk9oIgjJQDJ:sxZS4ds/ftsqkV7Z0Z0/bG5YjJQ1
TLSH
T15262E7166A386977CCDBD719FA457B93D7F91523D2804E44AAFC8A0C00E6ADD2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5f944537b20a3613b9a14fe157f6b4931f661efecca66e7cfcc855433df76743
MD5 ff949b24fc02e970376e1e3f757c084c
SHA1 851a5addebacff92efe9b51049fe38dc9781850d
SHA512 d7a761448361e1d10aa9e6c50d747caca9598378a1d07993b318a0ad4827620912cdbeb595f4b2a22621ac2b1d79b7b73c82c946954a2a966b1e5f8bb81df923
SSDEEP 192:sxZvRzyMqZjK1Ml8MFs/ftsQWKQ7Ph0izodpAl/r96+WNbbW4H/Y0Zyk9oIg5VJS:sxZv4ds/ftsQWV7Z0Z4/afR/5iXJQ1
TLSH
T16562E6166A3869778CDBD719FA45BB53D7F95523D1804E44AAFC8A1C00E6ADD3203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 cabb71bfca1660efbd35fb1f5ae68362e22722d3c800c62ce4408ace550e9625
MD5 97cb9601c5539c93245b5c4181aaf264
SHA1 d670abd57cc2634d13604647d1f3b73d7b928fa7
SHA512 33317470c1e195f636262ab6c6c50f0c01498d5a27d9c75a397c6e550f9d4db7719c768c70d675d0b6b1b82bd343948d1b22c8c93801543ec6ca617afb517f5b
SSDEEP 192:sxZvRzyMqZjK1Ml8MFs/ftsQWKQ7Ph0izodpAK/rZ6+WNbbW4H/Y0Zyk9oIg5VJS:sxZvYds/ftsQWV7Z0Zj/efR/5iXJQ1
TLSH
T1E662E7166A386977CCDBD719FA45BB53D7F95523D1804E44AAFC8A1C00E6ADD2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 0dc0fb9144ea796d9550509428b3774afe788a480b5de36b3fa44af52d7ad8a4
MD5 a9d7f872b5a853cda67e2f78e6f01514
SHA1 526b636c3658443e2952d90146568b34eafec42f
SHA512 e79b80e2dced729501c6fb3ca5ae9fecfce52ca7fadb9733663d0de7e5160816f55a9f8fe090a8e73008512467c3e05f910f9f57513e1feb06c1bc78d61fa041
SSDEEP 768:XwZh38Dv2aFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV309Ll/lv0bzkro1o:XwZh38Dv2aFWRm6GQFmu1jaK09LplMbC
TLSH
T119E21B3B280CC77E4F844E9DEC266F966ED802CB66684D5447FA894C03CA7EF511B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 60d27d8dabfd257b2aaf627f924d0273b6ed1d34bd95948f8e3c9832431bb4f2
MD5 1e4b5c1ef903a3528ee5ed43b67104b4
SHA1 631d52b826d030ef8da0eb161f2465f9447a739a
SHA512 1466f94cd84d626a67928b69a18b4021c4a47b0f7398616f6d5a08f67a33ee29d61ff0e4923de8de202443d4f733a06bc9fa0d21e113da45222947609b2ffede
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlZ5Vn:ctGj+BCNC5qFVpKxZPn
TLSH
T124B2691632BA02033C3DB91D87A597375A42B2633018E93B7BE954B60E67E214DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 93f01878f6be50d278cb216e2a9818b40ac430c5b85cd0064f920b5ffb398794
MD5 1d62875d9380dcb0c2dad767017a951e
SHA1 8ff76908aea212b3a80866b3d2aff04fe2c19943
SHA512 9d6c53e0bb9a1f54d1e163d15d2f232c3815e9a1e2d81a6e8d1470f28a5cf568dfdea9171381b33e0daa282b190f9e34b6349382539c2045302f61f97b283260
SSDEEP 768:CFZ3Izhr3AwgSc0OosT3qk0NjEUiaX9m6yMt:C3Ix3lwak+4hgm6Vt
TLSH
T10DD25A76EC64DAABFCDB4ED5A75A7213EEE04123C58CAAD4D9D81E0E008B0DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7856acbe9d5be592dce40f538feb9df8a8e3a128f6ebf0d546f8dc3a0443e259
MD5 e39493bbee52d6d08d3ce4c5cb6affa3
SHA1 d94b04c7d337945a7664470720e55f8725f05560
SHA512 e4de5daac0d6f353647cb756fecd5d3951526ac6fbee0b5851c4225f5f63248e2d1203aa4eaa12a88852825d371411de3c8f60fdc337bee86b5f0b331238ac4c
SSDEEP 768:CFccpX3Awgvu0OosT3qk0NjEUiaX9m6yMc:GX3g+ak+4hgm6Vc
TLSH
T10AD24A36ECA8DAA7FDDB4F99B75A3103DEE0816385CC9AD4D9D81E0D009B09D530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 19c37d2b9871d7d9c1d3d7cd1e821dabc9358ce8324185fc0ae076e76fc71b06
MD5 f0ef943844aee880b02eb9e35b81ba4d
SHA1 e907869eb49e4af3abd00ea1d8997e31bf56e407
SHA512 1162ad6e75e90210177cd9a55dbd2cb233f6f21801d2f889b517b541339ca1fa729ec00ff1f094a1138e233c0d03cbaec7cb8a5a17bf5d7fd7b44df04f8c93c5
SSDEEP 384:nQqiF9CcmyWCs38Nz8TUNTUlIxBrk6Y0OO1J1zCfbLoTxOTb7qkfEXs2REUie4Kk:2Fccps3Qwg4ROpOosT3qk0NREUiI8p0C
TLSH
T109C25B36EC98DAB7ECD64FA9B74A3503DDE08263C68C9AD4D6DC1D0D009B19D570B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c2f86b2d0afe792bc9fb88992a6ae35b605e04479f0a1f24093c5ddf0a7125ad
MD5 6d9361c2c5aaf9f14f3faf1d861cedd3
SHA1 e2479e4854cb4b6af070eba08541de22a3bade04
SHA512 7f68e017af697859696fa08fa55efba92edee387f2c38bcb617ca401cebe39df778050c06e9a572fb9a7bb9bdafd995d6df4b51a82e6902669c390472fa1d4cc
SSDEEP 384:nuiF9CcmyWCs38Na8TUNTUlIxBrk6onAF1zCfbLoTxOTb7qkf0SEie4KV8p0vBta:FFccps3Zwg4bAzOosT3qkMSEiI8p0C
TLSH
T10FB27C35EC58DEBBEDEB0FA9B74A7603DEE0526385889AD4DAD81D0D00C719D170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d22c499260130eac9775bef7a6bd25493f7781fae14985b9546426fc4f0d4bab
MD5 d85ba8d12b21b7917247ea48364f63d5
SHA1 9fff00b4a6d03b090312e74250fc144af445c551
SHA512 5f313a795aab8b398f2d1f678a222d9ed1ed813419d7a40786b72b2411d914c7f75a4dde001719aeff4a79420dfec7b9c10c91afc8434b552bc3f5a08ef63c01
SSDEEP 768:/FZ3IzhZ3AwgSd0OosT3qk0RFEUiaX9m6yMt:/3I/3lXakEahgm6Vt
TLSH
T18AD24A76EC64DAA7FCE74ED5A75A7213EEE04123C58CAAD4E9D81E0E00CB09D530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ee25b8ee1122cd2571f865055a7b23cf7f49069475ea72cd56eefbc766d85544
MD5 f39d7ff135a80e75ece30df01c305cc7
SHA1 e4aa2aa11a6476206d959751bb163bda8fd737d2
SHA512 cce7ced940deb006e75a9e06f0f7d5dbf8af87afbe8321dbf289fb906e5715e08125d14b43c503f33727523df72a9c29295f78bccc623f69b28dc56987de9381
SSDEEP 768:XFZ3Izhr3AwgSI0OosT3qk0NjEUiaX9m6yMt:H3IN3l8ak+4hgm6Vt
TLSH
T1DDD25A76EC64DAA7FDDB4ED5A75A7213EEE04123C58CAAD4D9D81E0E008B0DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download