hxxps://sites[.]google[.]com/view/drcheats5

Resubmissions

16/03/2025, 11:50

250316-nzsptatms5 10

16/03/2025, 11:46

250316-nxgjrszxbz 7

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2025, 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sites.google.com/view/drcheats5

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4484	msedge.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
13	sites.google.com
517	sites.google.com
5	sites.google.com
6	sites.google.com
10	sites.google.com

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1337277531\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1337277531\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1337277531\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1337277531\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1337277531\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1754884733\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1754884733\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_2011743476\well_known_domains.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1754884733\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_2011743476\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_2011743476\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_659610739\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_659610739\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_659610739\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133865992021818952"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3342763580-2723508992-2885672917-1000\{4D8CA42B-F294-430E-9E0D-11EE2AEA3D58}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3848	msedge.exe
3848	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3088	7zG.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3088	7zG.exe
Token: 35	3088	7zG.exe
Token: SeSecurityPrivilege	3088	7zG.exe
Token: SeSecurityPrivilege	3088	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2820	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 5572	4484	msedge.exe	84
PID 4484 wrote to memory of 5572	4484	msedge.exe	84
PID 4484 wrote to memory of 8	4484	msedge.exe	86
PID 4484 wrote to memory of 8	4484	msedge.exe	86
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 4128	4484	msedge.exe	87
PID 4484 wrote to memory of 364	4484	msedge.exe	88
PID 4484 wrote to memory of 364	4484	msedge.exe	88
PID 4484 wrote to memory of 364	4484	msedge.exe	88
PID 4484 wrote to memory of 364	4484	msedge.exe	88
PID 4484 wrote to memory of 364	4484	msedge.exe	88
PID 4484 wrote to memory of 364	4484	msedge.exe	88
PID 4484 wrote to memory of 364	4484	msedge.exe	88
PID 4484 wrote to memory of 364	4484	msedge.exe	88
PID 4484 wrote to memory of 364	4484	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://sites.google.com/view/drcheats5
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x258,0x7ffa3131f208,0x7ffa3131f214,0x7ffa3131f220
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1936,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2176,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2572,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3420,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3448,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5040,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5044,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5532,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5820,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5820,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5604,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=6220,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6228,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6548,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6704,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6660,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1632,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6652,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=6528,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=4856,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=6800,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=6596,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=6692,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=7228,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7268,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=7760,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=6916,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1740,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7072,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5216,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2708,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7892,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5520,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5912,i,15298586627675543370,7789467004526789475,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:6124

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault26267090h8601h472ehbb77h845d08e119bc
1⤵
PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault26267090h8601h472ehbb77h845d08e119bc --edge-skip-compat-layer-relaunch
  2⤵
  PID:4784

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4784

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2820

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap13602:84:7zEvent16478
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1337277531\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1337277531\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1754884733\manifest.json

Filesize
118B

MD5
ffa5fcfeb00002903f6cf667e9fe6a3c

SHA1
ad765ea344c8cfd95a591da8259fe412e52d13b0

SHA256
dd0679c622258bad2e2ddaec3470297259dc68b55b8c4f4d7f2f28a378826217

SHA512
8da9b780e9bc6785efbd56b51a4decc8703c9f1d41b33469153cc0aea8190c1b6a9001128c6022756a66ee539086ad6f787da84b6b7082dc51939077365e7beb

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4484_2011743476\manifest.json

Filesize
141B

MD5
811f0436837c701dc1cea3d6292b3922

SHA1
4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87

SHA256
dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d

SHA512
21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4484_659610739\manifest.json

Filesize
76B

MD5
ba25fcf816a017558d3434583e9746b8

SHA1
be05c87f7adf6b21273a4e94b3592618b6a4a624

SHA256
0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11

SHA512
3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
df2d1721cd4e4eff7049314710dc7c11

SHA1
f5aed0158b2c0a00302f743841188881d811637a

SHA256
ba336ffd1b01965d7ab0e5fac5415e43cb594139c76b19e4c0d9b5b3b67c1e93

SHA512
11fd520176193f284563c7d050e6a7ab4e9895bac49fdc05759bab2c8a69f224858ccc784b351fc1d3ee5d39345430f9234623c9390978d7daf6a08ff5576ef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
dc0a84d42611ccaad2fb3129750c750b

SHA1
8825a88d54c6fff4d63ae02da8f278010eea8555

SHA256
6dd3113f35ee855521852245fc24577ed3cb51c7a8ac016774a3f4ea82ea05ff

SHA512
cf06afae68191454cef60348daa4cd926ea5eea3fa37cd6a2d4d88b398e9280264b9764e461b71284c468e4b9ab6e5fb4a2b7fec6070f55a18b509f9466040d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5899f9.TMP

Filesize
3KB

MD5
14cc661f310dc0ab787a91be74762404

SHA1
aa19c2a9a1b9ea4367cb23618c9b52145b91b0bd

SHA256
823b8767e973b70026051fa0ddbedc7177bd6ee969292940eee73456cacff511

SHA512
ab632f6fefc5c87d5c9886f62786ac4f25db7a84a1fa9262e159d9fef0c1480053edf25a713b7b80b424fc95eb07d8d9cfea944fc65bee3923a00fcdd2ed869a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
18KB

MD5
28c0b3fc3e0672d369cd3cb138d7edc4

SHA1
116358c6383263ccea21ed9b4fc5e4c2f4c63904

SHA256
448c55e5a47865a9a0467ddcac80f7cfd720a71d07c2a65496afc6ebb5ffbf19

SHA512
3f304ce75b5f5ef47c3aaee990f5ccdcb06c6d8ca8b9c26925ccdd76111107f30ecf5ba729950945a3698470aa575846a486987ace11c3288bb1e80e50d11aba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
19KB

MD5
ec04c573d9741ab8ee732046a83b33f1

SHA1
0d0f19d42d293d602eaec0ff4208643cd0cc6950

SHA256
95949adef96cf4cc5b47e42c6f03db454aced295e08b3d4d2e77017a3fe387bd

SHA512
bc61d047652c6b5683054b4c34b46f68e1b959ce41309489ffc3dc4b4863f427e8fd76ef2bcc92251a41bbb8a1c6244c44180d3abeb296f67a416de429799217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
215d8e8d0c8a7523ea41dadab401b468

SHA1
95cdd61493a590b41488ab335f6f36199372708f

SHA256
354b98e85f113788e7f90ddb1c840f4f3e81fa8116d9e938d20d9ec16f46a0f0

SHA512
d3a1a145d8b4d32cb31ae72224854cc4b7dfaa74d6336c1f91b050852cf0582959dae02571f1595d8d4245a7bda4633d47c508f02f6f8125b14bf6776be75cbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
22KB

MD5
e5a6864d8d380f5934eac08865f323b1

SHA1
af50d5fe03827981ff6b283507ac914032f4a778

SHA256
b2a1ec701fed5303319598b2ccc767498b7b9df34781a20298b075769fc42e90

SHA512
d6f3449005e2b071fc054572819f70039cdc70f8dd2baff99032cec7d2ae6a7a97ea212f0279497fa10b2b401c3dd4ec42a6231ebfee4fa20e0e69b2e88af571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
22KB

MD5
fb4440c89d7b71402867584b37a1155f

SHA1
29494335fd189b042d9aa148e12b21d8312c59ad

SHA256
3f9406423598153b13ceb10ad402c497f9e9d7b2bd8834178e58a6f9dab0f413

SHA512
988bba62e3b851518b22e8f8e7de8281d0abd77033dcc7ed7449790e8e4437b6bd13d8a24ec124db6c08fd8da5b9acee7dc702f7c9c10773b0a9e6edf0e0cc7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
22KB

MD5
a0ae63818dfe6d0c169489cc6dbe25db

SHA1
86c8b99816a976268d8e6b14a669f7a15b08dbec

SHA256
13962d0a5fbb918f71a32a9346162169a47232aff48b86b739cd21a8cbbdc831

SHA512
2a0c9f96b5c5d6c862b761b8fd933fc05259d82d132e8e6f3182d4ca705e2b4afabf90d80d5a2978010f593183caa23586d6b9ae4e0acd4f11b4b90b3b7edf61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
ffc4dc0081c865f7d2aa2d6835e36f2f

SHA1
424fe73847d1aaed7fe385300af9af61acf3ce06

SHA256
cc684ed28cb70fa37aa10ed08338e466197e81686de6689cf0765d082be91ca5

SHA512
ebba7d8068e460e01325ba1c16f7d73ccb4b84dc063769803303001eec5c6089eadd52f05ec08ab2a074bcbf671fbbd4443ec06248dcc6a18d32d8b438f0f9e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
b6c619b4ea532541c4f079cc80299906

SHA1
634a76beaaba58be825e79dd76642cc6dad78a2e

SHA256
a1627b12e387b192082dfcfdca12ee99a6970e072c2dd4907fffc0ca773b5e89

SHA512
e14212c8858eba93ef8151497ae08ebb09ec3cfc17955e55595b099409f7ad5f22d10c9fb93548aab97fcf6dfe0f34ad6b4a9f00483e77bdd44f75b61c828b2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
464B

MD5
6f4429164f1e140588da7356dc701549

SHA1
6918fa7f1e97277da05e8ad82da5c7f6274939c4

SHA256
8a30298dabadc0e8836ba172a17dc9f3ae160e672a518d24fb6c24f94da3014f

SHA512
8a2926d247ad1cb638560efde1834fa0b9709988f65fa167b4585803a82c4b35db4ab8f60502eb1f11ef7cf13874c7a22bb8f933226e8312b4058830bc74f441

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
d2eae7caf64613af803c694077aa4f93

SHA1
963eb7d9d324692fbc2c35584fb26bc0e7622b38

SHA256
63d92f465991e8669e8bf3e621600b9204532df987e6d798e5f10bdb794cd7e1

SHA512
2a88addcf0e01e2fa90fa188394c655a7d60c832dc988a340d4575b45cdd82093ca02d6f18516862416855ccb2e62f3b3c9e9ee99d67a281f839c52a28ed5aa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
7509e8e829e58343f478ff4b240b434c

SHA1
8f02c751975ac8cf7a7e29b47888eb7733877b02

SHA256
9033e889d2dabf4fe86e949b394f48f111dca2e4167ddf9c6a87d807414dfbea

SHA512
447a5e7503c44fe0aa4524cdb54011b3c3dd1911713894c4bdb719e0cf11abb9300792365c37687882b19fb4550cfe8d86fc4f5257786385402c1ea7421985c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
beddfb970b7401b0ae13bf445d44cb78

SHA1
eb195b2395eaf39ffd0e0f0fd64fa63e1a1c5a79

SHA256
db8b3d2009b77096a2f1618601f24f9b28edfa17bde848400e4dcc23b2ae61b8

SHA512
71e9c0c609a4e2c47dd8e530ac9a066636b181761d21b9e7ef7a15e0edc8d503fc3671cf609e6c8d168040ab6946fcd7219f41dcdaa76e23ed0c207242663def

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
6e178783d9f7264e403ed1de6fd64eb6

SHA1
6d9ce511a7cefe26d68e4b1f6b7093654e66547f

SHA256
e80bb075f367dac051f8996f5cb072dfc006622ef43006f2bf211761667e8e58

SHA512
6f1019d90b8176a2b7de99d99efa1539c72f912876b2ed3d37695762de3510df5ac7263fb562278c451ad09f6cb8af9344d6a55bfe14f57b221f0ce6480a97c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
bb7df14753c1c41e95d7d4e999a4ef95

SHA1
9ac84401c88f96cea059c440fbb153e8cd6200c9

SHA256
ab034547e162abfb93aa3e2bc660acbeb60cab52e80639ac9a85102ebba81d58

SHA512
031b4366a380559b36adb914c6c2d7a63f5352d4598d72d6099379d94132edce8183ec73023b64b4eee921f7679c2c2cefd81980a0b0c656d3419441f70a061d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
a65bf80e7a1f4cc0a260396857d98dbf

SHA1
e00899fe25645198aad516f13d6283649ea0ee07

SHA256
78536e3a353b9d30f421f632419842f5522a0391e4035175558cda30db8ea014

SHA512
ec9acf6334f460a2d97b0dfc8713c21b0cb1c50139dee2b24ae2bce9cb5597429abdd67989f7a7c560acd6e38b3a4373acb8fb7301c87fa57e89f33bca1e99ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
84fd85f245f18010d90e4c2b13e4aeda

SHA1
480aca873ad02fdb6d4e200530a81dd37f48e461

SHA256
ca2e47f919757a3a857b12224b058d1de2818f3e851398eee99ed0e3a3fb8ac5

SHA512
0c4d376f11bda65e779b35f64af7e8eddd906ce5c7a420b4d105524d29cd6a108d0a991884c7bb2c3e8b58871f0933aba0bb3050f4aab50819d96a776ae11d4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
0adc0eb11c034b3bb2f6c6cde266329a

SHA1
fdf8706e43da02cb9ac9350ebb31c3439069cbca

SHA256
3bde482ff9d424e85b56f99e01d7d623eca2730bda0b2fb5f78db970fbda7698

SHA512
2a3475b4acd4ee7e11562ff0fe448f7fab22854fc0b63d86f5bf3d520a1a5cbdc96f0afb98a97e594b6190a8c7b269a2cae72ba7070473aae9b8e780428f8850

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
4fbe8cda252fffe09d9504db4a331100

SHA1
a6f96fb37ac134d89595e936c28f4e6a5489fe9e

SHA256
3492b51a2f6b0b0e58089d08934b9fdfa9d5e23f3c7aea40289323ce934e914e

SHA512
68758d6c4ebe6e62568492f08a6a5fae3caaacb4b92c40b6013faaba870117f5cd617a6f315909e1e59f12432baf1975f434886041b97a7bd01dd8747e647110

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe57d699.TMP

Filesize
392B

MD5
35e4bd47c0f4380ec52aa572d570b22a

SHA1
66550662936f2fc75bb654f944c023beca528a9e

SHA256
47ad5b0dca4fb25cd6aefd356bff9af5b5cd53ce3e0d6b2de750bf6e87e83329

SHA512
d98232fa643fe403d59c8c67e379c81cbaa13e5821aa0bad147fa73faa83d7d1a11451fd66ebebd5f81ece64c12d85e39953bcb3647fc5af043b19a77b57622a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.16.1\typosquatting_list.pb

Filesize
631KB

MD5
c3ec8bf0a625c2583833a3340825f1cb

SHA1
582054710a312897117128ed59ddadc983525eb6

SHA256
7d10e035e0b2e152a1fe32a92b0b34295a979f7db2269cfba69d4aaf3401b77f

SHA512
175125259eb39225d0584fa4e3c5cbfc66bd22646cf32677f0eb7514a0abeb2c08118375210a69207be85e6e7ebdd9b6fa9a967d3c4ecd40ecd514e306873c6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

Filesize
572KB

MD5
f5f5b37fd514776f455864502c852773

SHA1
8d5ed434173fd77feb33cb6cb0fad5e2388d97c6

SHA256
2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e

SHA512
b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
8392af40c628f909af778c8392f24e2e

SHA1
9a0b94215b6a9920001f744c7e5876268810b10a

SHA256
b12f45d0d2f2156189abb834e5c691657311727051f3598700a17fd118d20d8f

SHA512
4520eb7244a3947cc73c350c59ac271c9e6f754a4938b224762565ebf142bc3bcbcc301be9e51e4b48cf6ca8230964f156263ef76367931f9740c0c1f9cfb700

Download Submit