44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1

Analysis

max time kernel
284s
max time network
276s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2025, 21:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe
Size

896KB
MD5

9a52aea2b0c41150776e760873f1a7c8
SHA1

e7b085a12af034ffdec85e957989c47207e54e9a
SHA256

44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1
SHA512

033e995bb184146abcb06657bd7094c4900ed4b28395f83c992950051442f24f39e6765ecbfca1f6fc5340e0ac204964b8b0b5c053571cb5eae628ecfcc02326
SSDEEP

12288:yqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaETb:yqDEvCTbMWu7rQYlBQcBiT6rprG8akb

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3256	msedge.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-et.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-lt.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-mr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_962699219\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_618340490\kp_pinslist.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1684534058\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-de-1996.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-hu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-nl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-sl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-sv.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-hi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-it.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-ka.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-ml.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1875612904\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1875612904\Part-DE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1615310123\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1525575423\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_618340490\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-as.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-hy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-pa.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-hr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_618340490\crs.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-de-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1875612904\adblock_snippet.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1875612904\Part-FR	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1875612904\Part-RU	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1213952762\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-ga.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-sq.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1875612904\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1875612904\Part-NL	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1213952762\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-af.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-la.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-te.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1875612904\Part-IT	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1615310123\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-da.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-fr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-ta.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1875612904\Part-ZH	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1615310123\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_962699219\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_618340490\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-gl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-or.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1875612904\Filtering Rules	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-el.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-es.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-nn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-und-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1875612904\Filtering Rules-AA	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1525575423\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-cs.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-lv.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-tk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1875612904\Filtering Rules-CA	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133867220440192018"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1062200478-553497403-3857448183-1000\{3DD17B75-39DA-4217-B81A-7FC04D316CDE}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1062200478-553497403-3857448183-1000\{C128C2B4-1EE1-400B-A318-CB897CB4F37B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3600	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe
3600	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe
3600	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe
3256	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3600	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe
3600	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe
3600	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 3256	3600	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe	86
PID 3600 wrote to memory of 3256	3600	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe	86
PID 3600 wrote to memory of 2620	3600	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe	89
PID 3600 wrote to memory of 2620	3600	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe	89
PID 3256 wrote to memory of 1852	3256	msedge.exe	90
PID 3256 wrote to memory of 1852	3256	msedge.exe	90
PID 3600 wrote to memory of 2580	3600	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe	91
PID 3600 wrote to memory of 2580	3600	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe	91
PID 3256 wrote to memory of 5648	3256	msedge.exe	93
PID 3256 wrote to memory of 5648	3256	msedge.exe	93
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 2920	3256	msedge.exe	94
PID 3256 wrote to memory of 5968	3256	msedge.exe	95
PID 3256 wrote to memory of 5968	3256	msedge.exe	95
PID 3256 wrote to memory of 5968	3256	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe
"C:\Users\Admin\AppData\Local\Temp\44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2f0,0x7ffa85d8f208,0x7ffa85d8f214,0x7ffa85d8f220
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1904,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
    3⤵
    PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2364,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2400,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:8
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3456,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3476,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4348,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:1
    3⤵
    PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4692,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5320,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4480,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
    3⤵
    PID:6128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5752,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
    3⤵
    - Modifies registry class
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3976,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3452,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
    3⤵
    PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5224,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
    3⤵
    PID:216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6224,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
    3⤵
    PID:5640
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6472,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6472,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
    3⤵
    PID:5256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=704,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
    3⤵
    PID:2688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6280,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:8
    3⤵
    PID:1456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6880,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:8
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3512,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:8
    3⤵
    PID:1548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3740,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
    3⤵
    PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6312,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
    3⤵
    PID:656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6512,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:8
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6980,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1912,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6948,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:8
    3⤵
    PID:3916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4672,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2196,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:8
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6308,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:8
    3⤵
    PID:5808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6100,i,15725733808979342098,10595190555196142439,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
    3⤵
    PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  PID:2580

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1213952762\manifest.json

Filesize
76B

MD5
ba25fcf816a017558d3434583e9746b8

SHA1
be05c87f7adf6b21273a4e94b3592618b6a4a624

SHA256
0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11

SHA512
3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1615310123\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1615310123\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1684534058\manifest.json

Filesize
141B

MD5
811f0436837c701dc1cea3d6292b3922

SHA1
4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87

SHA256
dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d

SHA512
21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3256_1875612904\manifest.json

Filesize
116B

MD5
2188c7ec4e86e29013803d6b85b0d5bb

SHA1
5a9b4a91c63e0013f661dfc472edb01385d0e3ce

SHA256
ac47cc331bb96271da2140941926a8accc6cb7599a6f3c17bd31c78f46709a62

SHA512
37c21eaff24a54c2c7571e480ff4f349267e4404111508f241f54a41542ce06bcde4c830c6e195fc48d1bf831ed1fe78da361d1e43416cfd6c02afa8188af656

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-as.hyb

Filesize
703B

MD5
8961fdd3db036dd43002659a4e4a7365

SHA1
7b2fa321d50d5417e6c8d48145e86d15b7ff8321

SHA256
c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

SHA512
531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-hi.hyb

Filesize
687B

MD5
0807cf29fc4c5d7d87c1689eb2e0baaa

SHA1
d0914fb069469d47a36d339ca70164253fccf022

SHA256
f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

SHA512
5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\hyph-nb.hyb

Filesize
141KB

MD5
677edd1a17d50f0bd11783f58725d0e7

SHA1
98fedc5862c78f3b03daed1ff9efbe5e31c205ee

SHA256
c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

SHA512
c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3256_424667464\manifest.json

Filesize
82B

MD5
2617c38bed67a4190fc499142b6f2867

SHA1
a37f0251cd6be0a6983d9a04193b773f86d31da1

SHA256
d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665

SHA512
b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3256_618340490\manifest.json

Filesize
102B

MD5
a64e2a4236e705215a3fd5cb2697a71f

SHA1
1c73e6aad8f44ade36df31a23eaaf8cd0cae826d

SHA256
014e9fc1219beefc428ec749633125c9bff7febc3be73a14a8f18a6691cd2846

SHA512
75b30c0c8cef490aaf923afbdb5385d4770de82e698f71f8f126a6af5ef16f3a90d0c27687f405274177b1a5250436efddd228a6d2949651f43bd926e8a1cc99

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3256_962699219\manifest.json

Filesize
118B

MD5
acb8ebb43624ece8dd7964092455d2b7

SHA1
7c61f04b419f927f98120afa18d8553513e2a0f6

SHA256
55b2b1fd2a563b240179fde6335370f5e22068ada77b5dc5af50bbc379c72953

SHA512
8e6c135aa19d6d21b32c6e9c0727ccf3df7e8dfcaf49e3f0ce55af9b53748188949746d69d17cdafd9d77511b1550d970289912a33b3d9c4daed8837762d91c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
690f9d619434781cadb75580a074a84d

SHA1
9c952a5597941ab800cae7262842ab6ac0b82ab1

SHA256
fc2e4954dbe6b72d5b09e1dc6360ea699437a2551355c2950da0b3d3a4779fc1

SHA512
d6b1da8e7febf926e8b6c316164efbbac22c7c3d9e4933a19fffba3d1667e1993cdeb5064aa53816c0c53f9d2c53e204772de987eb18adbb094a0fb84ae61fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Filesize
268B

MD5
c777972ef3b8b993699acbb0f6a5b593

SHA1
9a34fb35175afc468bd97a08b52d3b07998f4be5

SHA256
8e10bf8781110bfc40a9401d218c85527c4ad7e7d16a2bdb270854ac123f5c77

SHA512
daa0a2043545158a030348d13b3d0a5a798d18e1a2980660098d3f63ae9993750fe9c86e5fb2626121b11f28600502c8ed48090438c50b0529ef638100f606ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
fbae15858e9cb1661e3b96264092a738

SHA1
ba00e16d189de3652e878cf3ee64d9ee44b39f1f

SHA256
da55ed48017f5b9466da29c099ee0f1781ca4daa686f26ffadf0aad2b21a8a53

SHA512
edaf757e851c936a60b7d41c08e1e0ce909f7834933a2b51c0912c3b23eaa91da1f40c4fd9ae6636c7ade3e454218039b56816bfcb47eb900378e72de992203b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57a827.TMP

Filesize
3KB

MD5
92c45c0252f9b036dba2b06fba9eb08b

SHA1
84ba5bbab12637c6a4bfcdb1010ee620707b5514

SHA256
f531123c9460bfa3f303fd35300d0ba5c194ecf4e3546c65301598fa74ed7b1f

SHA512
0f67efdc9e0873fce0101a38bc1fb8129666874e0d85b5214fc9403db206fa1838e32eb35342286ccebcbbbb376fe5797f148cb64fc01bd863cf7f9c39432025

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
79f120182d33fe1f6ad2a2c64b252b86

SHA1
0a7603377b635f6b5cd385e9ffee350da8c89d99

SHA256
a0a2eb1ee267b743b45b86116ebd037af21c8b62c6854d192ed7934eab952c1a

SHA512
2238fba18014ecceb157740debca8bf21416b2d4e47a8207b53c2d6a7e3d1f1bb4653ca7720bdee2c4e34b9bac0c3005b3d6b851f811e942184de29c1a73cbbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
34a569e2a722f9b5ca5e033c1f201e62

SHA1
d72d6f842e65d3cc7f6eeb44a161f398e37b3ea1

SHA256
ed7cd472edfcb1cdabbcc4ee6e2c918cae79cec18d7abdf6f4748e018cb974d0

SHA512
ad29ea257380c37f8abd3bbf67a95a1e734f185282d60ca8b1b45fd8daa82ba490d26864425e29652f2ceec71546e939fbd1d17c6a08276c6047f889b8f475ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
8b0e1228b94aeea90ffe891f5145bf8f

SHA1
d312cd945b1fdba012c22e453156d36dc9fb2a1e

SHA256
4a76aca036d0fe85ce9adac3e212ce97d70aa0f0b273d077fe8f008bfc613783

SHA512
b328310a5c4a420d4835de98520175ec6a3b8a35d5164b4ab60c829934ebb7918176d5d2d357dc81d2bfc911bc7555b2e076ffffd1b77f34f57bc3f095bec4a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
02f5396ac110b30c200529b1dd4e51c5

SHA1
f422ecc1ed329ebea3544d32707143886c705401

SHA256
067810ac07f1cdf90905893563518991e9076ec2d8186bfbd3aad20e9553a10b

SHA512
1fd7c734b9c4523105c65f850c5ff697885ea9212f61829e13dd25a397c4a214cd96be6abedfa02d56c9bd64e6d5d953038e338d41b902a98db5f1c0ffdbc164

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
f73b3a43b9eb7fe08f11de7b7e29d2ab

SHA1
9a3650da5f37d0cc3d3def56e7b336109a67dec7

SHA256
4c6f7e73d444aaea8378d9a0f4019ecd6bc5b855eab8de8cfbc2fc060953b575

SHA512
a86b97e8c142bf2ba60f31d5daf68ac67ffab6f1ffa8441090a78f4a3fd0573e2edb8a774a2038dd5ccb667d3a2590745547f68cd8b2b97e452395a30eab187a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
85bf2c1deb40b78033976dfb67c1922e

SHA1
fb29668c6b1847e8bf02fb3faf4b7f803143a16e

SHA256
5690c8abf53af4094f5ec571be0cd317997700effb059141556a8e833618b647

SHA512
519426130f9c6c871f0d182098f2ce1ea67e284040c7c60bee1679f7a9f3d50f2479ce45e73f0a85967f2bc1d41ca26189da407601e2da533e44d6f417cd8d07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
0cc5374ba728b1f14e3e7da6a2f63a1f

SHA1
3af8d7bdc9e6979f0d069153cf992fd33266c970

SHA256
5656df073c44206281a2931ea56312046b48a923de0696cc0eba1bd14ba10eeb

SHA512
c9dacd72c72337ade41066d628c78f15ef8a4009f66e3a55e0d575d731de2fcfc6949e1d4019e4f835af0def9296f98a768db3a084e708a64499982eb6e5db36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
18KB

MD5
bfe3ab06df29c451465f1197ac4729f4

SHA1
25ea3ab95c84bdf3686b73111efc2e053e787cea

SHA256
9281b9c80fbd910717d8d74947ed9d3c0c65a29add642bb13012a28c5b7812c8

SHA512
6a6fb800564f90bf387038aee5b6ea74782b7e1502942ec4fd483d474c70a367bd5121947dbc3c179f1bb3b184b5fbf4a6bbc8403b1ad939785d2d686db6c524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
dedb37e8575c4463126c86a311cfff20

SHA1
025ca03f1d99554aa0b7756a5b87f0dcc3342230

SHA256
f59eef915b334072e50deacf951867deec2a94566f850a919eedfeeda8b343ad

SHA512
cb6ad7d6880ae28f60ba98f030a81ab05fb84a4ecec29e3813e8859ed48537e8ca0bfed7dfd9e60cc8af054ceb6b91114370dba2ca505d9deb82c06505fa4184

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
9f1c786b320c1c92f83e966a3775215b

SHA1
4803eefbbe99c9c2fdc72f10758edf652a65592b

SHA256
545dda8961663724b8faf7420b3c36e7fcd5d60991fa6921b9b7a21bf1bbf69b

SHA512
806aa945ab1be4e64741e1fe218da2118b0c54ba571b1b07f950941d7b6a33e4bf549dd35fd31c8b0d374ba96523e98bb735036b80b9c836319d9598b688e09d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
ae69a696ca307c3bad2612697b19af19

SHA1
695e16da3294d360232f5a932845617e8033b0cf

SHA256
bad8832e5fed3fd7d97d59752b0935b7598d39a5121b7a0d7f324236a0895af7

SHA512
a65ea9cfa01c6c77c8f45355807cc15341b4bc02fa3b1745d21db196e7569ef3787d47224a9f3149decaf1ae633ca0a758fe67bcb00c46c47bd6b873158abc80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
a607f3494025bb07537cfae091ab6b2e

SHA1
14f1fdba964e41337c2cca6ad54e515677a680dc

SHA256
226a7813cb69c82de61cd02689dc1c900b1805349ff544634cbc14f57cc08f49

SHA512
ca31ff3d651d8bb9dab795608eefb89ac153344d24b0d301e19f28891eb1daaf0a8b56fa7c94ced2ee611652d20640ecc2c9470883ab00ffda41c23e72eb6ee0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
1b632fb385ed0ce91f1db364bed5ac68

SHA1
eea5951040b9808ec0ddf70952a177a295dcb1b2

SHA256
3a3df09ab7ccc2f53e2b31bea3a20581996d1f3bb2a35107c1cb7b8dcf64bd03

SHA512
51b54dadefcf8c925c4832fa5bbebdd76fc2a4259eccfc376a37131072b58c539dc23b1d13b1f834f3da0ce015b11d4e24f4dbe7d1430339f6aba7b94c1841f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\crs.pb

Filesize
289KB

MD5
2b59269e7efdd95ba14eeb780dfb98c2

SHA1
b3f84cbc37a79eeecb8f1f39b615577d78600096

SHA256
ff2ced650772249abb57f6f19c5d0322d6df22c85c7cf2be193b6134e1b95172

SHA512
e4b454db2248021e0d198805ea54f1c0cfd84b9716a9348b1d0e0acb7c6fb5dd0839e532a5eb6d4410ab759d6688dd6cce8375ad55a150d738d280993142e9d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\ct_config.pb

Filesize
8KB

MD5
811b65320a82ebd6686fabf4bb1cb81a

SHA1
c660d448114043babec5d1c9c2584df6fab7f69b

SHA256
52687dd0c06f86a2298a4442ab8afa9b608271ec01a67217d7b58dab7e507bdf

SHA512
33350cce447508269b7714d9e551560553e020d6acf37a6a6021dc497d4008ce9e532dd615ad68872d75da22ac2039ef0b4fa70c23ec4b58043c468d5d75fd81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\kp_pinslist.pb

Filesize
11KB

MD5
0779206f78d8b0d540445a10cb51670c

SHA1
67f0f916be73bf5cffd3f4c4aa8d122c7d73ad54

SHA256
bf0945921058b9e67db61e6a559531af2f9b78d5fbedb0b411384225bdd366ec

SHA512
4140b2debe9c0b04e1e59be1387dca0e8e2f3cbc1f67830cbc723864acc2276cde9529295dcb4138fa0e2e116416658753fe46901dfa572bdfe6c7fb67bd8478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.57\Filtering Rules

Filesize
1.8MB

MD5
d7c9c6d2e1d9ae242d68a8316f41198c

SHA1
8d2ddccc88a10468e5bffad1bd377be82d053357

SHA256
f215127185b2ee6b01e12b6ca75d3e5c4e454598dd4aed36124ae13d59afd547

SHA512
7fd14824e9200dd99e1fd2cee402656dc0cfc3d0a60058c5eb05c68e9e65b7f0b47e550fb4d6c2b59eba204dbf3ef9e69dc9723b43a9b3ccd5412d6b77715fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.57\LICENSE

Filesize
24KB

MD5
aad9405766b20014ab3beb08b99536de

SHA1
486a379bdfeecdc99ed3f4617f35ae65babe9d47

SHA256
ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d

SHA512
bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.17.1\typosquatting_list.pb

Filesize
631KB

MD5
094ca661fb20ae7e5c26df780e0f7ecd

SHA1
0cc79e2fdf43962d9597b7eec7b34c8983c3562c

SHA256
76f100a3d96cddfbad67460eb0db1a8877a53c8a1881888b208011cd3a9d5726

SHA512
088ca8996eb3bd02f5561b026a9e36755c915d19eb9ae768ee3949491059b1c7e34117b72828d843131df50456c6a162eb2cffe74fd38c273708cd4ac6fda53e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

Filesize
572KB

MD5
f5f5b37fd514776f455864502c852773

SHA1
8d5ed434173fd77feb33cb6cb0fad5e2388d97c6

SHA256
2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e

SHA512
b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
dbc6d53b5508a950f6e66b2c22a036ff

SHA1
904ee12136a3f92a7279a5970308d6df22d8d798

SHA256
bdc8855b369f1cba5710fdcfe6b1634dda095d058eab34125aaeba5e9d1a60be

SHA512
2dd266675cc3953bd84332fb799f8076383bfdf04f32970bc181d8d27090a11b23bcef8c20b094b04a8c9053a13a0d94fcad1a9a6482c3d10d16bc9606fdfaa4

Download Submit