hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

17/03/2025, 11:12

250317-naszaa1qt4 4

17/03/2025, 11:05

250317-m62evs1pw2 10

17/03/2025, 11:00

250317-m3yvka1ny6 8

Analysis

max time kernel
144s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
17/03/2025, 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1565609426\Part-IT	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1242796122\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1242796122\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_92847482\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1565609426\adblock_snippet.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1565609426\Filtering Rules-AA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1565609426\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1242796122\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1565609426\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1565609426\Part-NL	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1565609426\Part-RU	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1242796122\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_92847482\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1565609426\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1565609426\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1565609426\Part-FR	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1565609426\Part-ZH	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1242796122\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_92847482\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1565609426\Filtering Rules	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1565609426\Filtering Rules-CA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1565609426\Part-DE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133866835502190627"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1678082226-3994841222-899489560-1000\{6B610733-B51F-4E42-A050-F91E744642BC}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2812	1976	msedge.exe	78
PID 1976 wrote to memory of 2812	1976	msedge.exe	78
PID 1976 wrote to memory of 4560	1976	msedge.exe	79
PID 1976 wrote to memory of 4560	1976	msedge.exe	79
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 4488	1976	msedge.exe	81
PID 1976 wrote to memory of 4488	1976	msedge.exe	81
PID 1976 wrote to memory of 4488	1976	msedge.exe	81
PID 1976 wrote to memory of 4488	1976	msedge.exe	81
PID 1976 wrote to memory of 4488	1976	msedge.exe	81
PID 1976 wrote to memory of 4488	1976	msedge.exe	81
PID 1976 wrote to memory of 4488	1976	msedge.exe	81
PID 1976 wrote to memory of 4488	1976	msedge.exe	81
PID 1976 wrote to memory of 4488	1976	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x25c,0x7ffd9d59f208,0x7ffd9d59f214,0x7ffd9d59f220
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1780,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:11
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2388,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:2
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2440,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:13
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3432,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=1784,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5088,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4912,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5412,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5412,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5576,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5748,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
  2⤵
  PID:5076
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6312,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6280,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=7004,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6604,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:14
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7200,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:14
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7192,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:14
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7172,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:14
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=7264,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=4900,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=7304 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=7424,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=7392,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=6936,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=6636,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=8152 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7316,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:14
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=6948,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4988,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6444,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7768,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=8024 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7780,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=8444,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=7776 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7972,i,16000697006393589419,8554677668534422765,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:14
  2⤵
  PID:1244

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
19a88bad99bffbae6102e191cfedd75b

SHA1
df476b325df883b73eda1b2349bab45aa22e808d

SHA256
0d576dfbde1712b7288e4561e3eea75ffdad84dc50a77ceb57a6e9c37d60465a

SHA512
9ec5eb487d8c8fc8e283a94bd43afd740edc4df6a4509d83629416d040586bd42330eb0da6dd41ec1e5550bce9a6643319ff8584f8638a9cde9042fa406825fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
e09642f6c8871215aa78d35da2488818

SHA1
9805ed1b9ec6b2428cab6f1e7d2cf444399d8901

SHA256
7e82618d21f7fd2ebaae940b9567e5b6dfc63f1a5130dc8835cef5e51d80c303

SHA512
c6b31d0a021e0de4c5832fe6b62fdc8c51395009aeaf98135864178ccb0c1ce1d9c20cf2ad6342797db7a807e8d6d7657b5c33802cb5e130d96e2daa9d740bac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe583dc0.TMP

Filesize
3KB

MD5
31cc2d828fe130e8c413922d6f056c91

SHA1
5bf02684f9d5abe7aceac0064cdcb1acd8dc6ab2

SHA256
17558baa8bca4e2518070d02834f0aa83ef3a6ba59a11ff2d6a21faeb16ffa83

SHA512
53e7d1d38c9ba8047c344418adb352e3d3ce9f42f082959ea6763972521f7dd68ab3d2dc049a9ffaa150cf79cb75113f0ec488710b0c3a978c32268a21b2ac29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log

Filesize
33KB

MD5
8f96f903ea2ab939f6e1a13241d40712

SHA1
af61c99652c5ad7c68d2313e10ad25f2fac91169

SHA256
51ad1616e38ff27742c4bf71134391c337be4031f596a81f652b2954737d0776

SHA512
19a6a93765359ae4a9f35dd9e2729652a5cf3ba55c1748d248b6892a350e3169697001cec9d55d316b8c4a7525a30f071789f0d4370a240e90cc902a553581f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG.old

Filesize
343B

MD5
636be873711ad361300e4ce462811498

SHA1
1a48b6c89c705b19136ad46b1c9337a1a574e514

SHA256
94434d3f74874b92c1a9e5541d0a4b1780db79a64d6b273831e0d7e1a1c75424

SHA512
b6611487fcdb13e12dbed81adab372fd4e0724c3b38c0607e1269e91be5f2d29d82eca0797dd08ae95649dd8d65ae40b08f3ece5f633087fa274d3f692761e82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2415fda2-d782-4c56-af27-29adb117f52e.tmp

Filesize
211B

MD5
49c2f9652e64fa8c47ce1c4819226479

SHA1
3bb9adb3072c5e1357d897729c8f4415375e0eee

SHA256
9e937bbfb433a18f6313e8f137f865ee3ef4076dc7771930016e5350ac3d662a

SHA512
948e7f928ef9ae7e47b8492a8c738f73c5e5d451dd97cea5f2efa76ff742a6b94c4c16c2b1954edb9036baa31ac1c86ed78dc4ac1fb35a0b9ae82e28edf4a454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
5cb188f399490f311161bc8e5f29f00f

SHA1
bf71a393af3efdab149f62f1b6a94524fa9aa79b

SHA256
41c1d60cdb6d9ca62067dfb7a4f200d905051f5e909fcf40887e62752c0ef5f5

SHA512
3baf64b1ed8c30cb593df351cdad4a91d411890bc12490a5133772589ee83a4c5af6e4a3f5d1e080505c2a7728b16ff17373b6f7422df5ace45fb4e41192be0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
f00037a5d37922c3d21cd51cbe6f6e73

SHA1
70b8636ffc2db28eff2e573ecad9662ac21f49a0

SHA256
457253cb61847bac8302166f29b4d9cdef3af3a9987c6ee7ee3a8da36d1f16f5

SHA512
e76a85356cea251b4b8aa312a23d72f19fe97c5efa47706863a3aa884e2901fe81c526c3010f6c474517876b1581cacb8b28863c124c94b03ad42cf0fb348fa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
0b4fa120a99bd07badec78d4b0018af8

SHA1
000a2f3e6eff63823e2bd9f819944a8bdb7b356c

SHA256
b913451f4f16e0e19b38f362114c394316f61190ec19cbcd0f2e05d6edd93fc1

SHA512
11c3edbcc40886f457ebf1cf4d62b0f7b201f3567d79a0a1afbc2638ccbc3fc4312433a40214b1dfdf894488fb7ae572baa665ef8b6a04fef497eacf75ab288d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
e3de96ed76aa9509934b187687c3adfa

SHA1
bf32276374b4814a14f1ffa6e17f482041e57cdc

SHA256
e07c687ab10b1736dfe9cec0d2b1234e10deb08142a68180d966df1ab34a9d6d

SHA512
04b51b60ea69b8471899f53573423b681145b4ca1a43f6aedb43faa0c9625ebf6cd5cec2791377e567fbc7dee33cf5c0dc8607b75efb4cc0c46bd78085852bca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
175b193022c3187fcde8dd48e1285f81

SHA1
648e6f39070474a573d7b5048aed8e4d50e3acec

SHA256
2a5c1b32f8fa774af1cddc7c10439a540545a74816afdf95ac6547b3606674fc

SHA512
1d92d7e8520fe1aebe176dbb9aa7ef9fb63e4bf2616c6db7ec291353c4af193eaee16242c0a97ea8a5965b234c7a7bd94141ddbed25e6592685806edb69c9a01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
5794a40aaa072bcdf6eb7b271af86b05

SHA1
a052659b284c854e192f42cb57ef8fab72fc5ab6

SHA256
b3977ae28bf6f198c6403026e10d012f19047e04aefd0c78c0c4fed35837b986

SHA512
366b3a736b21d870977a8e69466de6e3261fd014ebf219a64ade1bc6fc0d92fc6c0024b30b784b6f39627bbd761ee43b7e3f500ffc526a1e6cda6d0de3f8d730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
c7346c9c279b179a5122b50c0414311d

SHA1
b3b1b52a469a140062f369259f003eda497f5f60

SHA256
b40864292ec881f26cd216ab09921235ee516c3968c3824dd70bcae273b62f9a

SHA512
6c677dfb3d58d657a288e768b1c720f4c6e87e0a6eb50f970ff9b2bbab2ff3967c06719a13cefed6790a46789d914d4cd4d1e76fcaba3a476ce817c4aa75a783

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
c1a0ad885b2384e928cc1b44d8e3d9b5

SHA1
edbf9fefca5eb1b2213866e515680c2355513d89

SHA256
758aa9e530983206ec04defe307939e1be256ad9120fa564730dcc4b19a36963

SHA512
da5a17541eb634b1f7070677b8490581e754d824d5710bb6460fd15ad292e808f8fe368bdd44e812489a98f2816ac8d45d5506768e57860d6ba78ed31dec4735

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
f36749ccce1c702cd2440965e2eb0983

SHA1
298cc2d0330707e47688ba73b9349a8cb7e38497

SHA256
759814ef31b89fcc6fd33b7108d13ea524e4e8a5a287496de0e179e54bd6b6e0

SHA512
3d96f7cd03a5b2187f53cf9a6c59dece0f4159d8a2a7c036c8f7eecdb6c77a220d9be3bab5d16323789dbb278b32487c1894643d7ecda64dfbee93ca4fffc44c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\13bf7cd5-3f0a-4967-869d-004c84656018\170ce29fd1bcbf73_0

Filesize
57KB

MD5
ebad9e38f8014c36a1e3201fd36c96e4

SHA1
143a9d59eec9119f997134c92fac6a2e17b69ebc

SHA256
c8f0ff6e99352db1ca96ee8b18f53ec069eee05ad2df3d80b28db7fae326aeb1

SHA512
abe5a8d2a183da35a26df0860c8ba86be10c40008183c51badc513adf033f65108bd62fb6dfc7369db8c9ade0963c175d2ffa7358d5d6fff94b150902b8340e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\13bf7cd5-3f0a-4967-869d-004c84656018\index-dir\the-real-index

Filesize
72B

MD5
8853529df06f348162a9ea298d9cd6eb

SHA1
af0fd4a205fa0c1e1a6ce751dcb0472a48494494

SHA256
34fcdbcbf13a1c109fe8ce545432f70fd4920aaad1a58206304a9333db71fb20

SHA512
c03c11db3dbf20a20de36386bdd20591fbd687c4cfaf49acf40f0c68509b4cb1063b3afb36533e9f0c26cb1fffe7b460094fec5419215c8d716346fbf225cf50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1c69df4e-2ab3-4856-865a-c7e5f53027b4\index-dir\the-real-index

Filesize
96B

MD5
94a5018a5afee02cf8af5c85a6e904e4

SHA1
4c8810386234b0f1c59ef969225ec6240c40f461

SHA256
0b4603b720b763f06f8e83f9cd029451531dac6028995079e0a65dfe07667ab8

SHA512
c2361b9140e3c235cf0e912969083e1724f529ed2944bf94090043d4bfa4cfc2933f5b9d5b725d6fac92257fba23b46f62f87f292301a479d86ec85509b86901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1c69df4e-2ab3-4856-865a-c7e5f53027b4\index-dir\the-real-index~RFe582ebc.TMP

Filesize
48B

MD5
984e45c1276b44285813e728199a8469

SHA1
1bd0d496d5ea21bced80cf70658d1491b5c5b4b7

SHA256
dbbd152f9d06ec6ca103b0ec85e00fa3f5e5111d7e0bac62e55ae1ccd36f628e

SHA512
d86e6246c33a2c96eba043b71a10e443fc1acadc1939ff123b8769d3241158af5e5b4679ffca6515a8d02101b538162cdcc6b4e8dd7872235214db6fb9c0c7bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6de81848-5b24-4103-b044-7a04b1ce3981\index-dir\the-real-index

Filesize
2KB

MD5
8a5f049fed9800225f85f32dfa526fc7

SHA1
95187637dc5ca16777e7529b3df34fe21d412dbb

SHA256
b1d8b898af251352e3258e90070137f90460decee6a401487e20679cc587eed1

SHA512
9ed2da2633bff5df059a662effdc159bdc813c6431c5cf30a5fb6cf8da71b87ade536a432e3a9b18332963ee299504e1040c9394547fe024cb7c36196efb1e77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6de81848-5b24-4103-b044-7a04b1ce3981\index-dir\the-real-index~RFe582805.TMP

Filesize
2KB

MD5
0b8aa8e295ff1f0d7da5456906e9ee1f

SHA1
1ad6fb3221eeb70cf2cb9c2cc75a44287a4321c7

SHA256
c8e50801626b69101f8b3a880cedbd1e8a815b3d43e6508877e06264ed2da3e8

SHA512
b885f75d0e777f897ba3b835dbfb475383edd7c5d98b63762e25bc3244bdc208f78e763058897d4771d1bb23b1f612ab1b00fd120d4edf231217827a81958c46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cc7ad1e6-2a51-4dc0-9579-f8bf6674ff51\index-dir\the-real-index

Filesize
72B

MD5
384fc6a01f2274c56a38cba173449bca

SHA1
652ccca3bfc7e30e664983d0875c486d8ec9953f

SHA256
709f12d517e2606c8f98227ddc9faa55c7b0aba8b083fe56204cb646c43844b1

SHA512
40695659ec22af2c97ae662fefe2703deceb681bb2a25fc959e1589b14603ad413f65687666ee16ca694f256c7493f321b1f86f8255ec3ac460991010b840867

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cc7ad1e6-2a51-4dc0-9579-f8bf6674ff51\index-dir\the-real-index~RFe581066.TMP

Filesize
72B

MD5
ae29160f15b7f2fd1dbc246f96c4940d

SHA1
8b4b1b9188e74240a2c7138196624c5499043a99

SHA256
49134f4b5810df62371da51286f315c9a446c838ef8ac177d453355f19561c0f

SHA512
cbbffc718d9eaed09961971f6c14da136781418fcef18de586b9f216f53bd4ca16a99caaba333a4b89e9f97f1710ffd5e36a267f2b87090c64f98300332d3b17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
327B

MD5
67f02d589bb1c77623b276aad10111e7

SHA1
1d5720e37cb94f2b58793106f010ad65d52dee90

SHA256
d9f00a3c38972dd179ef7faf14297ec669e33a250df2d572694c3463c64bb7fc

SHA512
737dc333d1b2bc340fa07d7efcd8999c5ea319608e8981c5f2742656b78040db7440306702fcf77e9f3da9fcbc643d5aa7812c7557b8fb851aa2df523cd9f9e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
322B

MD5
bb96dfc9d2a8b93cc6732e2564e877c4

SHA1
0f251812de3b7e70cbf20c76931e7ff04e57313a

SHA256
d4fe71754a516f253b861da8482eb576678bbac10e8ed5eae12bad6568a73761

SHA512
06913fe2b9208127c230e7318720fce7e1d66eb3bf52e0c1884262d496c76b9bc5e14f0d962bf04c6b2db8f2d9460fe92f3d1eb741d52191d5a12e2696999f34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
192B

MD5
ca281c436a4961db13e3b4027fcf7aa1

SHA1
01704ceb89d377f77529f778ea4560a64446806a

SHA256
3efe6c5a051539eca20497ed03b87b3531b6e9dae1f2fbfc5ea31ca29ee23006

SHA512
1d647442db39fd4e4f53ee301b3683a0893c17549c138ec98f2aadf24c7a5b628891aa8ab9d8412add3ab65f7cadf26cbadfa89483be1fc96736758a54a36d0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582a18.TMP

Filesize
72B

MD5
1d129f177ed37f3a3c2fcb9493ab6532

SHA1
801fa8b2d3e76514540a45c899a3df1fa54c57f2

SHA256
49184463c5defcc4d63e355d44c5c0d181b24d103bf7631be9fd1b3cee3a9e03

SHA512
7d11a3e9e6dbd9023bdcfe5324b93096bf68d5c86dfd57896448caf87a9c03f6d104ea91c34c371a718f350a8b709ec27ecc75bc49270e0391088f91ed8fbcb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
2210465baa2f0dc673b66c5b42334a6a

SHA1
97f5adb01f09c205ee9da1c573a9c1b48f2daa08

SHA256
aaef0b69928d49982a3d59e2a5f45cab3a51f4c638667e527df29ad7f7ebdfdb

SHA512
936569f5cc34b2e8675c3fe0aa4981340dda3c9a33a1447a1d0cb7c749052a2b0d4cebebae5932cb2de1df1bf28a489fe7b1f1f755f1587387f99e98a3f345a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
464B

MD5
66c87b54b8944fcba6e8e46e89373eaa

SHA1
779db197dd446646585e446b0413fa26aca35641

SHA256
6ce3e29ff8852458b28a7741184ef16d7a626cf0ecefcbb34a8a522d1a2c0239

SHA512
6de0583d7f45452dd0a79a8a4cf3bfad7200c99e3ebe1782c44861d8dbfa48cbae909f952f0743b80187aa1479a75f5b4329a3c778ba1d737975599c55a287fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
c67318ee5ece98b986ef0dfa7392640f

SHA1
1cd69e0681016428ebbbfd04bb97441751fc1438

SHA256
387209a3f92ac1c25f7998add8dc3dde3a4dffc58b44428cc38be953b1cfa2ed

SHA512
781e546bf95c587ccbf8181cc0f37d9c617bfba48736b1fc6206035fa21cdd6b8e9163b46d49d6b9c1b49942eee588e5fcdcb02d092d04d325afb1bece5cb678

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
172cbef1b5d19ed5144a6387386eb552

SHA1
e7b67dbfdd9ff21d6a6906cda4c30bd22e4fd605

SHA256
da7ba4735aa2071e57844d7fbd7ab97899575d9ba1a05ea4b3bd020dce7fd038

SHA512
222048badb839eda5d7ff1308f6b7f2cf630291d6285a179e7b1c733fd93a07a0d11b57687eac3aefb9a01497657d86f0f66e97c11fbe505f9051395f91707a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
8403b21498b45548a858b4fb6b35fb88

SHA1
f037816f7064aa63edaaec76f2cf7f4b6573f120

SHA256
e66a25a3c96403d3d1d6348b0140cf3065d62f85dbb0d1edd000a5cc9eac81c8

SHA512
7fbe0e3567a2a6644078e39a336e6b300bab93c89e0c00978e897bc78e79e5b3a669c7b76029582f95c64d8353025d5fad3c05227ad4e8b6f2a0576b97494028

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
77d2f261f60ceac3cc0b59b732156410

SHA1
489e1c5bb97ad068b6eaa30e69ef0fd8c58d1855

SHA256
b778bd31e398d30fb1832638fe47d7bb9fbfa9bdfb319d11d3c5cd57961e323b

SHA512
e26d914259f57476b5ad4334f34568aa0e8a7e078fd0c1996c7d0d8b8db8446fea72ff40b0c8d1073946699385f4bd2b42335b235f9e177243c00ee641b3c55d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe57e85c.TMP

Filesize
392B

MD5
11b4e58e6aa0c6841636001f89b86f27

SHA1
32dd8faa0fab77815f05a82abdae0caca467568b

SHA256
c4ac300b98e7f255f121020e7fae7097747242f840d9c27d17437bb8bfc4d34e

SHA512
8762e76a5604e6d5518eef08a40e27de1f27ab070a5edd9de8053cbfcb382699a7a04cef4c5bbaf681e065d1a85124abb6344c53082e1d6376a75a42ed6dacf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.57\Filtering Rules

Filesize
1.8MB

MD5
d7c9c6d2e1d9ae242d68a8316f41198c

SHA1
8d2ddccc88a10468e5bffad1bd377be82d053357

SHA256
f215127185b2ee6b01e12b6ca75d3e5c4e454598dd4aed36124ae13d59afd547

SHA512
7fd14824e9200dd99e1fd2cee402656dc0cfc3d0a60058c5eb05c68e9e65b7f0b47e550fb4d6c2b59eba204dbf3ef9e69dc9723b43a9b3ccd5412d6b77715fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.57\LICENSE

Filesize
24KB

MD5
aad9405766b20014ab3beb08b99536de

SHA1
486a379bdfeecdc99ed3f4617f35ae65babe9d47

SHA256
ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d

SHA512
bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.17.1\typosquatting_list.pb

Filesize
631KB

MD5
094ca661fb20ae7e5c26df780e0f7ecd

SHA1
0cc79e2fdf43962d9597b7eec7b34c8983c3562c

SHA256
76f100a3d96cddfbad67460eb0db1a8877a53c8a1881888b208011cd3a9d5726

SHA512
088ca8996eb3bd02f5561b026a9e36755c915d19eb9ae768ee3949491059b1c7e34117b72828d843131df50456c6a162eb2cffe74fd38c273708cd4ac6fda53e

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1565609426\manifest.json

Filesize
116B

MD5
2188c7ec4e86e29013803d6b85b0d5bb

SHA1
5a9b4a91c63e0013f661dfc472edb01385d0e3ce

SHA256
ac47cc331bb96271da2140941926a8accc6cb7599a6f3c17bd31c78f46709a62

SHA512
37c21eaff24a54c2c7571e480ff4f349267e4404111508f241f54a41542ce06bcde4c830c6e195fc48d1bf831ed1fe78da361d1e43416cfd6c02afa8188af656

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_92847482\manifest.fingerprint

Filesize
66B

MD5
3dd42978e1b983a0eeed340168119b7c

SHA1
00f5178dc64c814f51f484483433acfae5234ca1

SHA256
3d17691eff78ac9236ebb6bf1e1c5d965082eecfcc8c1ad7600b05e4a8745c28

SHA512
a86ed88493cf27e73b49ad612d22f89f707de03e79769a7b3121f1007e5527ac4486609792c467444c51cb578bbdc1343584a8d31fe908353bdcbed7c9203261

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_92847482\manifest.json

Filesize
118B

MD5
acb8ebb43624ece8dd7964092455d2b7

SHA1
7c61f04b419f927f98120afa18d8553513e2a0f6

SHA256
55b2b1fd2a563b240179fde6335370f5e22068ada77b5dc5af50bbc379c72953

SHA512
8e6c135aa19d6d21b32c6e9c0727ccf3df7e8dfcaf49e3f0ce55af9b53748188949746d69d17cdafd9d77511b1550d970289912a33b3d9c4daed8837762d91c3

Download Submit