hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure[.]apk

max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
18/03/2025, 23:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
81	3476	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
228	Vista.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
77	raw.githubusercontent.com
78	raw.githubusercontent.com
79	raw.githubusercontent.com
80	raw.githubusercontent.com
81	raw.githubusercontent.com
76	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-mobile-hub\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-notification\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-notification-shared\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-shared-components\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-tokenized-card\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-mobile-hub\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-tokenized-card\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-tokenized-card\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\runtime.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\vendor.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\wallet-webui-101.079f5d74a18127cd9d6a.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\wallet_checkout_autofill_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_53940675\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\bnpl\bnpl.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-ec\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-ec\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-hub\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-mobile-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-shared-components\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-shared-components\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_53940675\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-ec\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-notification-shared\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\wallet\README.md	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\wallet\wallet-checkout-eligible-sites-pre-stable.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\wallet-webui-992.268aa821c3090dce03cb.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-mobile-hub\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-notification-shared\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-shared-components\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\webui-setup.js	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_761025899\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_134986462\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-mobile-hub\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-notification\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-shared-components\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-tokenized-card\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\driver-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-ec\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-ec\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-ec\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-hub\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-hub\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-hub\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-mobile-hub\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-hub\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-hub\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-mobile-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-notification\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-notification\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-notification\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-notification\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-shared-components\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_53940675\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-ec\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-notification\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-notification-shared\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-tokenized-card\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\wallet\wallet-notification-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\wallet\wallet-pre-stable.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Vista.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vista.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133868145766672828"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3920535620-1286624088-2946613906-1000\{F5A03119-EC87-42D3-B670-A979916D40B8}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3920535620-1286624088-2946613906-1000\{64AAC6C9-F6B2-4A9B-8C86-A7073F862489}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Vista.exe:Zone.Identifier	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5656	msedge.exe
5656	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4172	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4172	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5496 wrote to memory of 2896	5496	msedge.exe	79
PID 5496 wrote to memory of 2896	5496	msedge.exe	79
PID 5496 wrote to memory of 3476	5496	msedge.exe	80
PID 5496 wrote to memory of 3476	5496	msedge.exe	80
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5924	5496	msedge.exe	81
PID 5496 wrote to memory of 5320	5496	msedge.exe	82
PID 5496 wrote to memory of 5320	5496	msedge.exe	82
PID 5496 wrote to memory of 5320	5496	msedge.exe	82
PID 5496 wrote to memory of 5320	5496	msedge.exe	82
PID 5496 wrote to memory of 5320	5496	msedge.exe	82
PID 5496 wrote to memory of 5320	5496	msedge.exe	82
PID 5496 wrote to memory of 5320	5496	msedge.exe	82
PID 5496 wrote to memory of 5320	5496	msedge.exe	82
PID 5496 wrote to memory of 5320	5496	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x250,0x7ffb2a8df208,0x7ffb2a8df214,0x7ffb2a8df220
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1816,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2088,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2440,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:13
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3484,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3504,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4948,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5108,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5536,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5744,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:5220
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5884,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5884,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6076,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6220,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6316,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6164,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5184,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5832
- C:\Users\Admin\Downloads\Vista.exe
  "C:\Users\Admin\Downloads\Vista.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5272,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:14
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5692,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:14
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4980,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1960,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5200,i,4382971876993423886,11783122389780340574,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f4,0x7ffb2a8df208,0x7ffb2a8df214,0x7ffb2a8df220
    3⤵
    PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1696,i,8828879714917073080,14307042149173476252,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
    3⤵
    PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2152,i,8828879714917073080,14307042149173476252,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:1504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2532,i,8828879714917073080,14307042149173476252,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:13
    3⤵
    PID:1948
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4404,i,8828879714917073080,14307042149173476252,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4404,i,8828879714917073080,14307042149173476252,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
    3⤵
    PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4632,i,8828879714917073080,14307042149173476252,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4732,i,8828879714917073080,14307042149173476252,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
    3⤵
    PID:6040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5032,i,8828879714917073080,14307042149173476252,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4540,i,8828879714917073080,14307042149173476252,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5412,i,8828879714917073080,14307042149173476252,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5864,i,8828879714917073080,14307042149173476252,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5868,i,8828879714917073080,14307042149173476252,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
    3⤵
    PID:396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5808,i,8828879714917073080,14307042149173476252,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
    3⤵
    PID:2220

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5896

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
bdf3935905b11c27aebc63854e102313

SHA1
f1e736f89a90a33dbe5c1e421cb802a2b0d3da31

SHA256
1c9dba5d2eb55e580071da9aba991a4ca8abb478a775b0e87ecd01518f4542ba

SHA512
1f8c0f442bb882c0525ef82aea7f04349b6bdb2b7dffe19d5589a4f3ae68063c716698a7d0938eb15d9192c0ad15b4812474bf9bf25ddc3e453b31815114154b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
c1010623e27aef341aed8ab4dfecf31c

SHA1
b6ef72d44d00dadd451349a938718750fc041b43

SHA256
efb8dabdd23b952d6ff87da8d02be78bf9e0cf12dfc306fb4aad5538ef9bf121

SHA512
68d5aa112df67e54f1fbae2420e68ca14b984ce696f800c746d91cc13851d7a7d892144bb3f9b76c34f9e5269fe3a37e60d149fb3f159b6aa7df54a49c87f760

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
509e630f2aea0919b6158790ecedff06

SHA1
ba9a6adff6f624a938f6ac99ece90fdeadcb47e7

SHA256
067308f8a68703d3069336cb4231478addc400f1b5cbb95a5948e87d9dc4f78b

SHA512
1cb2680d3b8ddef287547c26f32be407feae3346a8664288de38fe6157fb4aeceb72f780fd21522417298e1639b721b96846d381da34a5eb1f3695e8e6ef7264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
d5cf43f233ad4156ab7976d76c422ea4

SHA1
b97ebc55008763644838910df6d1606ca718777b

SHA256
f6d03d0c0fb46bb5996b90305fa2d84802fda76d2eeca6a6cb95b0b7cc153d1b

SHA512
c1e43133cde9f312350d1aeabebe9a70c1b92994b8d15fefd664574af3152fefd9e3e323af96f996a6f8dd53dc4a189f215693f95448aa110df6b416d5497e9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
3dec492b1795c322bec095658c7cf4e0

SHA1
3a75e115e18e92c0cb6a16af044db9e08af68196

SHA256
c31c294f5d663f88926ab6c82f6432134bac0d6f19181442db8d140305d07a34

SHA512
f71eb89035a19a807fb19cec6579886605772a156a120a012ee901d3c6959575ed223188b2075c8b1ec4884b65690dfe38495a305c0f38d9d3d6be42164c9a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
420d670a67bc65677676c3bf95d9cc8d

SHA1
608b3e12c7cf3afe8088f462697b25d8200d2943

SHA256
78e3a68e54b75ff58d6816df2d1503cdba7af79eadc0d0a21fd8f5577917fcd9

SHA512
329b82d3d8ef38ac7369e7a16e4df0fdaeb46e9519a5e73c7e2b5c638f66a18b4731efd506d8a7a4f9b7342ced58439e75de80465d43402f758d3623c6c13761

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
8.0MB

MD5
1ca76fdf0140e77be4519552a6fb1062

SHA1
ebc9951b9ffb562a63b80a9f015cf71d2a3da699

SHA256
43f555a147660388d00694d497f53b774c686003deba0f49440f502a69be66c0

SHA512
1b93c971e2cd136f02db6e6554442f4aa3005e9e8222058422e40f5be435c34d104720867cdad9eacc4c2b6022fa59785099ba3488176353966c5dedd9f24288

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f

Filesize
42KB

MD5
6940fc99a8ceb949712556d823b5bbe8

SHA1
fa31ee45112962896283269edb44d0ff545821ad

SHA256
4a32c789ab20ee38ac441a7599410953313154ba8935fe9c43ba31720b0ffbce

SHA512
ea81236377e62e24cdea3b45fdf5db32b1b53bfac5994d4b86328d4abc3325ca73f9047376f289d2a3aaf9671d6ba6e8c476e339a231ce003054dddf2c036701

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070

Filesize
37KB

MD5
9a0f2fed78beabcb1af818103e79eb49

SHA1
e36dcc0472152bec227a1f5a81b5024ff3624452

SHA256
bc3ea6c39f4b013cb279391c0adbbd540219cae079703926d37a82dab9046450

SHA512
c4a96707d57cb474f45d669a52e31cc4f34e783b3600781c683c88d470cc6f6c3a5c5a399af33b8a193c57df87e797087fab9f6817048baec5a75e44ff835c6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071

Filesize
38KB

MD5
b8103746b4757c6332fe545f11de8f70

SHA1
588965d6333eb015af39c7f44ce71dfac67fb0f7

SHA256
4177d563a186175d3a67091c399db6c57fc271e202406e244d4bc8ad95b1aebd

SHA512
c83bd52d674d90752dfffeb76971a4f9684054d6f02cfdbe8f336758ac46d8b430f306cc64be00112b8c38d191afd1b8395d58600b12cefcb6a052ab70214ebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072

Filesize
21KB

MD5
eb5f2f8b27b3794eb0b9d7302f3ed208

SHA1
ceb14ae185daed71ebd356c06f067ee90ca75a3a

SHA256
16a56eb5759e2174470278fec544af28e58f93a2e895141c140eef9409efeb60

SHA512
4c1441f9bc16c6c03df5c727c75e238d41aa24127904f86d18eb755564765eed86674de1d6d19406c2f9085454bbaa26c9b65f31973a364906878a9fa4688eb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073

Filesize
21KB

MD5
7e6d8ba8e3d32185d00e6dbbc7379403

SHA1
eecd73d27de29dc2a79798c6075bc91fedfa11b4

SHA256
4b836b13d01826c0194975da9d38634b98517abd13b2ff5ed9fb3f6cb6bc4136

SHA512
2fec7cb61b8ff717b44647e6f39d763d5030e22855d5ec6d3f2d6ce68ce31ee47c85d9dbb317d8efd33f05478a093861ed612d69f9c2cd8cad20f0af26701008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074

Filesize
27KB

MD5
482e69a70bd0db3690f0422498dbfe51

SHA1
03d8c267e5f48ccc5f4e781e82c7e443e354794e

SHA256
e24cd258636323a750f60e58600f3cfda0f90cea73d9fd79294b5748b7d2ef6f

SHA512
862300384a8d6218654f7c231e9627b3ec3744817bcf4267008cad979d17f413ff06f5e7c84c822683c4a36676e92aa85bbb9d6216ae3f8187a5e2c710938de5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075

Filesize
18KB

MD5
89ee4d8818e8a732f16be7086b4bf894

SHA1
2cc00669ddc0f4e33c95a926089cea5c1f7b9371

SHA256
f6a0dfa58a63ca96a9c7e2e1244fcff6aea5d14348596d6b42cd750030481b82

SHA512
89cc7dfae78985f32e9c82521b46e6a66c22258ebe70063d05f5eb25f941b2fd52df6e1938b20fe6c2e166faa2306526fdf74b398b35483f87b556a052b34c5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076

Filesize
18KB

MD5
84c3ce1d3d0b1d971e3d3f239f877830

SHA1
0cc932781f7bac01196ab2ce181ff298b98bd0ee

SHA256
ada01876fc7687a6fe35fafd68fc071adef5bcbf87323635bf985878a67b973a

SHA512
77df6eb947b861b4d5ee4c1dd1abb3f89d4a24170edc1fc4bc2460eabfb92accd687384d2ed9891bb9f1bedcb52d6f583d4604ce5c924a1e91249b8632e2f558

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077

Filesize
60KB

MD5
71fe7e61e7b9075031b40a1905c31c77

SHA1
1b19ccdc0f0d3b5e40673397ce71b6589eaeea59

SHA256
5438d062ba58c782f2aec6cc59b09d276cced94918e5cd9155dddf3326051e4c

SHA512
0426864ac6a35c06d7604d3114fb55972c772304d196f412bbbfc4aac0dcaec8acd7782abc223392aaf3a4f196da4a47968b420348d9a78b72a69e0f96c5127a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078

Filesize
16KB

MD5
dde035d148d344c412bd7ba8016cf9c6

SHA1
fb923138d1cde1f7876d03ca9d30d1accbcf6f34

SHA256
bcff459088f46809fba3c1d46ee97b79675c44f589293d1d661192cf41c05da9

SHA512
87843b8eb37be13e746eb05583441cb4a6e16c3d199788c457672e29fdadc501fc25245095b73cf7712e611f5ff40b37e27fca5ec3fa9eb26d94c546af8b2bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079

Filesize
55KB

MD5
92e42e747b8ca4fc0482f2d337598e72

SHA1
671d883f0ea3ead2f8951dc915dacea6ec7b7feb

SHA256
18f8f1914e86317d047fd704432fa4d293c2e93aec821d54efdd9a0d8b639733

SHA512
d544fbc039213b3aa6ed40072ce7ccd6e84701dca7a5d0b74dc5a6bfb847063996dfea1915a089f2188f3f68b35b75d83d77856fa3a3b56b7fc661fc49126627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a

Filesize
45KB

MD5
4dbcb483e57db903c4e2b0ade4ef157e

SHA1
97ce0b9911d353c8f68a18429ee6000af2440897

SHA256
bb92dae15cae348977d29d480aa14b1c320930a1b3375857e6120f3f160a00d9

SHA512
dd6efccec52900da1c4f92738ebfe2f1fccfbf9091e89a0bf35787ce5787d4937c6f77bae5b06c79505e8b1fccc395e37bbba08a0a9f37bd435c8dfcaedbf78c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b

Filesize
87KB

MD5
65b0f915e780d51aa0bca6313a034f32

SHA1
3dd3659cfd5d3fe3adc95e447a0d23c214a3f580

SHA256
27f0d8282b7347ae6cd6d5a980d70020b68cace0fbe53ad32048f314a86d4f16

SHA512
e5af841fd4266710d181a114a10585428c1572eb0cd4538be765f9f76019a1f3ea20e594a7ee384d219a30a1d958c482f5b1920551235941eec1bcacd01e4b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c

Filesize
68KB

MD5
bf76f063663fbd318f710387d52e9f7c

SHA1
fa4f690273d0eedd85facfac1d7cbc0421ef9497

SHA256
9f30b0f8955d35451947d214a995a2d101666e6ca6e4bd38ee67031efebca785

SHA512
54a8cdedd7a0d3664e8b5ce2295b9a46d59e71c26c07fe51071a43d970a30fccea964fdf82c9f3f6ff02c6c9665819336d45a5c8bf3a5e034554a6b1eaf86ce2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d

Filesize
110KB

MD5
c0399e6d4556acf02013416c3a3af8d2

SHA1
cfd275764c4aa78e272f0bc6d66b8506efda3c80

SHA256
faed6ef527975d8c81afe700f2cd3f24a4d4ae068705d460904dde292f25534f

SHA512
6f89caef920af72a30028c4e002f5504a0d7e40848fa17b48d2ea0854739df2b0eeccba606773f8347adf2784b4847f13d1431dd2d31fac49523b548dc11d1a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e

Filesize
16KB

MD5
dc491f2e34e1eb5974c0781d49b8cbaf

SHA1
b73ca9b5f9c627d49da4ecbc3455192e4b305a3f

SHA256
f956049f0d96d455a71003eba400cb94f7067bc52620cd05b81006ecfdd438d8

SHA512
5c9bd0d5c93a05ca76eb727328a0fde40f2be7fe53b6b6c9eb260e8f20f92cfc831fd4b46f954d85baf151ae8aba1cdd6f76b0faf96217922cad844c905f3645

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f

Filesize
19KB

MD5
5e5ae2374ea57ea153558afd1c2c1372

SHA1
c1bef73c5b67c8866a607e3b8912ffa532d85ccc

SHA256
1ef458d087e95119808d5e5fecbc9604d7805ea4da98170e2c995e967da308f3

SHA512
46059e4a334e0a5295ebcef8401eb94b8fa0971b200f0f9e788ed61edae5018c917efd30b01631cbd6bdadc5240c9fcad2966ea0aa9c94b538bcc369e10bbbaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
31d2107edc6851e5e215ccfa6578fddf

SHA1
197b000ec8ea7ec82ff49a697e8a9e1eff2d487a

SHA256
510ee33294991725d2e4e8745209288552d73a2f2fdc87655b84ccd2ecc36d29

SHA512
2dccc4cea88ab21c07239b975f9b71ec84746236e799aea0f22c44f4b8a38a5d1b46c5275bebbe737c12400469fd5508319f42c5853709170cd33e7bb96c26ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57cbcc.TMP

Filesize
3KB

MD5
71c1423cb081afe863eb5afa4b980cd9

SHA1
02a376b168d20d192187134472e3c2eff6f17c86

SHA256
d004b3b0b28bc71bf9dc172ad3eb31af920407ccd3b5b0d3cf840e0ad3b50489

SHA512
e3dd95f2596073d43f5643c8bb247e75656c44076a664fcd32206a4f8a76031e9ccc97e3cfe5f2cd90c9823ef6e487c0db9bfa44798bec8d49ef50747ccf3482

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1

Filesize
264KB

MD5
33d1796a7e7cc9eb6fc0ed7ed578a56a

SHA1
5649474d21b32f91baa45b8505935d80af803215

SHA256
6efe7789b63196a97b22483d2285e34dce81f5a8a49c4099376916016ee8b687

SHA512
49fe9b36857712a5c6ecbae8c47d5cc7de7e51a2726a9d0eb6454aea0c94a6f510c78b75b78410365ab6947d257b16a21619920558e535e8737e53b2a95285a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
50697891aeff3e03206d8c5507472ee7

SHA1
0f547c8a96b8f8828e9443f6a42669a03b26d944

SHA256
a1a6e249a7b5d93665d64ba0408e1bdcec1393f951749a85bb5e0c28e573b75d

SHA512
031732884cda48267a57b59ea5cde542a4aa1cbb04a4af6659dfd1955a46a6ce87df42538c3ee9204390d477f96d39d9e6b6fc2583da23a1c21314ed9e84d814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6c561363-6340-4453-8efb-e50c04040e45.tmp

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Filesize
20KB

MD5
5d8111509aa4c32768145e326021ad0b

SHA1
030d833d63f205635e51fe19ddd1dfc04817ad5b

SHA256
d88de34355136e54d6b7b618c8fdea9a9c0dac0ca01603afa85abd1aaf3bcae2

SHA512
0c00d737eca40bfa7a4f57168302e675f42158346dfed74d6ded11a330b3ca7f90b3455b8d9c714b7f013e1c1c7d0a85fbabe87e023b48f5f2da3d5d586700be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
acfad2e1cdad987c78a4e41b588f9f81

SHA1
7a81b879ff34eb5f37cd545424f7f984c8e7ddda

SHA256
d90cfade2405f0f8b78f1eb9343c7db6a2802d5a0247eed2339a631f5473c499

SHA512
a51f25e9f3642fc920c586c1127293843ce37ca172112e73a6660c338a3260667b4e631bfe36f1ee874630d1a5389fcbfa0bfe098302e3c05b727dedf6fc61b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
1ad072954a9b1ee80e3718faec34fa05

SHA1
58c367dc68a1d3ef7f936a3adea56088fed27c7e

SHA256
95d1673274bb8fae9429e7a66ddb266a7623d4e4e0a322fe288a2d5ceb8c15be

SHA512
a768d4e5ea8f64cc7ff4bae90089a26e006277bb70ab74f854a747c84f794ea389f4ed400bb6a6072654504cb1bfba37c8cb7de9af8d312af9e8c4ccf1fe2b98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
bbea2eae37a5c9b1f21157f173419d8c

SHA1
19427cee1652d54869e775a496ed0a432a97a096

SHA256
2f62588f54c72a4f60417471b5818f346c24b884b2d6787f09d1270b420cd2e8

SHA512
05d511b4529676d7c421feb3a396bf88399987001d8e8fdfb99cf0abdb3413df8175ea2d61165fa40be1197c742eb32cbd5bcb586191e924d4d5d6cf33c317d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
795a14906abbe675878c7ce26cc9f2fa

SHA1
6b7ed2c46575a965c9f7124b90854754fb6e34cc

SHA256
c996ba8bd81136063b580081543d92c0d4696b4e2c1f9698061dd6045e8d3ea3

SHA512
cc3c6de786e2f3122fabf0748c39dea66b34879a6a3f8e0c9411db6473703b7485e0e87fb6be00219e876757504cdb7abe7d899b0b316ae0da85f8230427251c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
0ae896fb611feed73935912f2bb17ed0

SHA1
095f2e62509a3f9e896f8f17e07a78aee2c8d829

SHA256
d2c1d75290cc31c0d1a0fa31b3bcbd1dccb9c81f266420fe3cd2264b26bc0dac

SHA512
a27254d921ed0f27e0726b5b37563f11a415724b972ac6ed4ed3f6ebeaae5d71105961cdf5d2089e2097e9cb651cd8a59b75b6994e41528603e4d591a87b46ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
7ce7dc687dce686c4cfeb1d64b834dd0

SHA1
e869eca92d09026881e4359297bc26bfdf7540b3

SHA256
0805fe200b7a9561050e727bf23e952d7593c78ea9babe2b02146156166fb316

SHA512
14f6c370d4f652055299165d69ee8cd819675de0c16463ebe5881e865a3045d30bf956ec4391826b33ed6dfda9a43f00439254a4c03d00be66895244f52e0f70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0fc5b3b-1c80-48cb-a8d2-b43051a74a70\index-dir\the-real-index

Filesize
1KB

MD5
8e170c84ebd030256c3874201cc40b90

SHA1
945f8f29e8febced6c57c29aafb5b76c8165f364

SHA256
a44cba1366a9dcf604384dba59c5bc856db6d1f8aa1e0dd1048a6c9ce3b4d8fc

SHA512
639a679825f7a8328fb1a1048d48e9bd40e94da47a0b82c5ae4e1253b79b0a4d08abc618946a399912884742ce82aee3fba3b50bdc1c3c62e0bf1823585cc7ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0fc5b3b-1c80-48cb-a8d2-b43051a74a70\index-dir\the-real-index~RFe595068.TMP

Filesize
1KB

MD5
36dbf56c7994c882c6d9b0e4a74fa1a2

SHA1
837202d0f7f7264eb7037811e2dd63ffcf1df94a

SHA256
a225f1b95e1cfb3161408137fd5e42348b7ac58631ccddbb6ccfc572874ee4fa

SHA512
c1abb9116f63ed571bbe3c77726d80948842314174acee575b0ef61928292d1e074b622278bcf9651696c857973181ce5dba4e152973f374a432266081e329ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
76d295132899d77181e9632cdfed117d

SHA1
b41045a019be59adcd023f28958d86d80fac49af

SHA256
f8e48e3527564c13c98d4fec254c0eadd4d9e2c0969a630a2c09aba1ac51147a

SHA512
b950f46edd3064824248982a26fd8968bab0e7fe08073cab49bf8509643e3aa9a817b2b7775814fd6752f3e52b98fca9a742e8089d3c895bb9f42ca711415884

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59a5cb.TMP

Filesize
48B

MD5
e31eb71a55430906b6d7bbc5d1585de4

SHA1
a056b3465c1e51cf7954db139f256668fbadbf5f

SHA256
c4c46d23d432eab0b57ce3f8682a1ab00a7967e41d5e9815338fd12a4a6df7a7

SHA512
7a15faf2771a230b66122692a326fe0980916eab504c38246a0bb534b51d78816cf0988d362539f7d99bcbc76da4db4b455ad2d4426e579ef7228b810101f1a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
ee1c78bf876ec04ea63c4a9336469f1d

SHA1
bf00a3d11b867f1d8836c70c3f7cfc17ee4c081b

SHA256
1bed9e478ce82bddfdabfd0dcb8ebd226ff17ed791023f0029fbcb2700f1bbf6

SHA512
569c20ac6224541d38089a7eaa86e3a6247355dedb0d12ed7a04aa4f08b11bd541ea654ed5b5ea64e41594d26f32e533532b845f61a1f0f62d6570b5d02e5dc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
42270d7cc49c741a0bad10c662b3326c

SHA1
04c145124b08b0113e62bbde70109a2bffc3f5bd

SHA256
d2b25b30a0a23b17715faffb8a990d270ffd0408726697c2c89f641ca29fc857

SHA512
ccbb1fc3a905de3c590b3203110fe7ed75635fe629f8d64d5556855703f6257ac0007babb1f3c5d34b1702b4d41dfcddf3d4592ecacf66253c81ca727151de1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
8f90e5e9e6116a30d6599d024894ae4e

SHA1
8b0e810f492859c3562d643679890c1552930be4

SHA256
235ec233a2b017fc8892d81de23df2491d5455a9fdce41404e319379f2733eb7

SHA512
3b78ad5343d6326e9815d10b0edafcd24feddeddfa25db67d294dfde927654d06c31a92939125fcbc47e31fcd20a3f08ea729222b24310c725ca09e8661722f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
25ccfa8a628c6ee6ef021b692e54de45

SHA1
46e9a0d87f54342276276d2a1bc39296d0b74fbc

SHA256
76e0de2d4d06197b22f3bd01c493e1487967fbfd68fd861a10ae3d7b181fcf49

SHA512
e200568e3ca3cfa36a5563effd25d5437b47e9a3f88612aef78a51bc30fed5cb9970bf4863cb542b1d5899e5984ef4027703633a629ca1204a8d58e0dcaf80a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
69ea4f14ac9c2d059b81959b607a69d0

SHA1
e8e4c6d49dd3a38353900053dfd375c5787df628

SHA256
1c7d0ed9c3c347ed4cf2717962e31f5390181b01abefff070e68d81817385121

SHA512
caa5a592a12acf11612a0848a9ae73be4bdface62e9bda1fac3c084b1d3ae6ee40ca3e956cd2fff9dd7ba6555e7b2641cf765b7a9b52be2f7a0878457e46b115

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
18KB

MD5
3dc854bb525ecfca47caf56ce801c4b3

SHA1
28b312a07070ff57f3b4e4bd56e3462327ab701f

SHA256
840f36993cdc8fe94c38271b7aa02be06c5cbc8017fdb2e99abdabc1a2f806b3

SHA512
e645360e4adf56bc0a6ed08834e064dfb798e6b937b1be0ade700b7d8c26daa9c3706462fb04480b1acdacac006bb579b000d60a30a123c1927edbcfdf634364

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18340.18330.1\json\wallet\wallet-checkout-eligible-sites.json

Filesize
23KB

MD5
16d41ebc643fd34addf3704a3be1acdd

SHA1
b7fadc8afa56fbf4026b8c176112632c63be58a0

SHA256
b962497993e2cd24039474bc84be430f8f6e6ab0f52010e90351dc3ff259336c

SHA512
8d58aa30613a2376ccc729278d166a9b3ec87eca95544b9dec1ee9300e7dd987326ea42d05dca3f1cc08186685f2fdaf53c24fd2b756c1ed9f2b46436689dc74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18340.18330.1\json\wallet\wallet-notification-config.json

Filesize
804B

MD5
4cdefd9eb040c2755db20aa8ea5ee8f7

SHA1
f649fcd1c12c26fb90906c4c2ec0a9127af275f4

SHA256
bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd

SHA512
7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18340.18330.1\json\wallet\wallet-stable.json

Filesize
81KB

MD5
2e7d07dadfdac9adcabe5600fe21e3be

SHA1
d4601f65c6aa995132f4fce7b3854add5e7996a7

SHA256
56090563e8867339f38c025eafb152ffe40b9cfa53f2560c6f8d455511a2346a

SHA512
5cd1c818253e75cc02fccec46aeb34aeff95ea202aa48d4de527f4558c00e69e4cfd74d5cacfcf1bcd705fe6ff5287a74612ee69b5cc75f9428acfbdb4010593

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18340.18330.1\json\wallet\wallet-tokenization-config.json

Filesize
34KB

MD5
ae3bd0f89f8a8cdeb1ea6eea1636cbdd

SHA1
1801bc211e260ba8f8099727ea820ecf636c684a

SHA256
0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d

SHA512
69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
62KB

MD5
fa4c531b57aa5fc314285212539184bc

SHA1
3d57b15fa1f1157668463da1046a16132a04541e

SHA256
a476e0cc401ad01bdaa31f79795c148032805464cfecf6b5740616eb2fadcd70

SHA512
eacee54f7a03fbb4a68f7b41e08afb30a36b1354c1ba9b672bf4856eeac29a35800f01143206d9d204111aef5a23544cea032ac9749322bc8705113e9a512ef3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
c3639b0092de79886f25218bc49748e1

SHA1
666e84d780ff56fd0f14962d937adf24e23af155

SHA256
67faecb7432f9bb118b1841f855b7979df57ea732ebfdfbe8a6c6377400c1870

SHA512
7ae48a044c9e1cc92b20ee9579f615cf6ffd0dd0801159621ef6ab0da378cc7add0a58e77d7c66977835500ba6ca78033c884ae629a66ea86e626f68fe70d684

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
6c6a794469b2325143021002a9029f8a

SHA1
cbd54cb08950a55a5e374e1470f0ffa9bd50279a

SHA256
3b8606a709f09a9bf11fe061b8ea8938412e359b0260dce1f27599ec9e7b2221

SHA512
10d2f2afb422e60c04f26423109a116826ac449797ad288f747afe04a3dd1e2d83dd5767d1b98d4aa3703cafe3af731b3fecc46cd9caa3d70f2df9564d75d253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
62KB

MD5
54256e2b57c88d285e8e5708f81b0dba

SHA1
15c97db53a1ab4f6f585f07d2286d8343055c452

SHA256
42080908ccc0138e8fbbc270598933478a3ee48b50e14aed29db4f363bdbf1a8

SHA512
f691dbb0ebcda336cfd1e2a617e8e0d1e94bb4f4b9e9dfba19efe2ccd8c060e165d34ae294fd4df66f65ea060c366cc9e7b77bb251c2070e3922d0c87612ad79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
07596a6606d30d0e09a426ff3f74212f

SHA1
71223d5bed517c4d752df7509a789d88c6f90c86

SHA256
ffb79f41d054d5b9fe57131a1a51cc793e620cfefde86a15a6541e4ec7787934

SHA512
7ef6d6c5d5af36758ab8825b6d3187a1dadcb3dd628334b6d0a077d4a5266b5a7f885d0214006fa2323bd1df7b7659c35ede3288f49411077d0e977ed9f6ee2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
716bf425804e672bbf07785373b8dbfb

SHA1
c76407674ce8a5a87ff58cdcd2aa25038834a376

SHA256
6766233954f88b45f17e7c33eb0fe7b728b0544ad035cdc4545d58a98ca5ee7e

SHA512
be794a349aa2a750af7c26f3bbe7f63b08695ec5bf3b7268e5b2416bd210563b271a33269845f9efc53991a0e6e01bb86042c799409f412350a6864023e39dad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
10a45c106c4a9f67046ba292ac60825b

SHA1
8aa38bb637c600247b4c2610899aca59a28cb40b

SHA256
2fe5e44479f7ea40a346f022ae8b9f8431a15f489da151cb61d127b361dc85e7

SHA512
1b0704e085026d5a46b69d131f749f56e95f8c7e76dc3a5e80052f69844811f6a06ed2c88e4efa0888ca1574ee5af1805e928d6149278f3a2150653690d4df6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe580a2c.TMP

Filesize
392B

MD5
fb69038a7c094b5388b875122b91a0bf

SHA1
83bc2eb0385a50dbe4c533dc221838b73857bbe3

SHA256
2a050fae5a47f5f1fc98d52a873c9bedd12cf87b254a778352f32cb33f92f2ea

SHA512
73ec1f13cd1616d0b9502ca407693b01676407f74f689f152fe497addd28f95937f76e44e9c07e2c073bbd4f80a8485ce7535a62d769ef5afc5ec388c4de4660

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Filesize
264KB

MD5
837dea7e8da3ef18d142e0f8621edd74

SHA1
8138cb631ddf5c17d209cff95e71ab3609f4cac7

SHA256
3cbe7bf1559069ec364bb9d9992e7549590ae4533a9058001a7c56272c75034b

SHA512
69b35aea0d03c9e01c0256de776c6a20cffb7fb4793eabbcf37175ed71214a6c91cefc2b1e543c47a9d8e379e0ac7640691a81fcc4839e0a6212c5ee138106da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\Downloads\Vista.exe.crdownload

Filesize
1.9MB

MD5
faa6cb3e816adaeaabf2930457c79c33

SHA1
6539de41b48d271bf4237e6eb09b0ee40f9a2140

SHA256
6680317e6eaa04315b47aaadd986262cd485c8a4bd843902f4c779c858a3e31b

SHA512
58859556771203d736ee991b651a6a409de7e3059c2afe81d4545864295c383f75cfbabf3cffaa0c412a6ec27bf939f0893c28152f53512c7885e597db8d2c66

Download Submit
C:\Users\Admin\Downloads\Vista.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\Notification\notification_fast.bundle.js.LICENSE.txt

Filesize
551B

MD5
7bf61e84e614585030a26b0b148f4d79

SHA1
c4ffbc5c6aa599e578d3f5524a59a99228eea400

SHA256
38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179

SHA512
ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt

Filesize
1KB

MD5
8595bdd96ab7d24cc60eb749ce1b8b82

SHA1
3b612cc3d05e372c5ac91124f3756bbf099b378d

SHA256
363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831

SHA512
555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\json\i18n-tokenized-card\fr-CA\strings.json

Filesize
2KB

MD5
cd247582beb274ca64f720aa588ffbc0

SHA1
4aaeef0905e67b490d4a9508ed5d4a406263ed9c

SHA256
c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5

SHA512
bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_395113209\manifest.json

Filesize
121B

MD5
fde1edabd926edaf85bd8dcfd6d26f0d

SHA1
380c447a4df3871885c99d926edd1e689f247b99

SHA256
3bab6a96aa24d25d5f838199dff00837be00480f92a559d30a24f67334e02a2a

SHA512
acc5b7ee98a6652a74477d2a9b295ecdacfd0182b75931653d373fdb15c52d1d869bbe3a41e4a79db36ed91ed55c39c47526268b56b123e9b7f19479bbe8dc13

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_53940675\manifest.json

Filesize
145B

MD5
d4e12ffdd8993ba5a661c6d6f631b132

SHA1
2ad30a3f86c7ce9df7a520e8a03e7d2ae0d0492b

SHA256
6c0822b52a411b119a1260d77b6e4840363639f7004fb9528895fce52012c773

SHA512
151c7557f18c8ab074d5f9a13c37f47b896c19437bd677874c0a48e06dce418ea149f84f5e27ec0f5ca0abe86317d110fa373500c36c48d6c2caeff660be13b5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_761025899\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_761025899\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
memory/228-1923-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/228-484-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/228-1668-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/228-2079-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/228-2292-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/228-656-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/228-645-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/228-2307-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download

Resubmissions

Analysis