44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1

Analysis

max time kernel
285s
max time network
285s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2025, 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe
Size

896KB
MD5

9a52aea2b0c41150776e760873f1a7c8
SHA1

e7b085a12af034ffdec85e957989c47207e54e9a
SHA256

44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1
SHA512

033e995bb184146abcb06657bd7094c4900ed4b28395f83c992950051442f24f39e6765ecbfca1f6fc5340e0ac204964b8b0b5c053571cb5eae628ecfcc02326
SSDEEP

12288:yqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaETb:yqDEvCTbMWu7rQYlBQcBiT6rprG8akb

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2896	msedge.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1832834676\ct_config.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-nn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1030568501\Part-ES	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1853011504\auto_open_controller.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1853011504\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-da.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1555335536\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_104614999\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-nl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-ta.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-uk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1030568501\Filtering Rules-CA	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-lv.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-nb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-as.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-et.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-ga.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-ka.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-lt.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-tk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_909898592\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-fr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-gu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-hu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-sk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1030568501\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1030568501\Part-IT	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-cy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-en-us.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-te.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1030568501\adblock_snippet.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1030568501\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1030568501\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1853011504\edge_checkout_page_validator.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1853011504\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1555335536\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1832834676\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-hy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-pa.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1853011504\shopping_fre.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_909898592\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-gl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-hr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-it.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-be.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-cs.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-cu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-es.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1030568501\Part-RU	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1853011504\edge_driver.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1832834676\kp_pinslist.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-de-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-hi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-sl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1030568501\Part-DE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1853011504\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1832834676\crs.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1600558\well_known_domains.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2896_909898592\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133867407957378974"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1279544337-3716153908-718418795-1000\{3F3AC5F3-7FF1-43D9-95D7-EF0778516534}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1279544337-3716153908-718418795-1000\{3DB512CC-F214-4C35-BE91-BA63D1844397}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5244	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe
5244	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe
5244	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe
2896	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5244	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe
5244	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe
5244	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5244 wrote to memory of 2080	5244	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe	88
PID 5244 wrote to memory of 2080	5244	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe	88
PID 2080 wrote to memory of 2896	2080	msedge.exe	90
PID 2080 wrote to memory of 2896	2080	msedge.exe	90
PID 5244 wrote to memory of 3296	5244	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe	91
PID 5244 wrote to memory of 3296	5244	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe	91
PID 5244 wrote to memory of 2524	5244	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe	92
PID 5244 wrote to memory of 2524	5244	44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe	92
PID 2896 wrote to memory of 3036	2896	msedge.exe	93
PID 2896 wrote to memory of 3036	2896	msedge.exe	93
PID 2896 wrote to memory of 4880	2896	msedge.exe	94
PID 2896 wrote to memory of 4880	2896	msedge.exe	94
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4648	2896	msedge.exe	95
PID 2896 wrote to memory of 4740	2896	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe
"C:\Users\Admin\AppData\Local\Temp\44a6d3e1106815ef095ec5836b8a304ba90876fd1826d67288705cf6171831c1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.youtube.com/account
    3⤵
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffed902f208,0x7ffed902f214,0x7ffed902f220
      4⤵
      PID:3036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1804,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2132,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2100,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:8
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3472,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3484,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4348,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
      4⤵
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4620,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5380,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
      4⤵
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3988,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5232,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
      4⤵
      Modifies registry class
      PID:1960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5224,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:8
      4⤵
      PID:2380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5904,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
      4⤵
      PID:1488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5912,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
      4⤵
      PID:1564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6236,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6536,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
      4⤵
      PID:1828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6536,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6532,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6312,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
      4⤵
      PID:3248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6260,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
      4⤵
      PID:3568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6804,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
      4⤵
      PID:2576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6864,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
      4⤵
      PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6028,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:8
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6656,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
      4⤵
      PID:2952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4324,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5676,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:8
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6436,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5304,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
      4⤵
      PID:1156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4780,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:8
      4⤵
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6280,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:8
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2688,i,9055118626221166550,6740465248628371713,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:8
      4⤵
      PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  PID:2524

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1030568501\manifest.json

Filesize
116B

MD5
2188c7ec4e86e29013803d6b85b0d5bb

SHA1
5a9b4a91c63e0013f661dfc472edb01385d0e3ce

SHA256
ac47cc331bb96271da2140941926a8accc6cb7599a6f3c17bd31c78f46709a62

SHA512
37c21eaff24a54c2c7571e480ff4f349267e4404111508f241f54a41542ce06bcde4c830c6e195fc48d1bf831ed1fe78da361d1e43416cfd6c02afa8188af656

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2896_104614999\manifest.fingerprint

Filesize
66B

MD5
3dd42978e1b983a0eeed340168119b7c

SHA1
00f5178dc64c814f51f484483433acfae5234ca1

SHA256
3d17691eff78ac9236ebb6bf1e1c5d965082eecfcc8c1ad7600b05e4a8745c28

SHA512
a86ed88493cf27e73b49ad612d22f89f707de03e79769a7b3121f1007e5527ac4486609792c467444c51cb578bbdc1343584a8d31fe908353bdcbed7c9203261

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2896_104614999\manifest.json

Filesize
118B

MD5
acb8ebb43624ece8dd7964092455d2b7

SHA1
7c61f04b419f927f98120afa18d8553513e2a0f6

SHA256
55b2b1fd2a563b240179fde6335370f5e22068ada77b5dc5af50bbc379c72953

SHA512
8e6c135aa19d6d21b32c6e9c0727ccf3df7e8dfcaf49e3f0ce55af9b53748188949746d69d17cdafd9d77511b1550d970289912a33b3d9c4daed8837762d91c3

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-as.hyb

Filesize
703B

MD5
8961fdd3db036dd43002659a4e4a7365

SHA1
7b2fa321d50d5417e6c8d48145e86d15b7ff8321

SHA256
c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

SHA512
531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-hi.hyb

Filesize
687B

MD5
0807cf29fc4c5d7d87c1689eb2e0baaa

SHA1
d0914fb069469d47a36d339ca70164253fccf022

SHA256
f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

SHA512
5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\hyph-nb.hyb

Filesize
141KB

MD5
677edd1a17d50f0bd11783f58725d0e7

SHA1
98fedc5862c78f3b03daed1ff9efbe5e31c205ee

SHA256
c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

SHA512
c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1548165618\manifest.json

Filesize
82B

MD5
2617c38bed67a4190fc499142b6f2867

SHA1
a37f0251cd6be0a6983d9a04193b773f86d31da1

SHA256
d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665

SHA512
b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1600558\manifest.json

Filesize
141B

MD5
811f0436837c701dc1cea3d6292b3922

SHA1
4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87

SHA256
dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d

SHA512
21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1832834676\manifest.json

Filesize
102B

MD5
a64e2a4236e705215a3fd5cb2697a71f

SHA1
1c73e6aad8f44ade36df31a23eaaf8cd0cae826d

SHA256
014e9fc1219beefc428ec749633125c9bff7febc3be73a14a8f18a6691cd2846

SHA512
75b30c0c8cef490aaf923afbdb5385d4770de82e698f71f8f126a6af5ef16f3a90d0c27687f405274177b1a5250436efddd228a6d2949651f43bd926e8a1cc99

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2896_1853011504\manifest.json

Filesize
145B

MD5
0df2306638bd60162686e9c4bafbd505

SHA1
ef9e16bf867f7950d5a30172e1d34d38686b0e72

SHA256
fd7b554588c5e72506a0bfed89bc298911a5649b9f5168ad7c1804d1c75de42e

SHA512
73fca229097631104cf352061d62455b6c5520bf59777520165719d2368b0e77f3ce66f52873fec53ac60e35274bf397ba321bc62610f0b7b172a7c5c4975174

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2896_909898592\manifest.json

Filesize
76B

MD5
ba25fcf816a017558d3434583e9746b8

SHA1
be05c87f7adf6b21273a4e94b3592618b6a4a624

SHA256
0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11

SHA512
3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
998db8a9f40f71e2f3d9e19aac4db4a9

SHA1
dade0e68faef54a59d68ae8cb3b8314b6947b6d7

SHA256
1b28744565eb600485d9800703f2fb635ecf4187036c12d47f86bbd1e078e06b

SHA512
0e66fd26a11507f78fb1b173fd50555dbd95b0d330e095cdd93206757c6af2780ece914a11a23cd4c840636a59470f44c6db35fa392303fb583806264e652016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000007.log

Filesize
21KB

MD5
c599cd0ddd228065392f18e47615e065

SHA1
9bf3970b16c94c9a07f1b11d32adb91be5e56497

SHA256
7cef387f39483b88d3f04e90473def58222161178da36a2f9cd8ba8f6382ac8e

SHA512
b94060d02dc888cad56c552693c02493a4769afdfe0704d218e8a884016c89fe34c0df8df4e9e45c020954fced2afeca3930266883ef9a7a03ba986c57152f75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
331B

MD5
4e40c0dabc697ceb771507ec18aa3a44

SHA1
84ee20eb277dcfd248f073638298c7ee89ff9d10

SHA256
9def33697fb91400f5d18c3c9d8f92745655f5e403f73462735ad0d25bd0c65c

SHA512
224bf3a29ae59ab83838083ffd3e0cb624cdca0a673c84ef6c9c389d738465f5478d1d785677d42c3d0021e9cf35f2933a95550b160806d083d4d3d6fe480d9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
d98ba8e8cada3fe70de7470c83096ef6

SHA1
0faeb0367c38f8b5380fb9f667354f8e9a863537

SHA256
736faebbd9b002a0d5ce6f36452969d3b8d358546ed9a3092b349bf0c94aa6a6

SHA512
b30cdbf4eee1967d671bc60f73bcb76b8d63271e56e5f2e0adbc8488b4a08ffab3ecb23461d4319e9e986b59837729ae8ff1c4ca5132ca3e8da78bc85d3e94f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585985.TMP

Filesize
3KB

MD5
9c28a6005862c19db480dbbbbbadaaa8

SHA1
a4fe6b0cfdbccdcb9b1735357d1cbb92acf50113

SHA256
d6eb19bf5f0846cdc9f0428f309368fd4549376a99ab8ea97850dd21cbba5bda

SHA512
c85d4cbdd866541d7e1aeaed1a4718d07f8e7ced8ef90409b10d72394b1f8fb60fa69f01e35f97add1b666d3c69b654554de9b0ec958d7afea9050c5a8d21904

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
cae8d5a9ebf70ecaf3ae8603838ec88a

SHA1
508c014f8ec1376ffa4b4bcdabe19fbcd363f02d

SHA256
843fe200b778983f411c9962949086b6321e0ab06b1109f08c97022f3265e0eb

SHA512
0ea092569641e1d465c1ab67129fcc213dfa8e2a64ef7012b707ec9578444b6869b667467e98e3be48386276e24092fca075a86cc0d7ff95f17842ccf82628aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
493f48e6508a99f88444ffe391b64a14

SHA1
825dc78b19f2ee5b24a972f6c06ed5a5efaf53d2

SHA256
e1b34764591b4181ee26ce0ccb1ac8046501b622b3438ba4688a350c9771409d

SHA512
230920fe74fa35df9bf3f24d5032f16b0f708e9fffd4e1171aea5cffab81531c3f7de98482581211baf77e1ab821408776eb427b2e1e8ebcced9e34fe970d905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
ca67098337ee9956ae3586327dcc6f1a

SHA1
1c75b33194b912c03bd37b3b9f2f1544aec693c4

SHA256
6b01968cf335d36af817b8d04bb1d5512318d8906edb1b1268bfd0e06195683a

SHA512
31ad0efda93156e8bdfcc802bc6f8a303e0385f4e075855deae697bca62498bc59da598218b22d851089f0413b3f78cea0327db7d2b7a9c6d5af259803720f19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
add8de75edf31a9182ff5ac0b93d49e2

SHA1
45f03fbfb2bbdab1bd2c4fc4f35f52dda8a91748

SHA256
7bd41a510f64df59dba693ffca9e18fdd3552199db18967d9e782d99249b2b18

SHA512
04718ee206b44f03127c7fc112ea7a0d67903d9678dfc42ecf0e07dba48f2b0335cddaba21859cebe0984304ca2bc084b0f16f1e594879ad390fa0460bed8dcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
78d7a2474cfc1b0263deede77a6a0ddc

SHA1
0dd7fe23d7f45cf3e3d016ca3238f27f070ac725

SHA256
3e9cd1919fb49d11b86e63ca9a923acaf1de44408c69668274d547272d963075

SHA512
1a6270ae3936d16fa27969be070a4350f41d4a7783e9beb41131826ee95272918731a5eb26d209434bc14cf63616148f9d81ab9435d363cca8ed51b50fd537c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
d22042a904f482e22b7cfe14a6df2925

SHA1
11f369202bde129e9aa6b8e5776978a16dd6692b

SHA256
a87acd0ad08abeeab0dceb31af4da6607d6719ead156bcf106d4ee15bcc4e1b1

SHA512
a35dc5178b70a43e337b0435c15032af3a7e36a7b7524d51b86b83f53fad155146dfce02113329c0f4c65bc03c9168461ef64595e007706ec6fe487f1f2e7096

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
3b3ca8d82da515e59ef8429102fd6df0

SHA1
3eb1bc4bd65447fd0d9630f7c6327f97f942940f

SHA256
8ec7cadaac191614eaf80f0af8509868d8f52e3c64c6c4c3b24ce35a83cd18d7

SHA512
237e2b7101b8ff78e296fd053abfbc50089d8f4088b3ee4e03c9cefab805f635f595585ba534b84b066b2d2881dcc5e9a4362dce3bf63f69913a0c24ee19da6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7ae98a8e-18c3-4b74-9e06-52f7a9517801.tmp

Filesize
896B

MD5
bb617f27ce57e7de3eda39535d0877e7

SHA1
481bf34fdd280f71111e1d415e60307381e77da9

SHA256
f52d05cc12c146b5a6b6a45e951ab4b89f7826757df7b8cc452002e2a230837a

SHA512
344d6b527ac7e972d2a2ba1280ccd3e737205f313eeb31525ad1a9050098ceed0431f7c28a3bb6a74a807db7a596442d9df4cf4efce330b6055920ac699fb927

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
465B

MD5
5839dbf3ed395545a8c6dde9b48cef4d

SHA1
7d0eb594db3c62eaf777bb11c71199b6fe84d595

SHA256
ce5f0a6867900719422ba4a4845be2074cded2c38d6c6ca13f43f1e7215c3c5f

SHA512
bee3be876b7b63d2964d753d1aaaaa08bdcfa60451414f8657b4b8bb6e797b645f8c07991f7453ae413823b51991b1efb5230c1b944a8dd9934eeb2cac78010c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
18KB

MD5
6389576ed1f11c9ba511ae02c796bf4e

SHA1
b0b5fa7541bf00e8976ff6c11bb61e34ad944932

SHA256
f02061e783bccf7cb5c3e9efe8bc9ba1e0ba767f4ecd962be0a0a1a101aca760

SHA512
d3c26845ec97724efd02dc2ae328945122a395c42536246d333f76609bc91b70d8beaeae0524532485d0883737ffa3ab494f930a16c1f1e42863b0c8dfcf5847

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
0f0004bf6f9159ab5d08a8452515cdf5

SHA1
1bbb64fcf90f5cbbf5c3f56d6ab998a3de79ec32

SHA256
c16d72dc0c618f8e7511fa822f0c24c4c7345a8a089b2b6e67252b96a7f8ef64

SHA512
c73f4627d12dac2dca29aeccd176a45464fa62f3f95f20e2fab3d02668a8bc0937bd949d248aee39e0f224bef35211333e21cc42b007f6408af05956dc59aebd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
8e9ad9b75a981d54db837cc0cf712998

SHA1
34cab24c0be11f828549cf4af01a3fbfb734c8b2

SHA256
5e8ca8fc133c2d23cebda50f83b8b9e20eb92aea11583e55c6034113bd7334e9

SHA512
1b79d3cf121f20c6b1f3663ad02d19df43fa20b207948e2e5c38d9c74cc3b81c9ffeab2ef5efa058e152296451405296b62983ad7482f60d081539717abdcbe0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
c5cb826eff16f6645ce69b1b3029fbf7

SHA1
14383dfc07321a5348b06a8b55f0052f66cee300

SHA256
0be11340d4aa46a73cb083afdf792562268c84ade19c99672ddced7b1b68a6f6

SHA512
2d9a8bfec768f35d6de62488ec2ed7c20504ac7337dcf0d057eba791cf727304c2b06c62059e26454c446e2b7e81fa025fbeb026f38352d5228e378ec8bb51d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
815a734048c311f86e51ceb447ae38bc

SHA1
a708099e02426b6c60e8b1f75764a7f70466669f

SHA256
9e65abd145d970e69d5fa29f9a64c110ef7bd0469cdd658f55f06abaed5b4cac

SHA512
f18983b1fee2ec72fd4c09386cf14cd107d2b37b9d157a87269d5c9b10f8141d55b3f7a054958d27f4850bc1d47914b21f23a12e837fe44fa354e2669db529f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\crs.pb

Filesize
289KB

MD5
2b59269e7efdd95ba14eeb780dfb98c2

SHA1
b3f84cbc37a79eeecb8f1f39b615577d78600096

SHA256
ff2ced650772249abb57f6f19c5d0322d6df22c85c7cf2be193b6134e1b95172

SHA512
e4b454db2248021e0d198805ea54f1c0cfd84b9716a9348b1d0e0acb7c6fb5dd0839e532a5eb6d4410ab759d6688dd6cce8375ad55a150d738d280993142e9d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\ct_config.pb

Filesize
8KB

MD5
811b65320a82ebd6686fabf4bb1cb81a

SHA1
c660d448114043babec5d1c9c2584df6fab7f69b

SHA256
52687dd0c06f86a2298a4442ab8afa9b608271ec01a67217d7b58dab7e507bdf

SHA512
33350cce447508269b7714d9e551560553e020d6acf37a6a6021dc497d4008ce9e532dd615ad68872d75da22ac2039ef0b4fa70c23ec4b58043c468d5d75fd81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\kp_pinslist.pb

Filesize
11KB

MD5
0779206f78d8b0d540445a10cb51670c

SHA1
67f0f916be73bf5cffd3f4c4aa8d122c7d73ad54

SHA256
bf0945921058b9e67db61e6a559531af2f9b78d5fbedb0b411384225bdd366ec

SHA512
4140b2debe9c0b04e1e59be1387dca0e8e2f3cbc1f67830cbc723864acc2276cde9529295dcb4138fa0e2e116416658753fe46901dfa572bdfe6c7fb67bd8478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.57\Filtering Rules

Filesize
1.8MB

MD5
d7c9c6d2e1d9ae242d68a8316f41198c

SHA1
8d2ddccc88a10468e5bffad1bd377be82d053357

SHA256
f215127185b2ee6b01e12b6ca75d3e5c4e454598dd4aed36124ae13d59afd547

SHA512
7fd14824e9200dd99e1fd2cee402656dc0cfc3d0a60058c5eb05c68e9e65b7f0b47e550fb4d6c2b59eba204dbf3ef9e69dc9723b43a9b3ccd5412d6b77715fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.57\LICENSE

Filesize
24KB

MD5
aad9405766b20014ab3beb08b99536de

SHA1
486a379bdfeecdc99ed3f4617f35ae65babe9d47

SHA256
ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d

SHA512
bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.17.1\typosquatting_list.pb

Filesize
631KB

MD5
094ca661fb20ae7e5c26df780e0f7ecd

SHA1
0cc79e2fdf43962d9597b7eec7b34c8983c3562c

SHA256
76f100a3d96cddfbad67460eb0db1a8877a53c8a1881888b208011cd3a9d5726

SHA512
088ca8996eb3bd02f5561b026a9e36755c915d19eb9ae768ee3949491059b1c7e34117b72828d843131df50456c6a162eb2cffe74fd38c273708cd4ac6fda53e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

Filesize
572KB

MD5
f5f5b37fd514776f455864502c852773

SHA1
8d5ed434173fd77feb33cb6cb0fad5e2388d97c6

SHA256
2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e

SHA512
b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
0b484cece0933f0517079dc0856bd522

SHA1
80b17bdffea2d7515b497bb8da7005009001ebc8

SHA256
bf15ba742e36337cb1e82c882e96f269a68d3e83c2c1b17d077283c9f3566128

SHA512
3bdf46ccae300eac430b1112d166a739e2200dab9a17c27f3a62d89a8a346fe223bfd124bf3fbe6470d420afe04980a5824c677585b95a75d437dff54a3b0ad1

Download Submit