6d9cbfd099d91fc5d53512f90bdcf8a7675cfd9a93b533a31ac2b2a8a5f6fbb4

Analysis

max time kernel
270s
max time network
277s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2025, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 5.2MB
Sample250318-fdlelsvtey
SHA256 2282bc8fe1798971d5726d2138eda308244fa713f0061534b8d9fbe9453d59ab
MD5 27206d29e7a2d80ee16f7f02ee89fb0f
SHA1 3cf857751158907166f87ed03f74b40621e883ef
SHA512 390c490f7ff6337ee701bd7fc866354ef1b821d490c54648459c382ba63c1e8c92229e1b089a3bd0b701042b7fa9c6d2431079fd263e2d6754523fce200840e2
SSDEEP 12288:/7etnqnVnMnBnunQ9RBvjYJEi400/Q599b769B9UOE6MwMGucMEbHDuX0YnpWQZO:sFEc5FeWSPZza8yUMmfSHCHWJ4pps
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-ec\es\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\app-setup.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-hub\da\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-notification\pt-PT\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-notification-shared\el\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-shared-components\ko\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1633141052\hyph-ru.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1633141052\hyph-de-1996.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1633141052\hyph-lv.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-notification-shared\pt-PT\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-notification-shared\ru\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-shared-components\da\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\load-hub-i18n.bundle.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1633141052\hyph-da.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1633141052\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-mobile-hub\fr-CA\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\wallet-webui-560.da6c8914bf5007e1044c.chunk.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1633141052\hyph-te.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1633141052\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-notification-shared\ko\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-shared-components\id\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\wallet\wallet-checkout-eligible-sites.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\Notification\notification.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1581194246\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1633141052\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1976084200\Part-RU	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1842743817\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\wallet-webui-925.baa79171a74ad52b0a67.chunk.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-ec\th\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-hub\de\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-notification\en-GB\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-notification\nl\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-notification-shared\id\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\Wallet-Checkout\load-ec-i18n.bundle.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\hub-signature.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-notification\id\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1976084200\Part-FR	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-ec\en-GB\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-hub\el\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-mobile-hub\es\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-notification\fr-CA\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-notification-shared\fi\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1581194246\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-notification-shared\es\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-tokenized-card\fr-CA\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\Mini-Wallet\mini-wallet.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\wallet.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1976084200\Part-IT	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-ec\it\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-hub\th\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-notification\ko\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-mobile-hub\de\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-tokenized-card\en-GB\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-tokenized-card\pt-PT\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\Notification\notification_fast.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_736846923\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1633141052\hyph-tk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\bnpl_driver.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-hub\en-GB\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\wallet-icon.svg	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\wallet-webui-708.de49febeeb0e9c77883f.chunk.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-mobile-hub\en-GB\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1633141052\hyph-el.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133867468390756449"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-308834014-1004923324-1191300197-1000\{BF676BB4-114D-4D92-9490-B7FCDD340D0F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 712	1456	msedge.exe	86
PID 1456 wrote to memory of 712	1456	msedge.exe	86
PID 1456 wrote to memory of 4008	1456	msedge.exe	87
PID 1456 wrote to memory of 4008	1456	msedge.exe	87
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 952	1456	msedge.exe	88
PID 1456 wrote to memory of 5692	1456	msedge.exe	89
PID 1456 wrote to memory of 5692	1456	msedge.exe	89
PID 1456 wrote to memory of 5692	1456	msedge.exe	89
PID 1456 wrote to memory of 5692	1456	msedge.exe	89
PID 1456 wrote to memory of 5692	1456	msedge.exe	89
PID 1456 wrote to memory of 5692	1456	msedge.exe	89
PID 1456 wrote to memory of 5692	1456	msedge.exe	89
PID 1456 wrote to memory of 5692	1456	msedge.exe	89
PID 1456 wrote to memory of 5692	1456	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f4,0x7ffc65b2f208,0x7ffc65b2f214,0x7ffc65b2f220
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1780,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:3
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2032,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2616,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:8
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3504,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3512,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4940,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4320,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5404,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5576,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5576,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5792,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5764,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6048,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5316,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5544,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=748,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5840,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5508,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5384,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3420,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5352,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:8
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1296,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3216,i,4958269934171659011,13546446036792012188,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:8
  2⤵
  PID:2572

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1633141052\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
MD5 SHA1 SHA512

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1633141052\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
MD5 SHA1 SHA512

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1633141052\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1633141052\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
MD5 SHA1 SHA512

Submit Download

notification_fast.bundle.js.LICENSE.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\Notification\notification_fast.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
MD5 SHA1 SHA512

Submit Download

tokenized-card.bundle.js.LICENSE.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
MD5 SHA1 SHA512

Submit Download

strings.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\json\i18n-tokenized-card\fr-CA\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1786308232\manifest.json
Size 121B
SHA256 3bab6a96aa24d25d5f838199dff00837be00480f92a559d30a24f67334e02a2a
MD5 fde1edabd926edaf85bd8dcfd6d26f0d
SHA1 380c447a4df3871885c99d926edd1e689f247b99
SHA512 acc5b7ee98a6652a74477d2a9b295ecdacfd0182b75931653d373fdb15c52d1d869bbe3a41e4a79db36ed91ed55c39c47526268b56b123e9b7f19479bbe8dc13
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1842743817\manifest.json
Size 145B
SHA256 fd7b554588c5e72506a0bfed89bc298911a5649b9f5168ad7c1804d1c75de42e
MD5 0df2306638bd60162686e9c4bafbd505
SHA1 ef9e16bf867f7950d5a30172e1d34d38686b0e72
SHA512 73fca229097631104cf352061d62455b6c5520bf59777520165719d2368b0e77f3ce66f52873fec53ac60e35274bf397ba321bc62610f0b7b172a7c5c4975174
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1456_1976084200\manifest.json
Size 116B
SHA256 ac47cc331bb96271da2140941926a8accc6cb7599a6f3c17bd31c78f46709a62
MD5 2188c7ec4e86e29013803d6b85b0d5bb
SHA1 5a9b4a91c63e0013f661dfc472edb01385d0e3ce
SHA512 37c21eaff24a54c2c7571e480ff4f349267e4404111508f241f54a41542ce06bcde4c830c6e195fc48d1bf831ed1fe78da361d1e43416cfd6c02afa8188af656
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1456_2092271474\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1456_2092271474\manifest.json
Size 85B
SHA256 db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f
MD5 c3419069a1c30140b77045aba38f12cf
SHA1 11920f0c1e55cadc7d2893d1eebb268b3459762a
SHA512 c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1456_736846923\manifest.json
Size 1003B
SHA256 005a2386e5da2e6a5975f1180fe9b325da57c61c0b4f1b853b8bcf66ec98f0a0
MD5 578c9dbc62724b9d481ec9484a347b37
SHA1 a6f5a3884fd37b7f04f93147f9498c11ed5c2c2d
SHA512 2060eb35fb0015926915f603c8e1742b448a21c5a794f9ec2bebd04e170184c60a31cee0682f4fd48b65cff6ade70befd77ba0446cc42d6fe1de68d93b8ea640
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d0c6ee43e769188d8a32f782b44cb00052099222be21cbe8bf119469c6612dee
MD5 01cc3a42395638ce669dd0d7aba1f929
SHA1 89aa0871fa8e25b55823dd0db9a028ef46dfbdd8
SHA512 d3b88e797333416a4bc6c7f7e224ba68362706747e191a1cd8846a080329473b8f1bfebee5e3fe21faa4d24c8a7683041705e995777714330316e9b563d38e41
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 47559b4491727fad855e4992c704d3aaacba565d19bf2dc82f384e78e774397c
MD5 eaa5b3dc4a3ce4a4d547f739c454cabe
SHA1 ca2d48451cf6854ed63dbc61eec13b5aee15c47b
SHA512 04f9f365a6ac8a2d1b867349d19c112551b461173ee1a9ed45d626519f6cca0ef7bbf0aebd2fc4e2b56f0f86c8bf6df7b0539083d407ac267ff911d7c8a58646
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5
MD5 40e2018187b61af5be8caf035fb72882
SHA1 72a0b7bcb454b6b727bf90da35879b3e9a70621e
SHA512 a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12
SSDEEP 1536:IRWH74CshBGZqW3iPPDuVvpBI/S8tZsA62UYPq:vHNdRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1dd0520d398fe357ec86318d8f35b13c6cc71482e5c6bb4877e4552db329215b
MD5 00d3a6d57b1faf61e4c8c0396d873a6e
SHA1 d2b5728c8314212b973e42cfb8c7556df7d2af8f
SHA512 5721d8b666b8770793c3b73e3f4c9f1171389fd0cb14ac112836755dfaea0e9d6e7f6524275af1a6f40753a30706bb62d6183025772b3a19b01721dbd681ea56
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 079d9c528805af3702c43bb3693993cb1dd3461f71dccdd3eb4b231ee06b7fd4
MD5 29a9c0c4dd5550b15b093483ccb9ffa7
SHA1 d8177f32e5086027e995ec6ee682c374eb9c8f9f
SHA512 c75f2de22b3a4cbb12871489a2aecb2af63618f38c1fbcf0e0e3b2138a7b63f362e6446f7a5789c8817d9196f005b24d3ed071c534d06f345121b1ca50007932
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 32a006c53e06a8c9f603c8257ec6450be76d3f8fcf469a2879ca7a3515764776
MD5 4976093084878d7d512625dc0d0ae1cf
SHA1 1f1eda96f6d9e92bad27979ad7f24e2a67a21764
SHA512 2f25f5d79554689bf2b279dc7d6ba2c1bd5823f1702279e2c186fee2807717bb5abb3261be3cc8939e0a614e286262421a22e49dfb6e12826f1d65d6bafad030
SSDEEP 192:sVrR5yMqv/Ky0hl8M73sKAcw8wIj4Txb5KsZ9IYooZ8pNHY+WN76VYKLErfefQfC:sVrsEj3s+pZjsxb36NHSeVBMefQfad
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 9d995f8b0b58fa62235e01675843f6f2f7cb27b33faf3da460f7ce764421de61
MD5 8299800daba192aa14e9dd53ef0dae79
SHA1 89f34f0cc591b111b4bea2376e81a99a9c44bb0e
SHA512 03a60d936dec5a993391088fefc9d664c6aca1aa70e215b1da513e936afdadcf75aebab594783752ef0626129896f35249c10fdc21f080423cb371afe66a499b
SSDEEP 192:sVrR5yMqv/Ky0hl8UQl73sKAcw8wIY4Txb5KsZ9IYooZ8pNHY+WN76VYKEErfefI:sVrsEqV3s+pZYsxb36NHSeVyMefQfak
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 773b1503644e30e6f8c48f206beb0a40c8b26134c8582f12a0be5aaf603ef94d
MD5 cba3b380f0cbf8781da0604d778ed380
SHA1 2bf568469d1b5e781e83c6e4a94ff3274841545b
SHA512 9d4bb46bb1fe85c9ff1ec99c631a9e320c078afa4b4e65773fcba2ffa82d9cfc64cbd66b523e7ac82ebff299af40956bdab9da8ff4837c7a8ed600eecfe41182
SSDEEP 768:uDdEGPg7pLuLxpHWFThjN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVO+MU2LlCc7OBrc:uDdEGPsExpHWFThjNu1jaRzU2LESO6SC
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 87079354b83392db187d7f9974a3f3a4383776797ffa1b7099508d4a4eabb13e
MD5 a0af040cbc6e928d9327c74e7a9f653e
SHA1 d5f3fa4fcece1f00b17f10da8119f24daf205bbc
SHA512 2f5cf93ce38935b737b73e87c2ba722a93301fbf5f27da567836d83fb7dcad303ebba774c114bfbd21260c06b4f16dcc628156a46399a0c15045a10b01441e4f
SSDEEP 192:1wLakOfUspeisuOVCjeqQyMcLqhXHwtAe:l
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 467B
SHA256 17c791a4a28dbb32478a1553e8bae5ed8d1217e9f77bca389f8c4e42f5962f88
MD5 9795620253edd4ad13ac52e7a1f968e2
SHA1 23a63d2493a8d40325381059166a812c39816b2b
SHA512 9dd399bde697d68c1d87f5bbd734c3874c0e2f40931402095aae8560867c31611072a36f6f8f6260ce842ea336e2f75c0e55e15500fd110dda4f760d793e7f91
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 898B
SHA256 1b3bfa18e5b1250093f400709a5327112931c019ce44a2ab848c81ce463813f1
MD5 3a72526080ac9bf1cf3c54f826bd7ae9
SHA1 9ce453c61fe94d9201ae075e5fd87a48fb42acfc
SHA512 0adbbfcf46835a14fa35390a293df30d28f992962768062ccc1be7e62282027044972572409eb63ccf991c1a646ceaaa632984138b08c16c66d79af202aa81cd
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 18KB
SHA256 4091631a5d82f624c7189b9339ab3a279e2bb021790389621bc71a298f881b96
MD5 7f9c58d16cd88f55d643754b7a6daf23
SHA1 11c1734bd82864410464320c6e0231ac8f018196
SHA512 e5902d020753111bf4f21496144f1746c76d65852054aed43e92b78b85b41e812c353643c117d0dedf72bd4fb7205f0de4447086461450917301a4abd4b60679
SSDEEP 384:kXJOk/FY7A42lagbkDtCkQ7wDThH/64+hkrX6PQpGMgSVlkFIum1z4tfLTvq/uIj:OJOk/FY7/2lagbCtCkQ7wDlH/h+urX64
MD5 SHA1 SHA512 SSDEEP

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 19KB
SHA256 16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502
MD5 41c1930548d8b99ff1dbb64ba7fecb3d
SHA1 d8acfeaf7c74e2b289be37687f886f50c01d4f2f
SHA512 a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+eW6PQpGMgSVlkFIum1z4tfLTvq/uIvqV:WJOk/FY7/2lagbCtCkQ7wDlH/h+eW6PH
MD5 SHA1 SHA512 SSDEEP

Submit Download

wallet-checkout-eligible-sites.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18340.18330.1\json\wallet\wallet-checkout-eligible-sites.json
Size 23KB
SHA256 b962497993e2cd24039474bc84be430f8f6e6ab0f52010e90351dc3ff259336c
MD5 16d41ebc643fd34addf3704a3be1acdd
SHA1 b7fadc8afa56fbf4026b8c176112632c63be58a0
SHA512 8d58aa30613a2376ccc729278d166a9b3ec87eca95544b9dec1ee9300e7dd987326ea42d05dca3f1cc08186685f2fdaf53c24fd2b756c1ed9f2b46436689dc74
SSDEEP 384:rQR5dkrKzmQWgFlhpyZv8CTi8I6kxAvh0mV:reKrMP8d5JIVAvhj
MD5 SHA1 SHA512 SSDEEP

Submit Download

wallet-notification-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18340.18330.1\json\wallet\wallet-notification-config.json
Size 804B
SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209
MD5 SHA1 SHA512

Submit Download

wallet-stable.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18340.18330.1\json\wallet\wallet-stable.json
Size 81KB
SHA256 56090563e8867339f38c025eafb152ffe40b9cfa53f2560c6f8d455511a2346a
MD5 2e7d07dadfdac9adcabe5600fe21e3be
SHA1 d4601f65c6aa995132f4fce7b3854add5e7996a7
SHA512 5cd1c818253e75cc02fccec46aeb34aeff95ea202aa48d4de527f4558c00e69e4cfd74d5cacfcf1bcd705fe6ff5287a74612ee69b5cc75f9428acfbdb4010593
SSDEEP 768:r7P7XSl9cv2tlNnqSBBoCJkQgXzwb7XARjMLVF2CYgYHFkJ/Eqajvapznp+9J:L8W27jLgX2ZLSgYHFkJ/EqajvWnAr
MD5 SHA1 SHA512 SSDEEP

Submit Download

wallet-tokenization-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18340.18330.1\json\wallet\wallet-tokenization-config.json
Size 34KB
SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa
SSDEEP 192:0NOKnK+QXzpTYaDEqIyVZ5mxzrIAfrXKoNKExGI+MmsMR6Q9GMKPrZnfB4FXZ8N:SOKK+QXzpTYaDEq/e5EAfrRoRI+B9wC0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 50KB
SHA256 e7958d27c994c61a24e9b2203ec0f5bccdd125c322e3c2d44179b3506a98a5d0
MD5 529587a756d6cdd183a73e340dca8e09
SHA1 12f0b2e9fd852cd522aa3a849db26584f94c5642
SHA512 6ba076a2558859979fa2d8bf079da4678f8a0422f4648da8f4c0a09bb52c2999c271cfdbc5ec989f0e1b1a0d11c11a847184b987985a628c031c62f91c52b5a7
SSDEEP 768:zliE6esE8lDldUG83Pbgs22bKbtfXkuyKIPG6dvX5qgWtqNFBEH6CGCecVb5rTfW:CeB85dU3Iu+EqtjH6CG3ctrS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 136b3e0e0b7fc0b69c753c81c8ad95d5dd328afc3da2be3eb1253cf5c3e4f31c
MD5 b0f576818566e834b4027e3c0df3d983
SHA1 ed95a7b52a7447c02c09733398ba39017746ab77
SHA512 77c84be833e4ba2c2d3f4d427798e0c298ea33b802847b8875b28c6a806cd7123fe8cda9eaf4dfe6ad2e3e28f48c0ee836be93dfbed56c1f51034b88ac525100
SSDEEP 768:RliE6esE8lDldUGz3EbgYQ3bKbtfXR1NKozn8lKCecVb5rT4EH6tU:QeB85d73Mu2nYK3ctr9H6tU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 49KB
SHA256 03a5b9f66e21286fd43c78d68cfaca0e8228ce21253ea21c0610b731083880de
MD5 9487a2e1eb4ff24e2f3c5d0ac05b8bf7
SHA1 22c4869b298169981bf851676caaae7c2d7477c1
SHA512 0c2166dd93fa4638f6562668706c3f93e9539e0e433db45669add50d25f8fe37f84930a537b49bb5578b83ba36412088a3f3711a401352603c0e60ba0d51a5e3
SSDEEP 768:7liE6esE8lDldUGz3Pbgs22bKbtfXkuyxIPG6dvX5qgWtqNFBEH6CGCecVb5rTfW:qeB85d73I3+EqtjH6CG3ctrS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.57\Filtering Rules
Size 1.8MB
SHA256 f215127185b2ee6b01e12b6ca75d3e5c4e454598dd4aed36124ae13d59afd547
MD5 d7c9c6d2e1d9ae242d68a8316f41198c
SHA1 8d2ddccc88a10468e5bffad1bd377be82d053357
SHA512 7fd14824e9200dd99e1fd2cee402656dc0cfc3d0a60058c5eb05c68e9e65b7f0b47e550fb4d6c2b59eba204dbf3ef9e69dc9723b43a9b3ccd5412d6b77715fc3
SSDEEP 24576:y+DPoZGeOT4JQm1zX3nJhS33dpuaQcLzNPNPCoMB50TcpdGGK:FAZxu3dplQcxNPCoMB50TcpYGK
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.57\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 30e304eb56a6d7cbe3566751f7724abd99e24a8161c069823688b3bc361da634
MD5 b7bfec7c899452474647df8c281518e0
SHA1 154ed697acd402e51e0752d04d9594eba1a73fe4
SHA512 da740367cd71c85e2044f31eefd5f4605dee37267e992ca790e630feb75bab1acccc1d9311e2e96dab21cfe768d8f97dde7a5cfca9bfcd4c8b3ef1ae1b2506ac
MD5 SHA1 SHA512

Submit Download