fad398fd1100f4afa63068f3d41a7c9be46102b9229c8e43ea6335ad59ac55fb

Analysis

max time kernel
150s
max time network
181s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
21/03/2025, 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

R.E.P.O/OnlineFix.url
Size

46B
MD5

59bf167dc52a52f6e45f418f8c73ffa1
SHA1

fa006950a6a971e89d4a1c23070d458a30463999
SHA256

3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
SHA512

00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
362	356	msedge.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
38	discord.com
39	discord.com

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1179324758\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1513151385\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1513151385\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1296293420\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1296293420\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1179324758\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1513151385\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1296293420\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1296293420\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1296293420\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1179324758\data.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133870382575449961"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-780313508-644878201-565826771-1000\{09173C67-FA79-440D-B80C-5BB951B32F6C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 2888	5096	rundll32.exe	81
PID 5096 wrote to memory of 2888	5096	rundll32.exe	81
PID 2888 wrote to memory of 4716	2888	msedge.exe	83
PID 2888 wrote to memory of 4716	2888	msedge.exe	83
PID 4716 wrote to memory of 1884	4716	msedge.exe	84
PID 4716 wrote to memory of 1884	4716	msedge.exe	84
PID 4716 wrote to memory of 356	4716	msedge.exe	85
PID 4716 wrote to memory of 356	4716	msedge.exe	85
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 820	4716	msedge.exe	86
PID 4716 wrote to memory of 1324	4716	msedge.exe	87
PID 4716 wrote to memory of 1324	4716	msedge.exe	87
PID 4716 wrote to memory of 1324	4716	msedge.exe	87
PID 4716 wrote to memory of 1324	4716	msedge.exe	87
PID 4716 wrote to memory of 1324	4716	msedge.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\R.E.P.O\OnlineFix.url
1⤵
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://online-fix.me/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://online-fix.me/
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffe9b01f208,0x7ffe9b01f214,0x7ffe9b01f220
      4⤵
      PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1956,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
      4⤵
      Downloads MZ/PE file
      PID:356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2264,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
      4⤵
      PID:820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2560,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
      4⤵
      PID:1324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3400,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3408,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
      4⤵
      PID:2504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=5176,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
      4⤵
      PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4992,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
      4⤵
      PID:400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5800,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
      4⤵
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5768,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
      4⤵
      PID:3528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=5348,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5260,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5296,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
      4⤵
      PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6200,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6628,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
      4⤵
      PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6628,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6788,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:8
      4⤵
      PID:1216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6840,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:1
      4⤵
      PID:968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6048,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
      4⤵
      PID:236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6072,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5612,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=4452,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
      4⤵
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6760,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:8
      4⤵
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=6104,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:1
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=6820,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:1
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=7820,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:1
      4⤵
      PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=6372,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=7376,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
      4⤵
      PID:2300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5448,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
      4⤵
      PID:4728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=5460,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
      4⤵
      PID:1224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=3712,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=4296,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:1
      4⤵
      PID:556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6248,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=4228,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=136 /prefetch:1
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7192,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
      4⤵
      PID:2644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1996,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:8
      4⤵
      PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6904,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --field-trial-handle=5200,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4052,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:8
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --field-trial-handle=7288,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=5680,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
      4⤵
      PID:3040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --field-trial-handle=7396,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --field-trial-handle=7212,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
      4⤵
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --field-trial-handle=8160,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=7952 /prefetch:1
      4⤵
      PID:3588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6020,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=8156 /prefetch:8
      4⤵
      PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --field-trial-handle=7016,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --field-trial-handle=7292,i,6922432819289960738,8139729563542104679,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
      4⤵
      PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4932

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a4 0x4fc
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
aa9afd16e8041e8c80250b50ea6899e4

SHA1
a3a698d431952253255c343f2b35f74e73e63088

SHA256
2bd7f856d73f78bc3a4de32b447b21babad42c009b19fcebe2f8cdeca2380926

SHA512
344de0888df8851d957ca6fab055eb9e2f1aa6d958022c2c30442cd6aad4d158d0a99f8908184abc60fb1e0ccdd3d9395d8c0d37fc317d3700974c3348d4a5ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f5

Filesize
661KB

MD5
fbd4f99aafd845a80ba9fd8e242937a6

SHA1
f7056a726c23ecd1d3f2329606f1759ecd2cc6c1

SHA256
6663d000085df1c894be3503d073af4727acd988b94a5035c78840d46155ccf5

SHA512
de4aa13522f2fe40f8f418c578f0bca06a8b873a797e5fa0083e605cc3e0e57d0d6848a061144b479436cbe1e6018f7de792a816952ecf7391738288774589fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000fa

Filesize
59KB

MD5
ea4681e68db7ec368b11b600f06e505f

SHA1
f78d5702d67c5331a9fd39ac0c3900337874c71b

SHA256
4f4b4b06dbe20a2df6efebd8ab7866bc124017af018a8414a16bc2da92d80e4f

SHA512
0128eac8a90168db47a4b2855a8ee23a0c37687a1e9eef0d825c6c5f1b62996e38e8ee01d697e62ea691db8ba460631288ceb8631f60854b59ff33c35160433f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00010c

Filesize
25KB

MD5
84a745b6be5d6889b2372c83daa17655

SHA1
5bb176962a37ca7eaf139c3a0c0ef848a8d45470

SHA256
19481514184cf22d0520c2ad55e4c12ebbc157af0ba8963b33bd149f5a60b812

SHA512
4bf2b655d4351fa250360f91b66ae51c09212cf70e8b89dafde243460316b9f76f1ed1412904f6d4ab56ec19621cdf7aed879bd09efd41f9f5467ffaa15c78f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
8f9002c61af7a9efda12ce798a5b0ed7

SHA1
e0f12a01ca7fa93f072431e010147c08d3221ad9

SHA256
7e3b74f250b371e1cdde8cf4852572b03642febbe18aef114c94b1581caaaba0

SHA512
8024132bcc01ce6287c073c3fdb1f789c8fb11be5b647f099b17d1940452477f302853600de14458c776d0106b500f20bd6033255b3d4c6033106e2d258385df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
5bf5b67c70883be67bd4fc5f52192a9a

SHA1
f8f256d9aa891e25167cfa631e18206b6b6cd23e

SHA256
acad13ae52c68dd43da646133d44521423f2f1c6763cac682b476905e6d28888

SHA512
994f06fa9066f7160b0ea0bc502fde56a9389c0599dd421521edf1808ba4cb844c667c8450270825e3786abe32be97862410a0c69adbf97b60ad1824eeac3edd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587cdc.TMP

Filesize
2KB

MD5
069f554d4ae7a358e6f1c7f3a61d374c

SHA1
f12697b04dc04ac2a203cd20531e0c07b1755964

SHA256
2671280e8c561f26b5100d9fd92916625a28f3350d373d5b7b4745ef5de19909

SHA512
c0d03488a83e5639b8774c987e38913396299a8128bdcaee2107188f9f8295c1a0c5c3c82f4e2945e0d83d90ed12f70e2268780617068d10df36ae248569fce8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
10KB

MD5
4ff3f60bf736c8e9fe16d23b8be2e436

SHA1
0dd12342ca0bb3d4b3a30d8d43d19a003c1426ed

SHA256
8f1b74c0416248f81688c4b722b45d270cd0bf16b5baaada7e1fc3dcfb9c3db7

SHA512
c9edeff016ac47715d7dde12252cf9715a9746b072289b51a9276dfb791fe7c79da8e901d9503a2ba64115b4deb67cf046d08a66a6770e7f9bbba533e3086f7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
11KB

MD5
fc71e38881b5afc256172728d7d0d18b

SHA1
2563f7effa7a026630c32d32b0897739f6da18f1

SHA256
c39caafde7555f697f4b182b0d6cea3a74ad50c0cc771a364c5151923701b477

SHA512
b701c298cd72234ee5c3cbc1cd5e27a5458d02b92218a3f01c3ae66929ad9a29a466301913440648fb696a4c7979b7b52bd3be99ea48075c8c460c3c5dcea706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
b9f2d1200ed52928cace4b3f6663c9bb

SHA1
32985285abeb8bc3968c5fb4f1c99acae4ccb9a3

SHA256
bc55c15ae69210b751e9ae85df3c0b78b41acfdb6561282b996b8681189ed1e8

SHA512
c0be222df5e8630665e9b539aa4eeaca98b3c8a12f28f39c218ff0274954b90b4ddbb06a6e48faddef6fb5c780fd8ec87cbebd97a032e430bbfe75432dde2d9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
734007297da547a38c95f7c56d6055b4

SHA1
6ef76e3b82d62c2320c88245ba0ebfd150403d66

SHA256
50799f8d3066fff52c99dae1bc12b038a13f290f3f57e16c8a519b697a358ba7

SHA512
af83d5aaaa54d9cee6bd8e78bfc306293a575ce85b5be10298abbebf5894995590285cb4f3a143d1223df6e66635c41bfd903ea370f3b9b6c18c7484d6cc0178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
2388789d8d64cf1ad26dc261b80c16f2

SHA1
3f70cc4cbb4d90e3c8a7f5036d48f135e814ca11

SHA256
6ba4fbd3c088ee9573fac5c37026941984efc8574a4021a7f658e570f86ba6f8

SHA512
d0fb6905ecdff52d832e8cb841b26e5ad94a77a86df189269bba66a9bce2c054e6aea6e3c98c958c82df339c83334bac64506d31ba15667306f1c8660c5e2f20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
6905ac28c150d08fa6f1eb7a902699cd

SHA1
b24af667389e18f54a27950365dfa27e10d521bf

SHA256
e5e1c7b0a611d02f5ac2e7f57281d6997c4c9604847fa3717d222ca350bb53da

SHA512
9b0cdad74d7b286dbd2b02818bc388e3b89e83a8de5d371e19e38f060152a093f31f1eb9cbb4e7bee10fd74460eaf66872db73455d977f4e93d4d9fe81d86aa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
22KB

MD5
6d7a6f72f68a57f3b0cecb2579346ce4

SHA1
36630086aa1318242f6a3ae77116410300ecfd41

SHA256
9e30f6aaf98b4c7341cd5dc164ae14a2d0d180a07e0edf78e169f238bb49fe0a

SHA512
36df13c58008be5c9bc6af0703652f0e4478485b83fbe102e6b8b9af088a7e6aee81b93b2fe8c50cdcfe88230bed59bb16f0e5986edf68ab2292afef29c36a6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
f3c93586e81510b46f02a12e8270c4b7

SHA1
f1ec37f57d9a2826822f263a65f8974952987a41

SHA256
5a3040ca85a3616a199aa2090251396d5a70515c618dbbfce09e49378b7c292c

SHA512
5f008ff5f71e53e45a53da84ed84bcca66550f1e728cba0b37cbbbdd8879a7d8c060dc6990a2e8e261444c2f950dec8ce7ec9dc554c01f4a17b7a5ff4ac1c52b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
5d3b79ae79db267ebaef0fb353604beb

SHA1
a6521556b2210fbaf8f60529161b154484aaf717

SHA256
ee037f570b9a672a90d62de5c2178e88d5a0b11634f892a4eb1b0f4815325e00

SHA512
3f5edb0be5cc59c9dc43a0ad2cf03f6d89af129663ca159401313e4c74d1dc3596af7ae3ef9bee3d0d861f986a7ef9d0302515db893f41c819b6b151e23a7804

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
164202773fcea5f042db2fb271236dc5

SHA1
caaae39ca5c623ff9f36208cc99349015918e5b5

SHA256
1d2e0e9adf2ef59418acd964a2fda82735ea81ed1c6cb86f5c6e2fc68ffff569

SHA512
af8abdee36ccf894dc05e5ce62b1b4c567d9e8b89cb41ad693c65bf8eab5c1ae3c2af3e9e61f41ba84aa2055c6a9d5e70645b6a2292db3d8e2893a50e80e03b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
c28567dd78b3191bf774f47d5cc1a67a

SHA1
0ac0ad868600c9ea97880c22633980c72fc2559c

SHA256
8cfa98343e820aada368a7e98b020ee651f8afeaea5efce97179d2ba3e2548a4

SHA512
0a22f0ea48b8f4744a7b08f89d37c366147eeb35a1e12843ae5cbd0a23e3566d4e848b43e99c92c51983cf498eb97e8c60a6f9d636e21fe8f29e919b5c98d95d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
1dda57b9222b93492e1a4ff304973a2c

SHA1
4bb9ded0de23c57dfc89004764ec70f9a4c6153c

SHA256
c0184221aaad30b6296442cf2798f813b244d74b4d0b4bd01918e0d11915cab7

SHA512
53d3b28cdb7fc58ecda01179c459f55fbced101479b2becf9d5a36277d6159a527ccb8d0dd9f5802204f16e8f74c969ee8c8970a92a7986d7b89068236297716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
965b6a3981556615aea4c7a817fe386d

SHA1
557ddd866fa01f64f84fbcd0f129bf98f2fbbf75

SHA256
14334260937b1c0acb8a936a4aaab93e790fdd3cc454d227eae000b5e6c9d603

SHA512
b5e8145790b71ed6eb4d20d57215fe12632087baf403590c897698f5361bf7563e478e52896df4b82e482a2cc38dabe8ef814b794f204d288b2a65f2e4011cef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
b26bf1bea64e076e046c52dace36d27a

SHA1
43e0dc3e9b2a9f9dddd6feba2b87e6c2f4ef2d3f

SHA256
06352f76a9fda5498dd0300b53c106134e56fdef5a16dda62c1689d291de2d4f

SHA512
abec1784a23aa8d533efb02d93dbad332683c6f4aa1e050090056ebc8dab0e2af8b66c3ab03c023948838d4f7117bafb58cf3627b30b359fc63e9e92bb34bbab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
437d4589e2ec84bc48075a3f2e920708

SHA1
27c92bfc2de059161768ecee72ed2f099f2fdab1

SHA256
1b7e0ebb4b051f0c43137aafff0c5bd1da86afe271b50fc98ea638b84d53c933

SHA512
ab2d46118a73ffc4f46e32ce00ce658979a0d625022d8a0f83426cd519bcae5636f9f4033a0689851a2215fa6d6cbaf8d93f7eff9bc0a393e06aa8da960fad3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
324a09c858d9cc45d556dfc6b1f5b648

SHA1
a3444407e7e63ac3d61f868688004ed29ed0d93e

SHA256
b8d8203172312bd3949651d446a344a7f5e9526cc56261ca4669ba160d0c0b33

SHA512
1c87fb009383ca3496efa505d12522ea6d67add9cdd17f354a7d94cb093cd8392d2dcd502563ac795301d30632f5750674259b3d39c27392dd0a063e58d57401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
e833ac01151c11443b0a6637250bbc33

SHA1
3ecc6b84a2fd670d5981593c0b5dc0af5c9a61e2

SHA256
b79e218e9239c80a6373dc3a4ed2ab225999b7cde522bc507e58bfdcc94eca58

SHA512
4e5d076b7c603551de4e7c6830d7360c812072639c44009dd4fee7c6119ded127985a65c629e1e5bbb4354d6e154a6606de785bc6de3ba68191c7906b3d0338c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
042f061f8ae1be9732f45e1b9c066e4c

SHA1
8bc84c43275cbe8294d355c3eae2dfb9227ab17c

SHA256
3beb3e24c90e398d3b6e81ccf8b8dc08cc93622a3a52d166daa4c68e25ed5617

SHA512
b34ef23a9c7bbd099319805e410ba1f7c9fdc11b092403489b66395741fdfaae0f3a571639ce6e245f217b869c04a768c4698fd5054c92248d03ee53da7bdaef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
602b57e8ba98413a0a57506ed190cb2d

SHA1
60fb2b6ab0416d3680ecf7cd5801918dd989fc3d

SHA256
5c6cb783aef1f92986418b2dc7efda8c7784dfac004bf22e3787945cd951aff4

SHA512
ba0ee0df9316f875356c1eb472a52a2e289ba5f6e46f3bd384d2f44178fe6f08b6fb57107a17a33abb7a676472bcf67f45d8aa1ab3da7301f197d1097f52d802

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
b1e5c92d3b5eddce1d7b941f243e9084

SHA1
8e837cd797c66bfe5e0e5ce5e8de67568eaa50a7

SHA256
39077130239bc53844bfaff5c50ce1292da15c750c41bada54ee784d107b3bc7

SHA512
812b6e6985efbb925d0b962d4594bc7f99e3d6260adabdcee270c594e306b6e4f4c8ef5bad412b9af1b31393f74472d29dcf7c70e92940c19aefb41b6ff0b891

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
86fe51e180bdcb2b11544ea6484ac945

SHA1
cbe9f0d78953010e8522e29c23f1f4291e1c2dd5

SHA256
414e2d7e2139a50168ec55f0cbfae5b56d75a41d2338bf439e1a72fd9f377de1

SHA512
736585afabf81f1da261da24d26f2416b83e5bcc2d29163c46bb6a51d7439b662514823cd30ee8d9e23c2b503e44084e91424ec8e1c3fb0e66b8c2cad9ea8353

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
79894fd325af4385ee6ebda0cffa5802

SHA1
a1aeab27162bb8570ec72833061fb1a8389d2e3e

SHA256
398ff4ff3156c3957ef4e54d5244b2725c063aa08273a2d08b5b97ed57f03ee7

SHA512
6e1a1aeda73cea10423b9b68acc0fb373bc4f7bbf4c7bbbbe5606e98058e74570c7944a975c217f4f0231b039f0e8b86948d03e9b005643de794c855ce1d44f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
d0ad9662e3b87c1e760ef390bfe01fb1

SHA1
9b15d1310a7a33bf0b4373acea6a14cafdaac1ca

SHA256
3ea6c01e36343663d7f7e456e26416e39cc603d189ae238a085a86c95f81fd7c

SHA512
12536e1ea56fc403bb3b8ed831865e99429e6c49f4d5b3d3621d1933a04070c45dcf58635991ad66bb8ce1a3722f35c3e335cd585994920cadae4454dc376ae6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe589100.TMP

Filesize
392B

MD5
a3e1a2e413602daf1abfeb163b8abc75

SHA1
ed7a4e3f6beaf778245ca939bbedd536aa051d7c

SHA256
a5f7cc7c4535bb697f1ee7eca8bd06ae584c582a006c261856ca3856c4364e69

SHA512
70b818895b497da63765bfed49376c4e2fc8ba11f048bff369833db4a890d138990883d00404c8a233db4b46e559b4ac086ad5b2b290e413580980b49848a503

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
7ed747c690ebc75cf29c4ed0277d3684

SHA1
a9ae84a869109b1b1dcb327fc48b26324b6e6b56

SHA256
4d68778820cf3bc36d3d6339c6d43b48e8b192799c001802c7fe900b3db5814d

SHA512
160b85518bc6c4c2e36ee4281e0a097a897353b3a9677d875166240827d9f1f7496acd1c03fd4d93fa1aef0f4d8252922f314bb16a80d3d41ee9d1d466aa74ac

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
8KB

MD5
a463da236bb51ac843255d43f9cff660

SHA1
631b2ac4f56388fc2b19d551e77fb778c59b9d08

SHA256
2ed5cc8256ade2a6f2808b6be10c499be638f398e7d066846a7e9d0246539d09

SHA512
12df5b077ff6cec7bf22d98eddb82de79abe0461f5605611fb6362313077755f015513cd1965517c56706fc9a118e3ae2f39d1bc6a4bad79ff778ff2eb718e7b

Download Submit