60689c3129e1b8236fe547f9141b7171953b2e9b0f5857ca0c8e155db664306a

Analysis

max time kernel
149s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

R.E.P.O.v0.1.2-0xdeadc0de/OnlineFix.url
Size

46B
MD5

59bf167dc52a52f6e45f418f8c73ffa1
SHA1

fa006950a6a971e89d4a1c23070d458a30463999
SHA256

3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
SHA512

00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2104	msedge.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
79	discord.com
78	discord.com

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_1547541640\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_1547541640\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_251084108\ct_config.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_251084108\kp_pinslist.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_31782199\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_1853290988\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_1853290988\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_1853290988\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_1853290988\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_1601380623\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_251084108\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_251084108\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_31782199\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_31782199\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_1601380623\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_1547541640\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_251084108\crs.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_1237288983\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_31782199\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_1853290988\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_1601380623\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_1237288983\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_1237288983\well_known_domains.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_31782199\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133871584254152073"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1062200478-553497403-3857448183-1000\{ED266CC8-CE65-4851-9D2C-B96D04ECC5D0}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4336	msedge.exe
4336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5976 wrote to memory of 2104	5976	rundll32.exe	93
PID 5976 wrote to memory of 2104	5976	rundll32.exe	93
PID 2104 wrote to memory of 2140	2104	msedge.exe	95
PID 2104 wrote to memory of 2140	2104	msedge.exe	95
PID 2104 wrote to memory of 1260	2104	msedge.exe	96
PID 2104 wrote to memory of 1260	2104	msedge.exe	96
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 5552	2104	msedge.exe	97
PID 2104 wrote to memory of 708	2104	msedge.exe	98
PID 2104 wrote to memory of 708	2104	msedge.exe	98
PID 2104 wrote to memory of 708	2104	msedge.exe	98
PID 2104 wrote to memory of 708	2104	msedge.exe	98
PID 2104 wrote to memory of 708	2104	msedge.exe	98
PID 2104 wrote to memory of 708	2104	msedge.exe	98
PID 2104 wrote to memory of 708	2104	msedge.exe	98

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\R.E.P.O.v0.1.2-0xdeadc0de\OnlineFix.url
1⤵
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://online-fix.me/
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x344,0x7ffa2d39f208,0x7ffa2d39f214,0x7ffa2d39f220
    3⤵
    PID:2140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1756,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
    3⤵
    PID:1260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2324,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
    3⤵
    PID:5552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2592,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
    3⤵
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3520,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3528,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4344,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
    3⤵
    PID:1380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5244,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5572,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5880,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=5720,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5672,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
    3⤵
    PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5240,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6180,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
    3⤵
    PID:884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6188,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
    3⤵
    PID:432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6576,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
    3⤵
    PID:3212
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6644,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6644,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6996,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
    3⤵
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5196,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6988,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
    3⤵
    PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6216,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
    3⤵
    PID:1752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5248,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
    3⤵
    PID:1780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=5536,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6752,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5728,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:8
    3⤵
    PID:1804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5320,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6244,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5704,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=5016,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5276,i,12427506868567361186,121262791647221347,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
    3⤵
    PID:1256

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1376

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x4f4
1⤵
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping2104_1237288983\manifest.json

Filesize
141B

MD5
811f0436837c701dc1cea3d6292b3922

SHA1
4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87

SHA256
dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d

SHA512
21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2104_1547541640\manifest.json

Filesize
118B

MD5
3eaf87405bb6f4c2f66a0fa1e4683d3f

SHA1
2ddb6e2e3bacf7bfc4c807dfc328dc30a003896a

SHA256
94623a5a71617638408e7cbeaa3c23bf109e3c7f787717a625f24f7377b732cb

SHA512
d35568778a0bc22b4dd254145debd1f202474145ff7a9c9c372ffc22466c2fbca32cc7ffc5d6781c3f86076fc9d5df28f7278dbe2e406d0364a06368c6fc8a04

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2104_1601380623\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2104_1853290988\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2104_251084108\manifest.json

Filesize
102B

MD5
a64e2a4236e705215a3fd5cb2697a71f

SHA1
1c73e6aad8f44ade36df31a23eaaf8cd0cae826d

SHA256
014e9fc1219beefc428ec749633125c9bff7febc3be73a14a8f18a6691cd2846

SHA512
75b30c0c8cef490aaf923afbdb5385d4770de82e698f71f8f126a6af5ef16f3a90d0c27687f405274177b1a5250436efddd228a6d2949651f43bd926e8a1cc99

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2104_31782199\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2104_31782199\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
690f9d619434781cadb75580a074a84d

SHA1
9c952a5597941ab800cae7262842ab6ac0b82ab1

SHA256
fc2e4954dbe6b72d5b09e1dc6360ea699437a2551355c2950da0b3d3a4779fc1

SHA512
d6b1da8e7febf926e8b6c316164efbbac22c7c3d9e4933a19fffba3d1667e1993cdeb5064aa53816c0c53f9d2c53e204772de987eb18adbb094a0fb84ae61fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ed

Filesize
255KB

MD5
e80cdded42978faae0ba033638a524ef

SHA1
4bc7ca1769ae8f7d4ae1abbe58776aefb4d0beb1

SHA256
f53ea4b855088dce71229d9760b4c6afef96a764daf95b5e3852cfdcc38e69cb

SHA512
b02648b654c1223ebecba8fbb8509b8e608760f6f8063acc3bc39511e9bf58d20a47d3f81cb627e9cd0d3a86a6ac554a51aff1648723cf20e61775e79982a999

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f8

Filesize
48KB

MD5
4f43bd8516012aa229e3731913d73256

SHA1
92b18484c5e638b4efc9723e5fc3afba359618eb

SHA256
39606ea9321f013ae9805371e20cbe9787658f50c4f256fc5b738d6d7c11fc55

SHA512
4d7235c5c1e4d0a9676b9801c9d165ef6ff8c5e313d36452e77177f96e48178391499a4bfda4e47026fe57bad01b87cd54dac8cdee7bb0cf94e11625c47e04e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000fa

Filesize
93KB

MD5
0db54a9de7ca5829cb5cd1f40a7df64a

SHA1
db6c3258cadf35af46a24a2f10388bf9f8a48e5e

SHA256
c3f979efb9f6f93ba82b263006f177ad088d811ddd45a00d9308020374ac638d

SHA512
c3311a7ce812a39b0f0027d260eb59f7d30dbb52a9a4f52fdfc8ed4ec4840aa66d11723018e6d46cc25485c6a3d469286095e81e7574d7fccde9f098f392a1f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000fb

Filesize
156KB

MD5
866fa967a11d20f6778600cbebdda8d6

SHA1
d71165d18fccb324990db5c5b08a6c218fcd6de4

SHA256
02abe881bcae956fb20650e9aca4f09bd5c5d2e792515637680f1849a98f186e

SHA512
d0025c198720a103983a87087ab435c7ec5038137a32d0d95517ce3bcd9bb1323e03e61e67ca4031ec9412706afacfbb4ee12f756dd65eb5c636d26f7b8caaaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000fd

Filesize
58KB

MD5
badbd4480920e01347c05e84b09316e6

SHA1
1e93ba08e65ae86e05c7e4455718f139a914bcdd

SHA256
37860d340af50c43c1f18eeba945a0ddf63f45654b7385f413370cf1f5ce57eb

SHA512
b735e554ff08983d0dfd0ab07374c9962d7af775a8c7d91481fa1fc4ff621fe9039539893e799c91552ea5fa8f785d2d068608c21a49de7bdb4236af6c394133

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ff

Filesize
46KB

MD5
f013112b19afa3f40fd173aad327c2b9

SHA1
ad7e182846e99e48c52478a41affc52f85ae9315

SHA256
3e4154d4f7eb1a3b87dddf264d6beae057c04b193be290f6e065100c502f1186

SHA512
509a0ef62c2522f9f0a2e1153e3d7c281b7a20f38cf8c83aca301465e9c85b43a0638c980191791275c14978baa6a29ffa8b0693e562dec32c8a13a27784aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
23fb595b806b18ce729a97595b9b8401

SHA1
cc7d2acd1d0dab40f0940d2c4fd7f343f6749d2f

SHA256
4289eaf7e73e0fcfa3faac313fb55f3c7d1aa01fa32de6d4073b3fcdd2603dce

SHA512
bdd356a6a329669aa98b2390f3356fcf257576beddbcee71e83b20ee1f7a515eb17289bdda48be658c369b701bc0085f0b0d08dd3f76e63f0917486c2d4f2791

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
5e707721f75b9c52907ab62cb2e9f642

SHA1
9146262774d53c2d719252811486b77958d7dc81

SHA256
519d51aa5178380abd3bdcfece960a236ac751c0d0a6dabc376a99797a801723

SHA512
c5446a43c4874a3856c6a405848d52b415baf393c1d885797378d4296c40b3c68d0953cf1fa34b6deafdd0f77dd13b8e226853a1409b0fd2d415c7216bc3833a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe580ee0.TMP

Filesize
3KB

MD5
56055ece84edac52efa5f417563557ee

SHA1
a75c8ce897f1daca9a5e3d362d2f3812dff01463

SHA256
a8178eb0fb508ce890582d0ff088f333a408afacfb4fd885dbb5731026a03dec

SHA512
593cacce1d82e7a61f8b1adc7725ddb1a1092857ba1af83909cda21538156a77ef671c7a7ae15137e964f2e31f0ee86fca8de0e10562943b2f3d2f8e9c4db8d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
10KB

MD5
340f10f0a54c22aae1653a89a94c40c0

SHA1
24144d9bed393a2b416f22cb0154289116ae45d8

SHA256
7eda9b8fab79e7d89f3cc2e6a3783d860c7c5657300faf5bfd0ddd48ec0531ff

SHA512
442ebb4a7bd363316627e33a1a9fac50f610bc40bbba7242e4c752c9e857204c9217e0ed162c04d8bace275b845c643173594f1dc98cf209d707b2fdcf8ee394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
31abdd27c992db6a11fa490390412922

SHA1
1387b1d1cdc93ca478d8f69a4316144165615343

SHA256
7d1231b66ba40d6b6c013a9f32120f1523f462c46ed1fa973ce0fe0b72f778c7

SHA512
aa356cff5685bb5d010d0181e7af05230df8220a4813f0ff471f9037833c1c515e8bf03943ce68d5e6cdec1b6ed75aaf78da99c3b8ec97c1fa77f0b120ef713d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
471fbf415decedd50285933909720da9

SHA1
c65c3b1e4da2694fd602be3b79f5e148026e0b59

SHA256
673a17e94b8577990f3efa05d9667c21dae9a0965c5ce88ddbc2165277c7e919

SHA512
b1fa1c91f7f470b98055c8437978ac62304ff0d68d4dcdd3c68de3112d26c623a46539cae752f2eb4e409000d47a80b2e8bb1598d5c543ea7a8a5e6f57de5dfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
fdd4282cf0b75448f07e5b19ec4ba2f1

SHA1
45dbd26b27f63c39d43d0b3fa17b6ccd08a8b4dc

SHA256
b2d9fe0c39ab9d180f55b5e92b8b17d6518426c42a5c22baa3a0a1c041ea81f9

SHA512
243689dc89309d06e9bd8a43f2ea185fb1d168075e18bdc6338fc1fcb349276a6b60418ad689a628f850b610d004b8bfdbcf3f962e7ee2a96f9fe4ed8917c2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
51c690a30e0bb4c0c9ff375db1ed0dd7

SHA1
88b6487097c458ae0f679f3cddd4ab1f24f0c7d4

SHA256
4a4f980e975743e683c1fa2cc834a46bc87da86aa9ccee9388c4a63c4af038be

SHA512
66cc20d332b7e82ac8b63d0cc0b74fab92f1687b23aa90772cf5b604537f06b0ad025665bd160c794982a32299fb7e1b120b453ca09a751fedb554c858875c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
26c65254094c3ea95128d2c78f5ee63e

SHA1
35d2efd4e73fc66328d9c6f68a30feac1dc66bc5

SHA256
d4c62c12a580598938aae1b18eb7e33d0da76f37edecc104dbc5b2d9ac80fa33

SHA512
a98ac850e121b2b1e6c2f365292bd2dbdaa9f3ddda8db1529732dc6db3f71c584243ead572a394b2a28496239bcf197d82ebb4acccd53fd1816885ccbbec2dfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
acd4e8427b1fea1e900411f2e97be19b

SHA1
1b6d9cb4e0aaadfee555fcc125bdcc5e8d539475

SHA256
4d79f96af2d36b41eb0f78797a26a9f09820944c3f168b4f1531677f9ff59c5d

SHA512
a7ff11248039f6008128e552b98f9fff8502c58192bef8d4ba5194e2dc14b12548a5c1bae75ebdb69216543ca266d3f58524948668d2290c1fb1d0448458b4e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
d50bfa3a7f9ce4ebefaeab07fb921f9c

SHA1
f78dce30ea4524e487a0e2ebe0773ec7b8f53084

SHA256
1fb6da504aacc95de541a41a7ee7e67a7d832908d99db8e4ee588393cfc5a7ac

SHA512
36d18a2987c746fe086674bb8d13eaeffeb5ef153f4f238e8d029cd8ee8f8a6f804565baaf0866f16167128ef35ce3896f71321fe539cd505a298b032b0715e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
6d0fbf2e768b2c1447398fbd61ac0131

SHA1
6ac5005559b18f19b12a6763f5d4afe7ecfec6b0

SHA256
c2a420cf2fbc4c71e68bbf02227f82ede0e84a805a363c2a4555b2f2917ea96b

SHA512
ea603d21359dec3ae70432e6a2d7d30c730828e506db3f4f39c47eac4e3f0415f3f4063d10c094435b449b8ec9dc4bd8d62840302ae708ce8570ad30c2410e2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
b2cb1389a7f5547ba2987bac0bddbbd9

SHA1
9e8d13f4f0d1fbd1e45178cddddd2e9aabd18d27

SHA256
51345345ed153c93b831668a7537dd2999bf56138a464931deb846780918fa39

SHA512
86a84cbd4fe388e2e032f624fc790193ba2706080d53ecd9c4eb2fa338deafe1f0599bd176bbcc2aa35eacf165e73dca9c7bb1d7f20d04444273972e907f11e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
718fcaec6be24b8f1429d79ac5a89607

SHA1
914437ca53a4309bf1e8ce5212ef0eee3beec1f6

SHA256
b22dc431d792b05c98c0795f7d0cf22f9d09a891a430d89879263e8d75ea21d0

SHA512
3a6ae3d78e299f4fe066cb8b5ea7885f1218768fd8151f13ce589fe80678e8b92e2056b099cbdf24361ee475cc177eee2a1314306a41946700ecc8cb39df8eff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
30e46fba1cd906d6cfb6ff71318b1782

SHA1
c964b94d0c715a74dccda1656befd6d8e67de574

SHA256
08c30f66cf91be2f70b4a72954b129ff385202786024932b929295fddc942ace

SHA512
bfc37105f1c04bcd9a55dad46fc4ff4db6767c09d162c209011e8f6ddfe539d92888a3e7a8f9d83f1cede353c0ce25f1e5d17838a6ee01c1454cc999abd87a3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
d1a3e2e84a55be6a5668955ba38c1343

SHA1
f170200473f9bfbb79307304e3c5eb58deac84cf

SHA256
bc6707c22178492ea8d22a4610d42296b9fdc9990ed4aaa14fb51ef444f488b3

SHA512
f5e2ca5c3fd78776568f7f56c5df2aa5292d3e2800eb4fd7d724c7f574671e4a30aa4066098df8fb8aeb1f429a6a30224573ef1a0b75f39012018a4eb4727f72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\crs.pb

Filesize
289KB

MD5
2b59269e7efdd95ba14eeb780dfb98c2

SHA1
b3f84cbc37a79eeecb8f1f39b615577d78600096

SHA256
ff2ced650772249abb57f6f19c5d0322d6df22c85c7cf2be193b6134e1b95172

SHA512
e4b454db2248021e0d198805ea54f1c0cfd84b9716a9348b1d0e0acb7c6fb5dd0839e532a5eb6d4410ab759d6688dd6cce8375ad55a150d738d280993142e9d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\ct_config.pb

Filesize
8KB

MD5
811b65320a82ebd6686fabf4bb1cb81a

SHA1
c660d448114043babec5d1c9c2584df6fab7f69b

SHA256
52687dd0c06f86a2298a4442ab8afa9b608271ec01a67217d7b58dab7e507bdf

SHA512
33350cce447508269b7714d9e551560553e020d6acf37a6a6021dc497d4008ce9e532dd615ad68872d75da22ac2039ef0b4fa70c23ec4b58043c468d5d75fd81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\kp_pinslist.pb

Filesize
11KB

MD5
0779206f78d8b0d540445a10cb51670c

SHA1
67f0f916be73bf5cffd3f4c4aa8d122c7d73ad54

SHA256
bf0945921058b9e67db61e6a559531af2f9b78d5fbedb0b411384225bdd366ec

SHA512
4140b2debe9c0b04e1e59be1387dca0e8e2f3cbc1f67830cbc723864acc2276cde9529295dcb4138fa0e2e116416658753fe46901dfa572bdfe6c7fb67bd8478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.22.1\typosquatting_list.pb

Filesize
638KB

MD5
1990075c3abcb86ed86f835866bc3530

SHA1
0a5ef83c48a1b313ae145d47fcef24ac9f903394

SHA256
436c76ecaac7055725852c8112888d6c161698525a56bd2b5ed47ee1c5b2a0ee

SHA512
27cd8b9b5ac90ea02f6dac0a75eacd966e59a5420d0628c942680f512b18138b53488616b8f38792d3c2d22cf94bd46f5fc22d09e4d1e9576c7b4d09ddcc36b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

Filesize
572KB

MD5
f5f5b37fd514776f455864502c852773

SHA1
8d5ed434173fd77feb33cb6cb0fad5e2388d97c6

SHA256
2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e

SHA512
b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
ea0a04fea92a9caac5ce7e133cb66352

SHA1
1291ee1caf6fbe98ac7b6f98927638a4edbf38a3

SHA256
c7c4877500e43c2291d49e06d1694a87ce6eac1f1d3cfd5ea5973ef4a66f9812

SHA512
e8a67b912beb9440b31591971161a22871a1feb0938a095a832d62060305b4de648dc609e3cfe15f587a17b036e35bd2473e76a6a2c78095d0d22995a8ef7e69

Download Submit