1a3ef81297f8445b27e7444b6bc529a097eadf8e4437b6964e4d725918139345

Analysis

max time kernel
142s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2025, 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Size

1.4MB
MD5

0050a749a20fab483d1ecf943f63d566
SHA1

5af6f1d0630e0e9b6683bc384dd5b56c4b571657
SHA256

1a3ef81297f8445b27e7444b6bc529a097eadf8e4437b6964e4d725918139345
SHA512

6f7a4761be9dbae066b906ba26042f96887dfc63e412414400f4caee30786d9e53048101b531d4ad1faf9dd273a5a3514028b54e016e585a4d50454a5562e4f5
SSDEEP

24576:NTLBd7xejG61lzFhE6WZXJDiY3Bf78QFnTojcZfUTq:NTLBd7Yuh5GY98QBTRZfUTq

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2308_1509629099\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2308_947729021\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2308_947729021\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2308_1509629099\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2308_560753497\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2308_1208192148\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2308_1208192148\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2308_560753497\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2308_560753497\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2308_947729021\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2308_947729021\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2308_947729021\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2308_1208192148\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2308_1509629099\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2308_560753497\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2308_560753497\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133873754631638508"	msedge.exe

Modifies registry class 44 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:PID = "0"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\AnyVideoSoftware.AnyVideoPlayer.playlist\shell\open	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\WOW6432Node\CLSID\{C7D55E60-9876-4f4c-AE02-EA050EE9FBB8}	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\.playlist\ = "AnyVideoSoftware.AnyVideoPlayer.playlist"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\WOW6432Node\CLSID\{C7D55E60-9876-4f4c-AE02-EA050EE9FBB8}\ = 9d89bbb29cbf91ad9db08daa9db095afce86ccb29d8699b298cd94cece86c8b39ccd9db3989591aa98cccc9f9d9598cb9d86becf99bf91b3ce86cbca99968db29cb0cbcc9986959f9c968ccf9b968ccc9cbf91ae9c89bbd1ce86a79f9d96c8b29bcd88cf9dbfc89f	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80aba36ff8d270c74f9c99fcbf05467f3a0000	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-308834014-1004923324-1191300197-1000\{812C167C-F891-4382-9232-CCF5E07CB3AE}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}\Mode = "1"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000900444648b4cd1118b70080036b11a030300000078000000	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\AnyVideoSoftware.AnyVideoPlayer.playlist\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe\" \"%1\""	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupView = "0"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\AnyVideoSoftware.AnyVideoPlayer.playlist	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\AnyVideoSoftware.AnyVideoPlayer.playlist\ = "Playlist"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByDirection = "1"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\.playlist	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}\LogicalViewMode = "3"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1092616193"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}\IconSize = "96"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Videos"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\AnyVideoSoftware.AnyVideoPlayer.playlist\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe,1"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\AnyVideoSoftware.AnyVideoPlayer.playlist\shell	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\AnyVideoSoftware.AnyVideoPlayer.playlist\DefaultIcon	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\AnyVideoSoftware.AnyVideoPlayer.playlist\shell\open\command	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2308	msedge.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 2308	4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe	94
PID 4452 wrote to memory of 2308	4452	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe	94
PID 2308 wrote to memory of 4744	2308	msedge.exe	95
PID 2308 wrote to memory of 4744	2308	msedge.exe	95
PID 2308 wrote to memory of 1924	2308	msedge.exe	96
PID 2308 wrote to memory of 1924	2308	msedge.exe	96
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 2076	2308	msedge.exe	97
PID 2308 wrote to memory of 4768	2308	msedge.exe	98
PID 2308 wrote to memory of 4768	2308	msedge.exe	98
PID 2308 wrote to memory of 4768	2308	msedge.exe	98
PID 2308 wrote to memory of 4768	2308	msedge.exe	98
PID 2308 wrote to memory of 4768	2308	msedge.exe	98
PID 2308 wrote to memory of 4768	2308	msedge.exe	98
PID 2308 wrote to memory of 4768	2308	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.anyvideosoftware.com/any-video-downloader-pro/download.html
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2f0,0x7ffb8c8df208,0x7ffb8c8df214,0x7ffb8c8df220
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1864,i,14214206648654954391,1760317341595424810,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
    3⤵
    PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2220,i,14214206648654954391,1760317341595424810,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
    3⤵
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2544,i,14214206648654954391,1760317341595424810,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3408,i,14214206648654954391,1760317341595424810,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:2672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3400,i,14214206648654954391,1760317341595424810,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:1096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4832,i,14214206648654954391,1760317341595424810,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
    3⤵
    PID:532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4804,i,14214206648654954391,1760317341595424810,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
    3⤵
    PID:3908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5004,i,14214206648654954391,1760317341595424810,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5492,i,14214206648654954391,1760317341595424810,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5492,i,14214206648654954391,1760317341595424810,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
    3⤵
    PID:1408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5996,i,14214206648654954391,1760317341595424810,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5964,i,14214206648654954391,1760317341595424810,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6000,i,14214206648654954391,1760317341595424810,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
    3⤵
    PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2880,i,14214206648654954391,1760317341595424810,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6016,i,14214206648654954391,1760317341595424810,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
    3⤵
    PID:1812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2144,i,14214206648654954391,1760317341595424810,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5580,i,14214206648654954391,1760317341595424810,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:8
    3⤵
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6048,i,14214206648654954391,1760317341595424810,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5988,i,14214206648654954391,1760317341595424810,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:8
    3⤵
    PID:1128

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping2308_1208192148\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2308_1509629099\manifest.json

Filesize
118B

MD5
3004ab7c9e3747e5109246e7f6b3859b

SHA1
ac4c574c03611b8bc675e878a1be8124bc32fb48

SHA256
1cb88f273e7906a853670161b6c75fabdd67f67c91b96a78171e2877b88eee96

SHA512
f81e8de5d3010bce31b311de7545353b72a9befd01249cca99e870f141090ba66913991c458f4b5cdfb80902fd116fecd54981cc0a0f4049102247c273f905e0

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2308_560753497\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2308_560753497\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2308_947729021\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
01cc3a42395638ce669dd0d7aba1f929

SHA1
89aa0871fa8e25b55823dd0db9a028ef46dfbdd8

SHA256
d0c6ee43e769188d8a32f782b44cb00052099222be21cbe8bf119469c6612dee

SHA512
d3b88e797333416a4bc6c7f7e224ba68362706747e191a1cd8846a080329473b8f1bfebee5e3fe21faa4d24c8a7683041705e995777714330316e9b563d38e41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
5f14e750cf1446d7b6ce6b973281b8f6

SHA1
1aff636351cf5acdf072b34e7fbcdaa27772de81

SHA256
b007477433e9c26e5ab3bfed4a0c91330abb9214d1a380d38144f421d97520be

SHA512
dc2bc4dae0a379b40a8f1315a2aedc465f1b29d375557c770e6e5f9162ed119482830cd0960b9204d595417bf6b6cfe473f9bea97a6c4f1a2d9c0a8fbfa3ba22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
4203010fa2610239e29e6a180652777f

SHA1
9302ff6d591376471ce20fbca12a0b6ffa4159a0

SHA256
d9f9e72177216c927c03bd7e341178658f392ea1a103e5da55f5ee8fba11f9a1

SHA512
e4ca2aaf9bc39f9ab7071bd9c8c587c4c90f6b143f7374879ef47d96f98f491fb233fca264b4f001a77a6a712c532d525a5182e7e7eec396e591b98477c7fcc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
7b35d8653ddff6d838460fd744a1f227

SHA1
6038258dd88c562f995b18ca3088b15ca4ed0d45

SHA256
b1fd8ca1611dd3dabbff793cbd8bbba11ecdb1b395030374c0d9614277303651

SHA512
3d81ec27749524611980a0821154987a24e326193963a9dc1f3d82fe8921885057895845e1dd8cfbfa31f059b00b5d6ae2af1205e819a0589f21e5281d7bb411

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
04af5679f83e485629bfbf39c4f15fba

SHA1
b3c2a15560c042ab1cda43eacf9a1ff34034edae

SHA256
82b20c2a3580dc0f0ddc648db0fdcdc7bb937b64c60177fcd126b35d04f3380a

SHA512
e18e953fb4ccb979839fb7241efe6b5c036fd762b25fbd4c7d4b4e6ee52fb32631d6cf517fa1e4ec3c302e723d4be678e27d5ff43b7d9ea2885e60a0d6484f90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
36d6cc700dbb54f7ff2901d5e49545d9

SHA1
f627fbb857f1ba97e3791c88662b40f0ad3418d2

SHA256
1e8cbe947d15aaa740fdafe08e607a00a4140bf41022fb077293e3eb975129a7

SHA512
2cf6f93a8fa3dad4c82ffe82e517a6d4dad87c96b07608bc4d592aa3bccca6ac5b7649d2f7ad58c67bdc71814c733a2a2800222a74de4fb89220ae56a2ebef3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
5958bff9bdaa81999909225786b980de

SHA1
978bfac2ec0d4dd629c6a765ac7c1e9f3097a84d

SHA256
b5acdc4f07a2a2c5a6369ec6f3482ca43a36ae9095fc13610beb57bbf3b7b743

SHA512
aa2910d0f8478a47adf770f52633bdb9422ab796fe0441cb36fdcfa08b8fea6d542662318c3e022c3195285688f5f900515c038b03303aeac2ed197470394926

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
0789248b4290c7962335346316200feb

SHA1
bc89aef8593c281bfdf95e8c5b58325d0781caaa

SHA256
742e5641d2165bc23aee6ca2a2f619d64fc5a21b57a93c2aacb4762f58da05b8

SHA512
d7cb84a40126ed2e4cc294923ac0d7494fb5a68f2b670b5fea6c3e354aab9b332cf2f3f944bd87fc5ca3ec22483e1235f43e2bd1505e4efe528965b65f007d57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
c359c2e0ec6782411f2ee41b4682bec5

SHA1
c97275dbdec4998269b2851deca06e5b1edbd598

SHA256
60e447cd8fc9ba21afd689eb1aa5d14276c904f02ab1f3e59879825044592b7f

SHA512
e1915da590eaf16281282a469f12bf0999d7a7013f95886c43f930ecc3ff2b8c81ef437cbeded3f60185daa5acde4e0c2d294978a56eff4fc1c08284399980d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
c2ec65a52d858f93e27dd6ee52127200

SHA1
da87585ecbd0f0dc4c0ef8c4a4bebf77bf3d79da

SHA256
f04b9415f16360c815a543023808cdad8c6de5446da0e767bd0bf1a30d6ae42b

SHA512
0e25c23e79ae1208e09151e268b66b6041f6cc4740a4f33faed3c294d132ba767bb99af25d7f21e5a788abe4ff06e2a28ccfbe58154012e806e0726fbcc25f72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
b86aad9fa97b96d83c1155d247f99b6d

SHA1
0e224efe748dde467419b8d54bca5fd15ec6d7e4

SHA256
ef56340ffa12524d41d54f9c351c9be943eaffd13ae5f9dd9e8a7ffaed8c214e

SHA512
ffba942f9aa0398503364d94e9e085f7582ba63fc974029c613ababa3f95d36e27847b06b1fe410187ab756e34b681345119053cce74f8eccaec1aefce7d86ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
7e028ed390819a38c86ee2cf9db13fd3

SHA1
1aad2e5f30452c61ff9d387a8edcf71c4af2cc39

SHA256
311caeeeeaff64bdd17db63db0e1e5c52c45fa68c46e359e88b831d543213b17

SHA512
5e81469d568d22d8eacd3a3b4a3ddc72a9345547beb15db6250a84f7e2e17a957b00bfb5eca32b6f98711b233222ae4f062bdd88c89ef6a795b52b8622691f43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.25.1\typosquatting_list.pb

Filesize
628KB

MD5
c26015b2460d1acf6859aad730dc8f4a

SHA1
9c772753b62eaf995e39ea5ce1ef86454b58f169

SHA256
5d816db5713aa5d2fa0c1de5461729250439d7609d95bd65623c0ea62da192c7

SHA512
ef72f6e7a4ac1eab4c59ef0d90f884e29880a305ca262869b87a90462897d182a45b38fb074d704205a422cb886214c05aea6d0701715917b3092cb15559a6d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
7ad76cefe4afdf8105adc41c42899312

SHA1
a08a5cc32bf369157587183815c5617648b1ec7a

SHA256
7cc369408566c5c586719579c059b5ccbd3b1aaec8c66f97cf6c7fe3b6c08ef9

SHA512
9c97cb98c1e18ca4ab58a407ceb678dcb1a454a1223fa0c3b77fa4016adc03dcd7f585f28435a8a5608192296d28b449876517815d940820b53f812799d057bb

Download Submit