hxxps://ability-nosoftware-3662[.]my[.]salesforce-sites[.]com/cj

Resubmissions

26/03/2025, 04:29

250326-e4hwqs1kv7 10

26/03/2025, 04:25

250326-e17qpaxvfz 10

Analysis

max time kernel
147s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2025, 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ability-nosoftware-3662.my.salesforce-sites.com/cj

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4224_180125124\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4224_180125124\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4224_2125208557\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4224_2125208557\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4224_133050926\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4224_133050926\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4224_283339434\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4224_283339434\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4224_283339434\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4224_180125124\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4224_180125124\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4224_2125208557\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4224_133050926\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4224_133050926\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4224_180125124\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4224_2125208557\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4224_2125208557\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4224_133050926\safety_tips.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133874367456123653"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3446877943-4095308722-756223633-1000\{F413D902-8D73-4E43-94AF-97FD3A1CA4A9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 2460	4224	msedge.exe	85
PID 4224 wrote to memory of 2460	4224	msedge.exe	85
PID 4224 wrote to memory of 5320	4224	msedge.exe	86
PID 4224 wrote to memory of 5320	4224	msedge.exe	86
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 1652	4224	msedge.exe	87
PID 4224 wrote to memory of 3452	4224	msedge.exe	88
PID 4224 wrote to memory of 3452	4224	msedge.exe	88
PID 4224 wrote to memory of 3452	4224	msedge.exe	88
PID 4224 wrote to memory of 3452	4224	msedge.exe	88
PID 4224 wrote to memory of 3452	4224	msedge.exe	88
PID 4224 wrote to memory of 3452	4224	msedge.exe	88
PID 4224 wrote to memory of 3452	4224	msedge.exe	88
PID 4224 wrote to memory of 3452	4224	msedge.exe	88
PID 4224 wrote to memory of 3452	4224	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://ability-nosoftware-3662.my.salesforce-sites.com/cj
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x268,0x7ffea695f208,0x7ffea695f214,0x7ffea695f220
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1944,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2232,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2600,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3456,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3464,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4956,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4212,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4828,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5708,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5708,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6004,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5720,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3736,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6296,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6304,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=4996,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6088,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6220,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3776,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4864,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5648,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6680,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=764,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=768 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6248,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=6656,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=6128,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=6416,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=5168,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=3432,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6280,i,10104908204172202399,10895230022670112334,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:3748

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping4224_133050926\manifest.json

Filesize
72B

MD5
a30b19bb414d78fff00fc7855d6ed5fd

SHA1
2a6408f2829e964c578751bf29ec4f702412c11e

SHA256
9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f

SHA512
66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4224_180125124\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4224_180125124\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4224_2125208557\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
7b0736a36bad51260e5db322736df2e9

SHA1
30af14ed09d3f769230d67f51e0adb955833673e

SHA256
0d2adfd06d505b9020c292d30597083d808bfd90ddc0fe173def5db96832a087

SHA512
caabdc6a8601b93f3c082e6506b3c9efe2242b90e92e86306dc0bd4857d33343ba395325fabb21f5db562d3e3932f52f77de547f379072d0154efd5f1b1cdeb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b338070f6939341bb4aa44a21dd5ea0a

SHA1
7b62eac908ba042ee7ef9babc049f309d6300c56

SHA256
16c5245bf3ba0241b81f1d146d402f4c17f3af5f71c9db21e244d9d485868556

SHA512
f709057dbdfe34662f6b6f2b72c67d4db05f9aa66a63d7f9bd80b636657311ecebe5eeee303c70edb87c58f53c47a4e2cc26a5dded1311a1ad60a6f03df5fc3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe580c11.TMP

Filesize
3KB

MD5
49c9c12e88cbdf174f2b530e05861ebb

SHA1
94a65ee5d20dcdb0fb76bee5b20aeeaa3e3f01f1

SHA256
67a8dfe020e27879a2f0fb5d3b91503b11a28471b0df1e46be6796abdc6003f9

SHA512
aef4ecc773858db121116f1680787807502b9710507ac01039a839f31fc90cabd01429ab32643f9236b882b59d57f7fd3de0a7bf9575509548fa35016a21daed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
f1b9cdd57fdfba0936cc9df4b3553125

SHA1
b0c01189fea3ee3c8a7a983a6c65ec17adfc6bcb

SHA256
17ac1ece79ed2d2cc67e0d7f914371a9a7332f65657f9004bd630553c3783e53

SHA512
6353130066ae58b42279e1ef8f7dc6a557c921d23a85b1a0e9edf9972dd13128e452a24a7a4b6f463324b9b8a302ce13fbc1c034948063bd63d553eefe2e1208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
86c500ab2e2a341c43fca32ebcdbd226

SHA1
fec30436c79c914200b0e01637a9ecd86ff38ccd

SHA256
37360990a6b1d1c6156fda4f53666b66c6d53dfd84bb668b4961185c7adac5ad

SHA512
f78e86ea6bbf810277001443b953c3d35f723846e2fa5698c23dc719c68f195342a0c9e26ad9dcfe6ca01254b054e915d009bb1e56d5c01b81352a85effe05c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
6e638a9aaac89c661003c716c95d7ccb

SHA1
1e281acc6e4a3531220205d8af7855c6be239b44

SHA256
10ee6387af35a2bfb65356306493893a6b1fb80040ff96ac0894d1444844d13e

SHA512
1b2695b3f19f4fce571426538091cc2b46ffb13736bb65bd9023e798bc1af54994e534dd2beda8eca7b9121a849d2629e103f48aff6bab9f1de9090a5bbb84a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
5a95a79a1eb578518dc48dc517edace3

SHA1
6648ee791dce65c4e05778e42b953861a5477164

SHA256
74cfdb287346102bb34e18a7d26e8d31f8781f917bb40ac59ccef4f6165e368b

SHA512
457bcfb7ba62f8f85fb875d75cbe6dbc52fea98dff16c8a1c0d96150200b5adcd5882d8dff051b3fe8e3509a0f06f2d93d0d8c123ffab4e3113af31fee41a9bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
1231402b63dd06cf54e9d279eec7335a

SHA1
ed69aeb2ff8ff88f2db8a9274e001b9a79c5bdd8

SHA256
14e63cfdf40470db54d284e4d5860d905595fc136c25709f9342dfa4c1031273

SHA512
56a5e9114abb08b1174e700def8849c123505fb5425fd15c30fce8bbd8c652bccd38dae3036775f2eaaf4a04bf321755d2bb6599443120109d1eed0311b17e76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
5b9002647ae71b2fb3ec6110c300e81d

SHA1
c58aea5d41f28e66adc4f43be07e79e38462ae8a

SHA256
379cedba3defb69d9da273b5745c14237f194dc9d76c2d62a4ea2fb6de25ef4f

SHA512
bc0e631965d6de64e6ef31d8a64b84542570ae066cfd97e2b2bfdf74ede16b2b747e0e338997299d02f79897757229854718563194ab98a9a0fca6ea4d58dfb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
6a677018b487b6ff3e007474f50c385b

SHA1
c2cbd8915db5764543306bbf2b9a86db6ca478c2

SHA256
b4986215858db0e220153696a9c09bb35282464b15622d432d99452cb2b15df1

SHA512
167173999ec24a57d7c030b97c1d7ebe4a2165d21a1db803b969844995ea34ab43a91fdb1411fd45697779cb14273f3d88bd80e90b669a9979a4cb283b1ff7a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
672b22359c48f5fce16093d64ea9d125

SHA1
38cdea90a7adc050d66f2f6b34886b9a7270c0b4

SHA256
d1e39e01e7f1d7680fff434fffc7f82099e28f126dafc4a4936dbdc72e83ef41

SHA512
f2a0e86d1cba5b193d3b02f3079cf27db18fbede70c8f5693611d2333a977e53c7edab9d3176bcb910e9b9aeadff10899f6f3457b33d808b390e52c5bc7bf9bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
b97f895c530a5cde3779ea743a5b987f

SHA1
0226659d54845f21d8950e6df46457403115306b

SHA256
d4704a8d9292de732b6603943046c5d1cd6a46d4d11f923b63ed65203abbe61e

SHA512
b00cb66549b2ee92a1024b699f7ae867c30b341695aab035d8d87a12e8675ce03f29d78eff9493b0f272acea44d3d8f3ccc1502dbfc2de796c059e05ce223733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
5b5afe51bd3ab4292b186175a0cfc2fd

SHA1
69d55fe328a14e68bf95e5748c97e935799f5961

SHA256
7dc36533f3a3243c0db4ef5269de1e161c9b8b6325d9d51748405804656394d2

SHA512
2345b046dc5b10f0ec3093be249ffc85def953c8f38fc345c9381a9f8eda69eddd68e1ef1d538932c5ce21cd25b676758b8eaf5ce3dc118466bbdfe589ef3514

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
20e64a7e3f4df313dde1bbb6895f00fd

SHA1
6a9a6baa8b68712431f35cbcd5f0b67f41e3e0a6

SHA256
0a18a855c4a6182635625dec63e84c1879b6e3e941338e09e214ab43c7dfce0d

SHA512
90b0b46e7c3f1d6edaf0d385a93774db4523a06ad1bfcb9af3576610151aa59060091b0fca6443ba564d31b01bc8a060bf0eea6ba94c4b0718edb2197a3f4f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
7e3f3e2198b8eb36b0eba3e1ef06c492

SHA1
63f627b873deaa5b51fcd48df81d7c37779da2af

SHA256
b820d77029bf7b78874b0673038d258e1319656ae13408dcb7b2e1b6cb56eb3c

SHA512
94510b2f8fe00dbb5473b3fda3c14b962674a0c29a349c64124a44725da05fae3e258c09127b09c723e777e4f1674d334a77ca20c69fa6bc46ed769f9fa91336

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
75ca5c477c19e734be9153a07ab97844

SHA1
0edaaec22c8e672ef6da72e41e91d174879ae5f9

SHA256
447d28e66286f4cd3802cbf0656b89a2d14965efcea75b618a19b2a0842c8bff

SHA512
34442963b4a3ede88c16a78d11d135a09b68ba5f3eae6ed42311926d92c9ecf061fc5ecc6fb78b8768e4fe83830a4641c2429b4d9051038dfa646bf324a2ec03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
33fa9c29345631a5f053f3d8af59a5d2

SHA1
34238c1c2a674aad47fa9f0af7d63cd5fd523591

SHA256
264136987a1e8368731eb1fa5e795344309be29e6133b5493c70d0abc26176e1

SHA512
479d29b0746286ecc32f396b36e346b91f735de1b4468640bb60644c0b12741435c97c61ca51091b36c3960ff2409f8206f66b8669bf9a4ec840c063dda33a2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5959ee.TMP

Filesize
392B

MD5
2832789cdcf427ccc7daaaddd1213e33

SHA1
7da42e29910940ed93ee8345ffa9735be0b57c9c

SHA256
5cc5a53c06226bbcaa501f3406367483cdf4069ea977db49e896509230577a38

SHA512
f7bfc0185441fedc0f106b342389e6d9267308ee386dbd19c4cd3abf17b35acfb6494c2f52ab6702b73e59faec069f58ceee6e8792a321c98fa86a52985cdec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb

Filesize
163KB

MD5
bd6846ffa7f4cf897b5323e4a5dcd551

SHA1
a6596cdc8de199492791faa39ce6096cf39295cd

SHA256
854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666

SHA512
aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb

Filesize
3KB

MD5
17c10dbe88d84b9309e6d151923ce116

SHA1
9ad2553c061ddcc07e6f66ce4f9e30290c056bdf

SHA256
3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e

SHA512
ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
18a4cb0e09d153ad21372aa04e6bc8f6

SHA1
472a3084e6d548f6b0b845aab88d75f54262b728

SHA256
59b3e1234ec983c33e2c57fb5f6758add4c86759bfa592c41c7833c25e773059

SHA512
b0ec1fea477df006ae3fa7375eda3bb2fca638698441975400a9a917df544c7e4a822987bef9655147026075050ae921571c64194389076096e8b88d868049c7

Download Submit