lockbit | hxxps://pixeldrain[.]com/u/TcV2BREC

Resubmissions

27/03/2025, 01:44

250327-b54m2sxqz7 8

27/03/2025, 01:13

250327-bk4sbaxpx6 10

Analysis

max time kernel
39s
max time network
105s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
27/03/2025, 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pixeldrain.com/u/TcV2BREC

Score

10^/10

lockbit discovery ransomware

Malware Config

Signatures

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit
Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
behavioral1/files/0x001900000002b391-811.dat	family_lockbit

Downloads MZ/PE file 1 IoCs

flow	pid	Process
102	3908	msedge.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
99	raw.githubusercontent.com
100	raw.githubusercontent.com
101	raw.githubusercontent.com
102	raw.githubusercontent.com
97	raw.githubusercontent.com
98	raw.githubusercontent.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133875115956434294"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1678082226-3994841222-899489560-1000\{6770351D-5631-47F2-850D-FCD21B753D89}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 1928	2376	msedge.exe	78
PID 2376 wrote to memory of 1928	2376	msedge.exe	78
PID 2376 wrote to memory of 3908	2376	msedge.exe	79
PID 2376 wrote to memory of 3908	2376	msedge.exe	79
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 5604	2376	msedge.exe	81
PID 2376 wrote to memory of 5604	2376	msedge.exe	81
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 4980	2376	msedge.exe	80
PID 2376 wrote to memory of 5604	2376	msedge.exe	81
PID 2376 wrote to memory of 5604	2376	msedge.exe	81
PID 2376 wrote to memory of 5604	2376	msedge.exe	81
PID 2376 wrote to memory of 5604	2376	msedge.exe	81
PID 2376 wrote to memory of 5604	2376	msedge.exe	81
PID 2376 wrote to memory of 5604	2376	msedge.exe	81
PID 2376 wrote to memory of 5604	2376	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://pixeldrain.com/u/TcV2BREC
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f4,0x7fff934df208,0x7fff934df214,0x7fff934df220
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1812,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2516,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2216,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:13
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3348,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3360,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4896,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4904,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5412,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5580,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5516,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5516,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6088,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6332,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3456,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6412,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6640,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6044,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6564,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6324,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5100,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=5144,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5288,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:14
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6884,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=7304,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7584,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:14
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=7712,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6496,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:14
  2⤵
  PID:636
- C:\Users\Admin\Downloads\builder (1).exe
  "C:\Users\Admin\Downloads\builder (1).exe"
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2044,i,15841367554386233608,10911963964246645136,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:14
  2⤵
  PID:3768

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
19a88bad99bffbae6102e191cfedd75b

SHA1
df476b325df883b73eda1b2349bab45aa22e808d

SHA256
0d576dfbde1712b7288e4561e3eea75ffdad84dc50a77ceb57a6e9c37d60465a

SHA512
9ec5eb487d8c8fc8e283a94bd43afd740edc4df6a4509d83629416d040586bd42330eb0da6dd41ec1e5550bce9a6643319ff8584f8638a9cde9042fa406825fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b

Filesize
67KB

MD5
cc63ec5f8962041727f3a20d6a278329

SHA1
6cbeee84f8f648f6c2484e8934b189ba76eaeb81

SHA256
89a4d1b2e007ac49fc9677d797266268cd031f99aa0766ca2450bff84ac227d1

SHA512
107cf3499a6cf9cdcbfa3ef4c6b4f2cda2472be116f8efa51ff403c624e8001d254be52de7834b2a6ab9f4bcc1a3b19adc0bba8c496e505abbca371ef6c8f877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097

Filesize
469KB

MD5
c2bc344f6dde0573ea9acdfb6698bf4c

SHA1
d6ae7dc2462c8c35c4a074b0a62f07cfef873c77

SHA256
a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db

SHA512
d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
f9d0f44b4056ef62b3b132c45b391423

SHA1
ec067ee199cc2ffdb49cbdcb1024a541ae4d4b06

SHA256
64bfc3a0b7b7e20f045b6dbd2e56d9a32995fb00bcfd7cc316f1b240f150a215

SHA512
447fde51ab18fcdeabe2b3f3e364034cca3aef7307ac98948dde17dbd444203b3f9b4605de39265c6d6a8977ba83868397c112815dbac1a16802e15dfec2dbd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5835ff.TMP

Filesize
3KB

MD5
7b57e95822000e826926f0cbe1370bcc

SHA1
26db48c163dce91ec137a9f7b1779655d23abc83

SHA256
b413bc8d83012a373dcd2350300dc5591bf70d5f47c2110f0309188e623ad9c2

SHA512
b42c7ae66432e0367a47845d19018e449f00a2ba76964ced9a88849de47017d2a9ec5c72bbc619b5f917002059b44a62c3b72976872465a255b0f0e2b0d34c40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
a4e1656da4fa2ee18f4771239cc29fb3

SHA1
be387f707f7a462a3afe37e7adc1e7d2392d606e

SHA256
296d308aa0c1855a591eb6cd23a05229271ef022a5fb08ee94efbab3cc60e7fd

SHA512
4e814a6138d7b46efdbc0bb4fa049148f91ade8d56f93cd5a6867d481d47582667d79118e99b5d34d6d1ed7d56a6e836a649a3bb86655d9ac27844dae4b42762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
211B

MD5
bd78a9baae777fe5f16959ffe4a3eb98

SHA1
8b8a12d85a3d26d0d0daffb7350b07bdcd04f578

SHA256
a8aebd048d78302494282bbb30d2ce4a75f7033d44f3a286b4e070ae4357f612

SHA512
3e58f371a56b7a4fe6635fc05d10c28863914f77e66736a12ed72fbcb7b89abfe3d7eb1d58b2e4d9f6f99062784bda4baf6a06d8d3d09b91c11197e8cbac3155

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
4f0c1bbdd49e2f48ca0210eca616db3f

SHA1
5cc99edf8082c69b955923180d5918db63ffb61a

SHA256
b20cfb0ec0303bbddcdb376ee60ad72f33c8dfe9f6d237115bf25225def0d1a6

SHA512
6f53b6d773fecb62d5d8682876b9a5cc61687255941d1914577fec6660949d78152e978bc4570f30b566d383eed4ceed25a25c0d540a82ace8c7f8a1dddf9f02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
cc976fa4370435891bcf90cc1ab10ae1

SHA1
7c4c322da15d53c0fb68876359979c546e9e829e

SHA256
f02a5e0706b6421bd703b8812922862f36cf1988821da412e03094cb89efe08f

SHA512
1265b9f8b2442282dc6c383880abb4157181e57f2ccc94a838ece0191b4bab26e0d55529553ef2a819e289dc1bbddfe4a4189aedb475fffc1bd1bca4294dfe36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
de302c0a1d74b1e0805be48b1ee66379

SHA1
7835f198933cff3f8090ab018fe71e06c9175c07

SHA256
470e188c12bf0b41b6fa740d876554b861e80e5e2ed41d92390a9f78ceb7dff6

SHA512
cb98d8f7f1f43fd51ed5b0fe3e634becfe9cac09f8e94c14d17a0ef4a2ee36d5a69ddc47c283a1d8a88563fb6949d9c94c5f4060f963b916f5bc1ddf16f95031

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
0d6773acd15630d38a3d777ade109896

SHA1
17e295f2046cca0ebdea1f374990977f6fdb978c

SHA256
6b1f20ba30f98ebd78b1105a20e65bd3099370c9168c4785aec64e0174a8fbdb

SHA512
52f06882368eb9d6632596de47c88ba57e7c491e637910f43dbc133e39bd91fb306034a0db995a1d822fbcb3f73a21ed08e53e85de2f17a964f9c49ca601eed5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
5b85a5a888bb47d290bf41db934b38fc

SHA1
26cac15546180f94c65115674710afda129d8eac

SHA256
d96f22bf083cf591ce4e353aa9d4da78d0b5f5a1a959465b163411cc62d479ca

SHA512
b1872443901344609f2520e4a67150205d90045cfa54d4b8e8929087ed01e3afa93a66083967d9be1e7b02a7e95b2cc01d43eea6f34b73710265e746e37eee70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
48ee3049ce3416e35b113ee500ceb93b

SHA1
edb3d4657fdb83a061dd554fbc65df237125532c

SHA256
1a379a31091650cb3036da2d30fed4acda98cfdace99ac3be88f3afa1300511f

SHA512
ff707ad5960de625f7944e228ddc3dd50989083bc43e5b24b3cb27d1767953e19b3dca125c662afd536983b955a9ff2193c3ea8186e337320d83fc83eba94856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
b965fb7c2dbbe691481b1579a8c5c6ea

SHA1
9cafb8836c6695cb2b97457e2c6286491ff329ba

SHA256
6e694d7ac3d466edb18bf82f63159feee0dbed64914e4ecf27857a0c0fc365e2

SHA512
1ea37742744ee08d64411b29502765c15f5d09d7187f93aeaa4c204ca9eb1039fe4149111d70ea91593ab50b27aeff19bd775a96b2dbf52e43abad2aeadb4181

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
af5eb47e9bcd22961df3adca2394e8cc

SHA1
ac6535278794bbc689f41046cc27bec9df9b5b50

SHA256
2b4341761753617342a2a437a0e215acd758fbeefc65cb958e1718c7a64fd21f

SHA512
ce34d5281dc7beadfc2943dad982f55b313175cc4465a8ab271cc433c914c847d8a55d4e0b188d7d3be2216193eae59d77db8dfd9d9c7dfd0931f90788e04ec5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
343ab0dfb403eb4f486ec9fc029d5d77

SHA1
11dc7381a9c308e6e8a3841d42f13c0ac15048e8

SHA256
d4c501bf7ce2e527ae5998dfa63052965f80e5c255c24de336bd84b264e4d183

SHA512
40e9a4f64b54e81331e49d18eca62b6d56eeb5ea3371a9387c711da990fda7ee12fc1bfb38db2547ff27e9b3f177731eb4eca9362ca6b60f1b3b315ec228b87d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
d2060f76c0a69ae3c7a63a314847b382

SHA1
42dd8e606a8cec244569c5d2828269ec9a123cee

SHA256
e57dccaebbd89d22f7f84a5c6e702888be4fc9eaadf97730d8bf382d74ecc0c4

SHA512
f052d37243dade1a0d8826eda257cdf6232e226a2094295743d632a902a70b4b14f604f899c0b4c70486db467fa3f1e18070a69c8cfedbc2a2cc745c08a266bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
3d401cee5bbf9b9d6071d3191df5cc67

SHA1
1285191750105abecd03da055355c07ec7393e01

SHA256
8d5259dfa6c6430ae3b8a360f66d284178232f8536a2d122080726556de500ff

SHA512
bde1e8dfe2785737af6d24e7e84aa417f1cb03b926f66294334016940cbb3e9a44a2b7ddbff6eb8c4a648f08e9bb36743b9c571f9446278620b810963e557d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
a0d01a13489754e930a22964edc8e09a

SHA1
7b20c1bb4d483222c96f88b5bda419bc6af488e8

SHA256
b6f19a4b18dfacbabd9075a9f576e5ae3d5cd1ce68b28e0c8401d3d2ec7dbf46

SHA512
0f065ce12299ad0586d6c7ad4ce8582d43cf774935e134c15dd5162dc733f1cea2c83c5e3564f734d62789fb81bbc0e4d6d63a9ef068300d6d76fb0378600ef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
8c0947eef585afd47c096a56a2c726c4

SHA1
fdeecf47f257ed6e6530f30b3da515631d4166b3

SHA256
4aa3d497bf172ee6c8b537941fda8628bd69529977a1103d209d6a0948a5edf6

SHA512
e16a0bbbe94d0dce1aeaa781eeb091356ba28f357405e821140064db746b30630c37e59d9c0bce5f94da04dd32928f813d2c629a494c2c71e4d33dd40b6ff773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
7bfcdfc06318b08e982cc06e9fc452e4

SHA1
d84c21cb98ffdeb7f6d4fb95052fd59e22ea36db

SHA256
df7fde3ce8321b56cfeb1e8277a09d4b053909ac5892c676c3a16925acd25ebe

SHA512
98c40b321ab667015d142eef4a951727e9bbb6b377df48848cc2478048f2eaa90dea07a0495c6345df40731dc5b9159a0ed00d258cf34d88fc80d42f631b2f82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
87f19b7727a8d3fca5fcb28d4809e10b

SHA1
32b41fb0773fca0d9cc6d781b574e0be1ecf1e3d

SHA256
45f85530a0f1c16fec9df71cab8c2a898d7fa5dd846860535a71613c904fdda7

SHA512
4025b2db42ef30261ba14bd3958a740dd35aa591950eb134879ad0b7b769d5ff9137f7f56bf90ab95299bd472b31bd99050c8f1e19bdfc2cf0c013b88cad911e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe57c870.TMP

Filesize
392B

MD5
5336a2ab18214c61bb58a50d0dd65292

SHA1
cb7c2c144cef16691f529cac9a7787d95192fad5

SHA256
b084d585cf375b0489d70a15eee5fdcea0f6cf585296edcc2f6b3653e12a4de0

SHA512
bc7697febce154c26a20c0499afe0531d325d1c1e19c1da432ae7a9124481597433f40ba8f863bd21050d141708929e10ee172ec4a5e988ff6d08994f1ceea27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\Downloads\builder (1).exe:Zone.Identifier

Filesize
189B

MD5
1ac1d6dcd4617b4645dfcd625c3c006a

SHA1
016b6b095a9ff8fd45690da5808225cfcc5a607a

SHA256
e2ae195910d3d0b99161ee7e6dc476d981c6b31321a3c57c37ec1537e7423cb4

SHA512
eb8c360146bd15d9caaaed49b19ec10e63312c2b9794e9e1d93e0af13a621ef8f7333583fa22f282a1fe84eee3652b12efd467d6fe373620d034ee97edd561fa

Download Submit
C:\Users\Admin\Downloads\builder.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2376_1270896139\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2376_908208691\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2376_908208691\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit