hxxps://Google[.]com

Analysis

max time kernel
870s
max time network
865s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
27/03/2025, 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://Google.com

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1400_353020115\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1400_506545882\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1400_506545882\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1400_506545882\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1400_1285917747\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1400_1285917747\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1400_567832502\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1400_353020115\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1400_1619880019\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1400_1619880019\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1400_1619880019\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1400_567832502\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1400_353020115\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1400_1619880019\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1400_1619880019\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1400_506545882\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1400_567832502\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133875577608664943"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2543098825-609255811-1615676193-1000\{2BB4A19F-795A-43CC-AB24-6AD0C9FC3617}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2820	msedge.exe
2820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 4660	1400	msedge.exe	81
PID 1400 wrote to memory of 4660	1400	msedge.exe	81
PID 1400 wrote to memory of 2364	1400	msedge.exe	82
PID 1400 wrote to memory of 2364	1400	msedge.exe	82
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 440	1400	msedge.exe	84
PID 1400 wrote to memory of 1308	1400	msedge.exe	83
PID 1400 wrote to memory of 1308	1400	msedge.exe	83
PID 1400 wrote to memory of 1308	1400	msedge.exe	83
PID 1400 wrote to memory of 1308	1400	msedge.exe	83
PID 1400 wrote to memory of 1308	1400	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://Google.com
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x28c,0x7ffc6606f208,0x7ffc6606f214,0x7ffc6606f220
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1908,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2240,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2408,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3400,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3412,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4184,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4248,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5096,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5060,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5892,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5892,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6208,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6216,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6504,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3904,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6612,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6156,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6856,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7024,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7032,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7036,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7496,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4872,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6592,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6400,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5360,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=136 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6076,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5556,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5208,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7076,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5456,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3932,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3568,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5512,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5716,i,9075139549602833143,7085101438067013547,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
6aa28abb11c6e4f6a4bf0c6f601bab1f

SHA1
09c6f71523f378a89cd45df5d9a450c5bc2b2d5d

SHA256
11cbeeedba673fe8c5bedfd6b972011802b71e99250b9676546b1a5a62ddf9d0

SHA512
ece20eb2ce64131c1d2b40610fce890dde6c0e9d8b20eb3983b60264e9a4597dec93a505efd15b3a48f4bdc3debe0a8b8c3ffdaf553d8d42e8728d5a650e51b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
3eebe35f04a1430ce4b55422d85eeeab

SHA1
fd6ba78e069f1b73464e5c4a6385a12c61c9a393

SHA256
ae9748c89efab3e1155e282ceca67498fd7cc40217d3b7f1c913d594d7915ceb

SHA512
4432535a1629d9b3a59b583b54f3300b2dfe42699572420064cee40f7b4dba6aba59fe1edb17eafe2f53ce769500a8b3184df9bf319f071867f8fb064c028b97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log

Filesize
1.1MB

MD5
c1d8eb5c8379fc3ab824d427e202c6a7

SHA1
789c9ad8708a987553e85814c958b515f399e8b0

SHA256
3fd2037226df287a5435d3d002e533efe035a43e092e1d7df27893279e0904f0

SHA512
7f64e9642c2a2f2cf1b7108932c895387e675053982822a8ed685e3dccfb01ec85ec0f11217b360498109b5d5080a1b397325a5092e5ff7b4bee3e1214211bef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
7KB

MD5
98a2c0cd9d3ccb451883a0372154f131

SHA1
eb888803bf7a2d07656c4e36dffcd1488aa9e7a7

SHA256
9ed83b95f370c4a0a9e1a0d4436383a5e5911a5f9419e4772c49c3b770f33615

SHA512
19d490904efe003ed049954fcc45151526d31ee8c0dfd595bbd9d9f3c15b9998730c848abda4be6d776c6aa3dabe1cab5fcc5cc9c90e56cd090d4b4e62c87f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
334B

MD5
c8477007bd3f43ccac9bbbd5680a2d29

SHA1
012b9d7535974e608b74a74575087296d944e918

SHA256
301c24012fff4715512fa6f4a431bbd95100a4956412ab4a111477b0428cb818

SHA512
d88d0cdd346f87516de491d2bb8c4c3692c7b1b0526581682ee0dfcd4f1e33b7a2a000bc8f528170adb84e7e91496d59862e072d6396941559f9bad7595cedd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Filesize
158B

MD5
73e3618355bfdcaf041280a964caa638

SHA1
51962c05d79150c43f6ca8a9af4ca080b11e4ba0

SHA256
1029c80591e790dd3ac2f558103210c1327531c1bc4bcf7ed370ceedb44122ad

SHA512
7d0925c5b4692baa7463f42849225ebf18be66d3c580ae8addab33cdeb37def9f0e7d348e26f2856a873f6404131afa30869a8dd316d00cd7ed05eb62a310bb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b8c15626bf7223f00083ef74ca2b553e

SHA1
192ba77a9b6257b1ac01ee226334dec1309767a3

SHA256
511a3528d965ca392e76f36cc879aa4c0bfc949109d9a6cc319f7b323dab6486

SHA512
c756899e0ad749e816bacaf6d134c0521104f6ac08c203eefbb388bc95e7953db713e5868192973c0792af9483a7129b76076bdf5b79ddcac1d546751a34c580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe581e22.TMP

Filesize
3KB

MD5
2ef1554fcbaedbb2a0328a90f4c86fa9

SHA1
d38f48fe92ff4b904f3d201afee1becce180ac80

SHA256
39ac42e49b405de183dae8f9ff66090b7a60e89a87fdbdf24db288deb2fb4996

SHA512
49eb760de92898e1b08a222707e009aa2f51cb04022109c2f38c25eda7897da5c6611c6eaa00a5633ff4036dcc335a41d9bdb4940e35856d8bad5543e14c982c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
d3e6bfbb6816c1bd98a91a5123823cd0

SHA1
558605766db677a1be6f33e8729f5b6227c0f289

SHA256
29a221fe68b5382371e4137f910c9f2810ee26c9ab17aefb59a84a4e43e6b810

SHA512
e3417fc6d82fa1ff9ce912dbba17b356462f3abf3fef5d8620dfa4f6c8a17303534622369c4384658c294a4a3876d30ad4d013fd965302a3f5563cf40459734e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
e93e049c63def36b6cf7c32e7a6008e2

SHA1
be681a21c625384ce36720b842f065434c538e91

SHA256
819d3581e0e285e45f1f6a0f4ea54810bc69b4a15ec6f5803ceff38ae61e3bf6

SHA512
d45e7efac91974058243ff659f57bd3b46336bc1e64deb2236c167ff7bc07f56c11983a0bd743ee341d783590f8f0b46f01bb05368b7c27c846b41536c2f8f63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
05a3a8bea53c1c308e91a53f5c2dcea5

SHA1
9cce10410e2a758493dd13ff4c05bccf06150c76

SHA256
8d94d43b2a844dc3e17937ff8ba0a0df4328d35f5ca1200ab9a62f6cd8bba6af

SHA512
32a955bfba215f23a90a642496838bd1d43d2f41515900a64f6734daabe3524ce746e2ac89fdc9a51d9f32688ace9f608ea11cf9508266a2084fbcce9f49a51e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
9ccec4693d3a899547abecba15b1e9be

SHA1
322287979ef661dc53715bf3ab885ca4118c3f3e

SHA256
e7cb0d6fd8d4aa09c8141cc6256abf5ccbd91151b67cfba584e02b052fc9a5d9

SHA512
4a8d267ac2d04d27db029a0dca712884d91b35e8afc1b8b938e5141917eb9ec37e3fc23c95357f3072c401a15e8b124acfca26325cb462af7ff7a427b2154654

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
ccda3948875065a5fbfd978e6fd3b93a

SHA1
beeca150223eb9313f1fe572e00f564f90056a26

SHA256
fe9411e208d3fc65d0692501d1e8e73c4e05bb9cb247b15247007a0c53aff050

SHA512
7c89b407986c1c889ff9ccefcee06385e640125be2c706956bb4a8edac7cd591c735f919371d13669e6f55c7e848e691ce38c03f83f35ec52ca7013531598ec2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
42441141a0aebff4f67afc64143c04af

SHA1
ea64bd8d5ff9d1ba205f3067754f223cd2125577

SHA256
9531b1abccdbdfb7eb4236d04ade2b57770fa05661a1693c677cee05c882e738

SHA512
19021ff88f8511d76eb561cce06783e9c73ecccca02ccc1e583399d6570cfa7d1cb7be9dfa1479ad9d4b060335018dcf796cdab2f244594a8b2e3ad1e77f8f6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
30KB

MD5
3a71ee14c4edcfbc3266edf0992dbcda

SHA1
5e92d349cf9a38dea3929e44dd1da297f99a3967

SHA256
4dc9347ae234770f40b7615a13f50de71d79800259e497820b9d325a8f5ba2c9

SHA512
5e56654a0da17bcc5400519d0f3491ffb1f5d09d02f2c36c698fce405b0c1e576a6b72858627ff4aeb7ba3b505866c83987ec6ecd88c5e3335f6e29bbbee7e18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c21ea8d-1c7d-4dca-810a-15b868c9100b\index-dir\temp-index

Filesize
744B

MD5
fd9e5137219e0b0000080c5af7707de7

SHA1
5d1ce4f74eb40813f42a07f0407f5e91145f4d15

SHA256
eecf97b5e2d0c17348281edb0ff4327d5d485a11b65d0c5c04bf88beb4cb54bd

SHA512
04e1062d3a2f7b1c63c6ac8fa60e9fadd240ff0362e0ed4c8d0b72f40d56d41bae2afc285e90e680badc4695fe1d2f00e0b84cdc2ed426ac291de8ee4296778e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c21ea8d-1c7d-4dca-810a-15b868c9100b\index-dir\the-real-index~RFe5c502b.TMP

Filesize
744B

MD5
4fbed7fca22512707441d0a06413d163

SHA1
78df19008cc6cd58e1e509b9cee12c603453fe7b

SHA256
6cfa850d24e15b6da1efde509efc3cbd619bd9ee396875fb16ac0394f09d2298

SHA512
3c055ba1863966b495103ea0edab299ca9be4d8bf1a3211537c5e9ccd25adbf5cc5e3a47d5cbe1bef64036ef5dacf3a56bebb765dd87e0521f648c9506a8ae30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
90f99f23b35333a814cb2d19a83ba3ad

SHA1
a9df55373cae3b18cf4f4976dede606b39797fc8

SHA256
3708eade8c27e1e48b76c3a264a43ea6a2c23338084e98bde0fe748ae79e7be7

SHA512
00f3c56c78b444341a77347da1644778062df4536f2b05f6d8b3866303ab33eba30ebf837098dd4929a373bffba3096e4cd996072fb994aa812d09374b4ae200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
db366e564bbf91aed461a0c705068d64

SHA1
35a10e3bb08ecd856945165c0815eee4b7c8a693

SHA256
1792f86905e1a052439af2ec133b83b2456767abe7f3b586a6377cf8adfc95cc

SHA512
adce9b1dae5014fe147ce41c9cb05935c877a945a3ab6ce19bd6cee026da944ca3be85b900db8832d756b27152545ee51622d8b0595c8d5e7fe988d0e4943082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
aca26b651a6bd94927f252d8e3046861

SHA1
0a0047f60b934fbd1c9f2865ddda9afd5ace8236

SHA256
8bc391947a5771f65f2319d4171a3002b707600e355f84428f85f7071cb33e5e

SHA512
6e337dc3086d87868f3a6d20e3771e45833d5fa7627672e29ec723e41fb2fc79e55924d386ac5ea6de8b60baf031f7736d7717e6fa99c5e28ce4c80a9abd24e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
876B

MD5
036fa1f6f8722aaa361676a3ceb82f53

SHA1
4904d693cc4a973eddd505da14afb90c77522ca1

SHA256
507babfba120e75d6f835be4c667aab19bf9e080bac11e96e676ae3423a7cf2e

SHA512
c5a3b93f30fa0f7ecddd83ced9fecc2d90b4e9cf73e914745e983ea7400689064826449e4730ecd8e097c70c406df5ba76d3b7a6c868f0cf42301ef5bd8b4205

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe587644.TMP

Filesize
467B

MD5
0b72cf6d3b830482a76fe8bfb5f0a22c

SHA1
555f8461ff02c150c5201a0e5c0194c733759053

SHA256
b16e9a500115ff5ccafb04dc6ecabb84b235df8bc962a06170acae34ac25d0f5

SHA512
f98b663192411721ce7ff0e703d591678b9aff734267a48841e54169a576dc868c945e5436f26054ec27929ae2e9153d9742e10c6c0129403dab61e2306533d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
06592b86d8ab6309c77426804f7b590e

SHA1
d63f876ab8d1dcbd92e052769cbf13f9a983534f

SHA256
43920eeafa84fd526a2e7c9bbe5de63b5306fdc17595bbc4e8ad1370f53d225d

SHA512
f2e4e7e937cdb486fa9d524b46d3a97a02624e4f612325da590fbc46ad337e063b771c8370cd389e581f1b16450c410850bf1979a46a118ded4a491fddb56ffa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe587a0d.TMP

Filesize
3KB

MD5
c7569efb2fa9fe93c0ea2f0896f54036

SHA1
e231c700b778b624f6065b035e5803fdd8b4db4b

SHA256
2422f055fd21adce7a027c3eaab1bbc474345a26cb1b9762b3d7572ebde67d3f

SHA512
c394da9a75cca87f6e20cb2abbc2e087d3e374b613bbc960f255ebfc8f01d4349fc8a487ec56ff8141f47566cf021dc33196e42b6295ce5399ff78e5ce4b066f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7a04be110367da5264d9e8e20f9c701c

SHA1
fbf8f03c98e0018133039b72f57361e950ad08f9

SHA256
d27483c6d8c15ae12ab9d7393c4c612a156a01afc2d5cca98b272f258aaa21ed

SHA512
f8ad6b31a2afc92fb6aaf715617a5043a64cc827a264b973017ee3b004a09b18f7589fb983058b1250eb151b4190a9fdc9dfa6ccdc9ed8ca47a4831021d6041a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
4f8b95dba7782fecc47f682b27be1c5c

SHA1
7ccbbc9ac55a0ac24a4793e916c62678c1a3073e

SHA256
8f9f6267fa6ba6a7cf1ae3ca209e4389e39c95eee35256379ec8b91893b7c553

SHA512
fcd210564ec98bd8abb94a0027f0bc6ef0494e33707d0563e944ef525f7f55fbef9cb579bc1079418961f274da2f7336d1778f83add59993a488582c1b00da1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
94bf31cf3b5f99189689d44030d6e366

SHA1
24e4af098be58038c43093f07f065ff8303142b0

SHA256
ef903e100b4483335cc0f7f8baa05daed8f31d38bce9361fdd57ae4174dec2a7

SHA512
59eea65fddc17409739ce13fa3ba2ada92f5f3cf64598618533899265238c93351d2bec72ccdcf5175bb2436325c80cdd79d8d694f409d7d09f916eb55114e3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
b1333a8003cacfb23a3d2535d86ff9b0

SHA1
d23c09fd6343e0e655bce30310a683adc2b785be

SHA256
b2d320b6972dad7b27eb4d5075c30c3c4fa23b21197f98a6f6aa8979f77c65b8

SHA512
08d15d91d3e7c916d094c2abe9f482e77aba0aa6c468420369f37a41230ffdfec17f9ae97d0ee68fb29bdb4d9ce30b79717104556d1c0d1a63d9de8d4c366012

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
3417295c0f271fd69aaff9231ff9a588

SHA1
bb01a40da6f2ed2a44d308ec5810d0e8fcbcd416

SHA256
266868ecd2356293109ad5923b049cc76ebe49e6506de1b9dc5a0dabb16159f7

SHA512
b992091adad72b68b23224556a12e69e7111531fb1261ddec24d5afefa54e64d944b29d6df5162c7a80d1b77fb90503497c1415b71b1cd1b54516258fab86180

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
16aea6bec66df28d344b99a0243757e8

SHA1
5b06258ee4937cb6da01d1f9e592bca02348fa82

SHA256
6a3fcbefde8ccd7810a8afab50e78366422551717b316ae7503d6dda22acfe58

SHA512
071580bb3bf6feced0846cbda6380daf8c0d5e3cca9a2598a81061333f0a19586f5d4b70062c6d8039770cf1b5cbf4bd1b415b3441180b0373cb03939fcaa2b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\32d75f90-507e-4cd9-ba2c-cef90ebba629.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit