hxxps://affiliation-sncf-connect[.]com/

Analysis

max time kernel
145s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20250313-fr
resource tags

arch:x64arch:x86image:win11-20250313-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
27/03/2025, 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://affiliation-sncf-connect.com/

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1568176916\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1767496541\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\sk\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1568176916\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1790091087\_locales\zh_HK\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133875634665250257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3712238951-2226310826-298817577-1000\{4F7FE292-F29D-4E16-BCEE-16D4A1915927}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3712238951-2226310826-298817577-1000\{B418264E-5683-4566-92CB-8409A1D872CD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 5400	5024	msedge.exe	80
PID 5024 wrote to memory of 5400	5024	msedge.exe	80
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4528	5024	msedge.exe	82
PID 5024 wrote to memory of 4528	5024	msedge.exe	82
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 4884	5024	msedge.exe	81
PID 5024 wrote to memory of 5000	5024	msedge.exe	84
PID 5024 wrote to memory of 5000	5024	msedge.exe	84
PID 5024 wrote to memory of 5000	5024	msedge.exe	84
PID 5024 wrote to memory of 5000	5024	msedge.exe	84
PID 5024 wrote to memory of 5000	5024	msedge.exe	84
PID 5024 wrote to memory of 5000	5024	msedge.exe	84
PID 5024 wrote to memory of 5000	5024	msedge.exe	84
PID 5024 wrote to memory of 5000	5024	msedge.exe	84
PID 5024 wrote to memory of 5000	5024	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://affiliation-sncf-connect.com/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x268,0x7ff8838cf208,0x7ff8838cf214,0x7ff8838cf220
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2168,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1852,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2528,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:13
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3412,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3420,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5008,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5012,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5636,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5976,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=fr --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6096,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1104
    3⤵
    PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5976,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6068,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:14
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4920,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=4140,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6504,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=5580,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6388,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5520,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6852,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6816,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6780,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6800,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6796,i,6119717528077521842,12745735055513204023,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x268,0x7ff8838cf208,0x7ff8838cf214,0x7ff8838cf220
    3⤵
    PID:3268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1788,i,155227921762818610,8530695030072727491,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:11
    3⤵
    PID:1948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2460,i,155227921762818610,8530695030072727491,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
    3⤵
    PID:1292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2272,i,155227921762818610,8530695030072727491,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:13
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4392,i,155227921762818610,8530695030072727491,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
    3⤵
    PID:3540
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4392,i,155227921762818610,8530695030072727491,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4532,i,155227921762818610,8530695030072727491,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:14
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,155227921762818610,8530695030072727491,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:14
    3⤵
    PID:5216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4592,i,155227921762818610,8530695030072727491,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:14
    3⤵
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4656,i,155227921762818610,8530695030072727491,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
    3⤵
    PID:3448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4120,i,155227921762818610,8530695030072727491,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4644,i,155227921762818610,8530695030072727491,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
    3⤵
    PID:5140

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:5728

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
f93b1e694731653f938947238cf842b7

SHA1
5ff83a49726b2475613be965344966107fa223a2

SHA256
f3cbf1fea1fb4e5a27b02d8339e00a41f898c30527961b864bf47151ad369ff1

SHA512
fa9cb8736c8c2bdeb229e371ee8dc2a706ac3d9fe92983bbfb3c12d30008baeee49a6268cf88d409ee353e33b030c2e67594aaa9f5d75f0a19ff093ffa9923ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
c9518eb24933c134e45d45cd7a4e8f8e

SHA1
8474a05279e3e34e908e5606c12c2d39791f002d

SHA256
d4fcf8544fbbe2acc48356c9260aa0b6497e7b02d3ac0e805bb7e2d99fb7b815

SHA512
6fd4f95020ee490ea3cc0ba09ead374f66286ba4727bfdfd70b32eb11d1a8c22d00788489be9b5690f687b212f45d2ae7679628cf13f8f7e97a701c5a5b1152d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
49576ba2e99b7e6397070412f069caec

SHA1
36c78b5becdc859fafd0c5204ca21c11132e52dc

SHA256
42f7f3b89461ffea585c4945f43620f7482d698b9a43634708394437854e9f4e

SHA512
3b30047c018554acd3dd707a55ed3731483e97f994db5fa22dfc466a77b351f10eb19c2ae2f31b7ec15b003abe43667844efcb27e01f0d97ca811b7952d02a98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
34808c907f485046955e00cd912e3dd5

SHA1
2b2eedfe02961af1115e95d4ff6f45d5b2fb4c30

SHA256
ad91704e782f326bda055e448ac64b8c0c1196bd3da299868dce7f3badd36168

SHA512
5a3e275719deac88d7a58834617028228b58d0e0010c9537e0a2669f452d1c02902ffe943893cd6a4d91ae0c5e09f2bd81e378c51a3badaa6681551e78b57235

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
200c1900cae89cd9c50fd5487da04770

SHA1
2e39e7e554a75cdaa8cf81ef58c65a50924ed2f4

SHA256
7280987d8f867578cac8e899e070d55d72dad9e1af9f15690f1f26b305f86ebf

SHA512
618ae6c86d2e32ec195e79b8b541072ee223fbd357b481fe5ac90e670055fc5fa74239e95b4cd712e0040e70d6cf62196df6072cb96cd59f1d7ffa3f89c3da26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
8e13c32ae999b02720f4ab292e4197e7

SHA1
1c939fab9fbe82f46611c58ade8c5c085bbc1ace

SHA256
11270c3094ff81afb980b1b097a5d88b7c3e5d5e7e963560dcfe92c597c59d23

SHA512
e8f5b25bef3762bf0e7a68c504a6809bfa5f890286567053e0124b82cc7adad3af9a67ed5839fd44413bf1bf361074d81b93dd99b5669941611d8c4f0c22537b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
8.0MB

MD5
ce6bdf84cfe5acf6e9f8ff059a987ed6

SHA1
a0bb3ba789f82e6d0fc191bbf3f5e91cbe445260

SHA256
68f72bba14d0e0252ad7668a0c0f28a5bdb21132316ba64af1fa99935824bf77

SHA512
7b1acc975fd007b18cf400788d93b3f5bfc4b39e4bcadfbea378fc009bbb1af20b6efde650638fb1096a6cadbbec20ebe062b6dc9d597b696bc20c7fa735b001

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076

Filesize
19KB

MD5
5e5ae2374ea57ea153558afd1c2c1372

SHA1
c1bef73c5b67c8866a607e3b8912ffa532d85ccc

SHA256
1ef458d087e95119808d5e5fecbc9604d7805ea4da98170e2c995e967da308f3

SHA512
46059e4a334e0a5295ebcef8401eb94b8fa0971b200f0f9e788ed61edae5018c917efd30b01631cbd6bdadc5240c9fcad2966ea0aa9c94b538bcc369e10bbbaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077

Filesize
86KB

MD5
47f34ed7467bcbb4aaddd4e9824e971c

SHA1
a43e818fe65b8cc77b0a59fc1b9806036a6b83ab

SHA256
b71b790fb923a4ea8b8445dce67df975df29ee1da46ba5f5ba38980448db72ee

SHA512
de903938bef7790bad75a0dd83f958783876868f92ba3282df3ab167a4a7c2e76f86f438724eb891af5f5e0783fcf18eeaa642ccb4ff84f5adef96cffbc53603

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078

Filesize
801KB

MD5
903ce94e826b960978f14c5ddbd5efdc

SHA1
053e974ae64a0ecc1b6f86030e4e7e04498a14a2

SHA256
f74bbbab1b7a633160006e149ab9dc5c9e3014bb576a79eb33ec1464a1072449

SHA512
824a5458db2c1a885cb1095f2ba741f618dc97a735677ea24fa414dcae740bb885dd285ac339dcf50d2c6507bb069b582f79d0442c0ca97379d23fcd541bee6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e3cd6b103b54b212564dd76db15362a0

SHA1
80c90e2a4d7a84037ca7b1fdabac49db129f7998

SHA256
442ca6e0f76291fa08a145c51ba378add27a6cbc1b9fe13a3b12c4fe425b7003

SHA512
ecb473b8a0a41d44ac4acc0f3963f6a0dfee8002d60dd446e0b211ad19e63f2a56e3672b664b415be911807c3138ed477f83a0062d5566cd16cc95a7ad2f9603

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5861a3.TMP

Filesize
2KB

MD5
4313132b270ff08e5b9aba0eb2753b83

SHA1
8037dc4483697edc7223b625997c5157a474097e

SHA256
558499639c96f6e47c7905b8ee3500480c093b2377ea78d6291d09610fde33e0

SHA512
1c7dc376cff0d5b6bc88fd48f38240245ea4695800018726142a86205a7297128cf82591f2f8367c9bfc1a3a9a1a278a8720f5ca8615569e0d7fcd7bf914c664

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1

Filesize
264KB

MD5
a20e864c163af4d4335f953ec1ffa6ba

SHA1
2a29e416e106d8800581f3d5d4f6f24d75f59cb7

SHA256
55a8ff076c632a44fa5a088607d753f954751f68511b51ecf1857ae483ae8588

SHA512
a753b4161157afe3adde8419be6c9d3dabd76a4ee9538c1949391c75cc65b697feb7b03fe5ec077091a4f23d8e82c3543ed399d1d4d68aa487cf34c9f6d904da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Filesize
570B

MD5
d4ba0ae0bb0b9faff3da6f35fdbc3c8a

SHA1
fb3e9dec7f35a9b1d94e54a5659dd0de484055e7

SHA256
99def1b557f19f04c1affc6f247d0451f33fc10ec42e73792223c3215ac98be6

SHA512
86fd07c34b9abd4c52ba19eae291936f92bc6d38a75c021edc1dedbc15617669876180cd99f959c62476d82ec6bb9f5fe4c6cb4d82cb037efb76d99a4d3d9c51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
a6b5d9c18781458cf4df49304ba039e1

SHA1
0a837f3943db7677e45becd8ae1233c2feebe4f6

SHA256
4bbbed471286de87f9a08d687e302838a06850b20f0ca54bcf2e2cb04d3fe1e5

SHA512
67ec9a3c966da712b6f4563e911903c702b96609ef0a1f6e618d262dd58de0ffd41ef71ff98e797e8900252ecb55ecd50a71ec4307030da504d58e213ba41d36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\_metadata\computed_hashes.json

Filesize
137KB

MD5
ac2ddefbff0bfa96528175820a0a3f87

SHA1
5db17afb39487c6ef6a650bf8aed169157415eed

SHA256
7af5d74143863508f0bc36997fc448a9b60a8831bc10c0fa82290bc7522d1a82

SHA512
5275edc546de2d10abbe924a08713c447e206f3c20d0d9ef8bb0408decbcf1b6a40b26097ca9f815f72c3ba651744a561468c0b31e34f3e9913e53e90ee33883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\_metadata\verified_contents.json

Filesize
2KB

MD5
c7182c4ef7a2cd6a57e48d44bfd4af9b

SHA1
2e1e4746da948d83baf4bcebee618784f8ab209c

SHA256
6f64306515428487987fabde07ddf1646f64ad4e3dc4841e982d40ad91459822

SHA512
d8af16336b66e4f264eda4ea68de4c1763a9c9b99635184d9ece67a9ed69a09bc1088bed254b3d2a8877ba3218e043065d1e4a06c20f18b58d312d93fb84bc83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
9c5ee548fffb3b58525962fdd3165c51

SHA1
6c6055821df43cfe85d8a888b12cda917ed79fec

SHA256
65cd3cf93d9143bded6ad2d6f5cb75c5a10b734c5266e175153c0cef1787a3eb

SHA512
b1163ee8b1487d3608d0f1d43358e7ad5442f9004435da563461acfd1e9e4bfbb1689e4e8c1b912aea256b95d558ee215354b0852317bdf2dcde02e97a9f5aa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
108KB

MD5
39a9e3091dcde72f36f2f3b6e6315948

SHA1
9ea65e854cde449fb944c26f930f5244e60b3ce9

SHA256
e07d8dea5c1f81a2e0964531111777e1d0c7cdf97d007f98926c61bc849ef24a

SHA512
908c1d035c43b4be8f1e733da0dfb648b4c6db1082ca69793b3cdbff253586d57221bfa86d7357791f32bada6e79327ecd21381078b238b5a97b1fada21ba618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\devtools_devtools_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
718B

MD5
660e204be0ef700f6fbec6050d47a6ce

SHA1
9d4242fdc1a5c32fd5a06c282b56de59c95fe8dc

SHA256
ba01580bbf53cb2a7f4d2dd785197e65ce9c518ef97cef3901bd8eabab8a13e9

SHA512
cb763d40f9c3f1ef63918d83da232ce3ee5d068bce8dc93e6e6d2a0f28d64ae3fb13a8f3f893cbc2414cf1fc20315514844dcf56b3e4c184bb2bda24723fa82c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
f0e6a74b1f30c8ed183e561f7e020f3b

SHA1
4e1ace3f6dc5646fc2cf3b7a66fbc6a7bd28e715

SHA256
5a249d2a12191887420ac9b12123328b36f3bdce8d3b4d08c93b6fa5f5d0102c

SHA512
e210320c6acd6e10f22d2819eb76a96bc4f670915e3bb45c38928644f0f89409da09a1d9d788d3537fbcba313c0fe04ac8df77d92be3c605c30c358dad9f025c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Filesize
20KB

MD5
8fbac8e9f0350495642a1f724afdf7bc

SHA1
fa3ef8304c9bb2bff39c9d8c7589e5bd4cca4ad9

SHA256
06694cb5318c17dd19d6c4a91a89ee967d39efaa4ef06e681bbd786164d95309

SHA512
0704ba682fdae87d789d4abd2718de7884502669abfb042ca390925965eefff777502362ffffcd84f5028eb00c2f0aa15e5bcbb7d7967b2f951696259973ca02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
3294751bc2f0f7956d2ff1233b6e6a0e

SHA1
965e39d4ed79179a00761d59cff8dca1105de4a6

SHA256
14fc8aa389ac90069fb248f4a46f0c4bdf8aa3241b700fe50bda084933e7b144

SHA512
c6e50b8c9baf1edee058ae3289d547922b4fb63879b5be903bc8b9954a22539514e77c117e527709884b19dbeef84e11175e24ac6077c1a7dfea7a0907a466d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
9a0174f047f41274b48e9c2a995b2888

SHA1
d3ac2a211ffb4ee5e010ba3fcbcd583cb89d338b

SHA256
6de3af6b54061c202cb3458f84c02b8c663cc9f4ce8979cfe0ad4de6eb81ea6d

SHA512
a9e3eb657692277f24118715f41b2536c7dd9724f9e11baadf49b51d32d06e7063f63503bad09edbf19a1b1ad3a56eaf34c228678f0b582d057b3c81f93bac95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Filesize
36KB

MD5
076896b0937ae17d9bdbffee21dc5423

SHA1
d7db125b4eb5bffb6b29e16901b9260f0a298a53

SHA256
336fa649c415def63ad1b5ee423d796ceb13833d5059c2c9ac715fa469c4567d

SHA512
126afe83dd8f84fadcc20a2d816a0334df8b54b6c8461b1f54f7ee62b6e2e0fcfb8b5f15ecbbf33d6616db10398b3b2a54510ed2ffcd84714f97730395e8e4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
27KB

MD5
e6a1d2acb1c3167b321c967cb2683b82

SHA1
e9c5cd902118bbb16dddf79f311aeb1eb4da320c

SHA256
c948eb721d21026be216936ae95a750e06838d172ef39e793cbfc420ea5664b4

SHA512
7ac82318ecfd8f00e715ccc41a7687e0df71eee1ba06cc1093a17e1fa107059a75aad9d5131faa43eafeaade31ea10a97a34843d3df58334e817ee41bed49a5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
28KB

MD5
3103d7771468c1400beaabaf8c15cdd8

SHA1
b9f43d9176039e3bf72f517cee9b189e0a21430d

SHA256
95729343fce23fcf7e165890636b9b0d40738faa513fa0c28f8fc219447f2ad6

SHA512
a6a457a783002ef4dcb6b9d2b01cebcc8cdab78476ee5a194aae59a46615c5ca483aca1ca1d5ad461bead5f07fa13d16a09b46dc2798c93226cb3fb748f375b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
5644649adb6609e4aeb2cde080387a59

SHA1
23079ed69ea014ff8948317c11fbe422709a39dd

SHA256
d36f723c3960deede13d90e3f838772edeabc4f9138da2c6abaca2e43b81c24d

SHA512
3910d448a8f09e381deb7f358bd9418805e566e8bfd3ad1981c7991e1e7429b5c1e860935283042d11c174ffd7e5e9e99d889944a3a0910e5b6c4dca2d7d7632

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
38KB

MD5
1d58e70834d123e4b8298fb218f45291

SHA1
5c74815876ddeae28f3db127286990c17cb3d15d

SHA256
55acaa33791f61d5e67e5873fb28aaae1f8aaf4fa56ec70471114f647fc7883b

SHA512
e79495c887d2e1869ff99979f2abf9dfe90d6b3fb2c1eb641086b161a2e073a2d80cf804ff7a29ac3ce24a381a4aa03709cc216406a3848cd6d48a5d305a7cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
ec6cf2c88e76bf8dd800e557d5382e48

SHA1
5ac316c66142872ccaa10f4d337416ca340dd4c0

SHA256
1088ef3058097ecf7c83b4a25c11f22a61e5fcb6fc1c4731485727dbaf2dba94

SHA512
2ff7c82383bd539f9c42c291de6fd208d896f2213d3a0d8e2d4a6f1ee8ab7050991cac96b7144a1c1a198b9d3b747b59461a285e8d2eaa70e116501f1d2a8f91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Filesize
335B

MD5
4902e9ab0ca77a343145679f756d7f80

SHA1
f5644d014ed538842008a1b6221c31172dadb7a7

SHA256
c308675425640e8464d371b78d36e42ed24e78b594577b9b9884c71e1c485854

SHA512
18d089ad9432a1e17bc49799387face410e7f0f579cfffad6e64f9b273b8e3721eb5c4c6914954f3b2ad202055f65ea43c13f9551f02829fac87d75d1ffd4987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
c9918d873d9cfd2be366c0f9852a80ba

SHA1
ffc95995d6a1b6343d29e541060b9ac1f44b60bf

SHA256
b0961185dd092157478d71fef83d2f13f4657ef3d6ee72e83e8569911b6113ea

SHA512
c2b85f87cea72deb3469427db4d3e7259c87ad03bac8a383eed43a39b8c1c2c0749aa512a45309cdb0cec61d15ba8343e23bb1bba7b95034eaf44494387cc3b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
b344a06ee6b31ee98b49ded5e71f4087

SHA1
455c3589094a850a19304aeb969df59d0fdbc5c9

SHA256
b8caa1ae27e5bacf5c13b122da157c124d3414913136e31b9fcb42f875eb1e5c

SHA512
1c33630306cd59baf3ad8b77d52e024bd31500fc0cff57964ff128371fe5a6ec43166cb591720850852b13618fd45e240c538771c4f38c851a33aeddb1f5bb69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
f20592f7c354b5e19cacdfc468250aa0

SHA1
c8f3cd1e65eef8c276acec631dd078c1b9e2f7f3

SHA256
758a7160f24148bd60145ac1b871d6d5a2e2d2c44a9eb1aea8ae6c9c67ae7a2b

SHA512
861e73ad67ccfbfb276b54321766cc5e57a9fd05d9167938200b6001f1b2dbe666aab0127858222f08d5f43b30b81dc1de8d1fc6800aacd0f1cf04f99c6c231a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
24KB

MD5
11bccf86f73b60ce644283f44828eb74

SHA1
26d9d1c4bb91c66eb0a5887050d150c9683a2c63

SHA256
75ff5e5533fb4195ade122f3eb9382949de29aa5ea78c05ccb503b40d336ba57

SHA512
b85a9cbecd9cff5afcc847f2e16add9bb01132fbbebf9f3b36a2a08888ca8ebd1dfc084c8913509077aaa7de9d346a71d684f6654fbb1bc03ffc278ddfc3fcdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
efd25e3361b35ade2c01bc7776f163c0

SHA1
ad21eb903485f489137d9e17016d51e9b79ab3c5

SHA256
33ba0488423b7ef4d29ee2e56975773a8374afe46a4f312952001af7de21dc75

SHA512
52ecff0575c5b1efa9db8959540a94370237576ac7221f0ba9e6044b9288cad3eaf115bd34ff38a9855503f15015188851fe81ebbd8e4e0db6321aa6c6a4fbf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json

Filesize
12KB

MD5
18261eb12378081f939fb9415ca0c9e1

SHA1
20d4ff782e17fe45e71c3f9fc60a94655f72ec7c

SHA256
12bbeec9a0af9e3ed945b28b9b8ef89b2f897768d1ba3ffd6f3fbb42fa5bc556

SHA512
fef634b4ce77c2f36ce1bdd63e8ac28e76cd089f0bff33f4425c757ddf37fe9fab30dea7b5bb51c91eb27012cf78800e03643e13d51a25bf624ce58ab3488a80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
10KB

MD5
70460dc1f07aaa8378e2a3ca0737afc3

SHA1
91244b3d49403125a3d2fcc54cc9e9a67af507bb

SHA256
0b9af1c549440cd5aa982d421d6944673e4e601bf656b9eeb64cb03704793029

SHA512
6813ec6b226353325271028d36f45408d3c066157e99d27e8510663f1b189c92879617e16dfe90f4da79a1d1aca1b0a167ec153eecd82172c848354fd653795c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
cdc1d9dd1680efab7c2a8fe9a1e3e8d4

SHA1
404aa0fc66cfcfcae0dd636e7770cc460c253696

SHA256
c7435f2638bf98d1d7b21e095a4eaead1c1d4a18fdac2daddc77fabdba13d134

SHA512
5013cd1756a9b9a19f62a02928189b1f645f00060e0f13c06ed4d46f1de64daaf8df883ee0fa35733d787e92ce84a8cddee7003b6a58e8d61213ce625a1cabaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
1KB

MD5
62c379da6c2bda01f76fe130302b0c46

SHA1
8a843da22a4cca024a206fabf5b0f6d9f98d815c

SHA256
1a9d7f6c8c7ba23a200e9037d4dee256bc438fdb487da8697b030ad7a74fd6de

SHA512
f62490131dcf5e9af0ce8f58fb5597f986d0fb1f0399c5d355d716c6bd949462b2ff4fb13d227a5e7b92bccaf4dddd7f5732762ee36b46ad2e770584f4188b83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
003dc084fe8422119854047160d56018

SHA1
8559f8a3a8d6f70743847a0c48e1fb86cf0ed467

SHA256
943208d5e2936d3318f62afd17c484db15b3d3919fbc9e3854394f08354756c1

SHA512
935dc0b98145d34982c2af1d81d49f33a64eebebbac909f1e869798487fd187aed239aeb130b0252c96829afb7d7e872fa502d22f3c2d704a5a2dfa8d42adc07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
fdc36186c7b7575bf43ffbf1b9c275e2

SHA1
9788685806823c69c2177c5375561f100a77352a

SHA256
82c6a532cf161f25060968085e1413974e049459cb482182bb197bcd918210ca

SHA512
75c320b0f49719a16737fa75b740451a2d36a26317ea4f6dcf63a0b8a496c9a6a474f1679b1c1321aeafa6d26c967a7348e5a846a7d0f8eedb1d085886e57e8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
cf5339fffe550b46518917de318e2118

SHA1
09ea78bcf87558c8def7c79c754960c4bc551097

SHA256
92db794a55454f5e80cdda686fd00ab4b1e928b8bd961e7d6381c1b15553b3dc

SHA512
3b28a7c22965d66353fbb5c147e30282368ac55ab24e85a07eeb6bea68c941118f7438dd3a86a39296459cd5ab8138d524ac6fadbdf440bbd86758bc08ea0c6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
eef3263862dac77f799effde9c661c85

SHA1
0476669ba0f138db284932066e2203b47628871b

SHA256
0b6d3992556c141fc23123ccca500a728d3e00e1e6d956911cc5b61977ecb6d5

SHA512
cb80387d7a9edc3c0b989075e2965fc41cbccce0d601cdd35d05c9ff7d537333615ad28c0153aac4e855c806b678e5e186bf6173b46da74f793e4c3cf185e84f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
56KB

MD5
b248487edc839b98fa8182cda9ae3e29

SHA1
3dd1482be35117be6550e39a35ce3b85c4515823

SHA256
c4eac69e989be128082a94af85dfbeab06c77e7daa6aaf1dc9438d2498edcd70

SHA512
356b8c1f1ddb438ad3d76e995f5977df3b2f9b0837b35390398f855018a46bef253fb4d993b05f4a5e315a0098633ba563a57d2bcd9a019d44dc5c6e608c6fa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
a9d3f416c781cbc0c3888c5433dd649f

SHA1
10ceda06c7b3da3a39d76a3da660ea481bf0a0f1

SHA256
85b7681de1e8ef5decea582e1a0e695422d449de52146c7b9626fc43e5d06e66

SHA512
bc54b112139f24c6199e585f2b672a0b81d41a5fd5c524e49d6248b77b0c56f93cefdb7e63e33df12ef41188cfe9117cb86d3c4c4ed9933ce677f0c69f45c140

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
a51c03c94609d8d399e5e96b77da5cbe

SHA1
535fe94b980b6e6a0a9ecd84851c4a467388a305

SHA256
01c80151cf53a29f04918a90717d8ae81a209fb0e356ab16e85e9eeffb04b412

SHA512
e1496e058aac5f3a8f24d4ec9148f75844a98bb86789799ba1ff069ff5528050df25e8582caccd5758aa62f8d2b7cde8829b37dd2ee7f802b0528c8b79cfd47a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
56KB

MD5
a816b5c2ad98d44f83f705a38a48053c

SHA1
979312bf2df2bb0b2c7b1ea50cb5cc9bb84d6ee7

SHA256
ccae60e1ad19a02fcbf67b28a73d71e5ce252248e0a05b44f5e0a4a3eb0dfe4b

SHA512
a06cd0fa4d718ae46f764390663c548f1d45f98dd2c6e444f45c30d7718d0884431ff77ed21e9b20150f47dd0de27bef5c782c1da59fbb5f96bcc7fe7365ee45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
948494328f9fbaaaee89af7403c83cfd

SHA1
27f5a8938e3bb4650858278ed71f53d6bb981e4f

SHA256
0f8144b469473e2d183a182dd698ad1a75677057b81c5be1dabb3ce40a49b3e6

SHA512
49f33fb8ec11e01d0cb30623d193a9c857e3dcf1a64734a009836c3a4adad8b0c9d904fef879deaa705f0e733b97193c235c7c725cf5114e3fdb36326e740451

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
4eda602c0d4ebd5afa262f90b7303785

SHA1
497309c28cc25f52b8ad5da92d2205ab40ad0b9f

SHA256
9a78974f13621323a794f7364bc6e923b9e7818d1a88e40114ddba98539ee20e

SHA512
6720759f5adbb6e9ce109e103620097257b834e76105177c00df22e21149443050b23f266bbcc1e80dde5a3f3543c0f2c9a14c19f150efc4c664b860401d1f53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Filesize
264KB

MD5
d4696afd1d4d7b4a138d254c2f936d1e

SHA1
bff474680502d747445015e89aff997782184880

SHA256
ada8164175d799817bc8640e3149ebba419b598c9a7649523424621fb4b467c4

SHA512
6c4d6576ba830459d2f6a627475f0ce22aee401f30e328380433840d86119f516335fab3b5e6f7a7b3e3b287c7d74ad5d0593af3d4971b6bab7be85264622a43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Temp\856cdb10-c253-48f1-aa5a-776ae866a7e2.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5024_74617879\e9d9cffe-146d-4c4f-a64e-f0f81eee096b.tmp

Filesize
2.1MB

MD5
4cd67032e35fa92f5182df10df289906

SHA1
9210bfc66bd808ffcd7c6443e160dc8d6754c416

SHA256
efdad7555293ec2d14399c2c2fc9d07228de1f6e3746b27da621b76fe5ceea07

SHA512
f3d83f6e77e4568d2dae539c95acf0a886926a001b4d80f0ea602387530fc333f688ac031b3057e1c2b0375426cf47ae33315f7da9ffaec601102be0bb7221cd

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1568176916\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1568176916\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1767496541\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit