hxxps://culturalintelligence[.]activehosted[.]com/box[.]php?nl=1&c=3&m=4&s=bf6758a6caea8f4e20f6e7d834fb253e&funcml=unsub2&luha=1

Analysis

max time kernel
20s
max time network
21s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
28/03/2025, 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://culturalintelligence.activehosted.com/box.php?nl=1&c=3&m=4&s=bf6758a6caea8f4e20f6e7d834fb253e&funcml=unsub2&luha=1

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5460_287777061\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\128.png	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_374915019\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133876332503095092"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1498259476-758239146-3116387113-1000\{CA9779A4-EF82-4F59-952C-DB631B1E5B75}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1498259476-758239146-3116387113-1000\{CEAD7C0B-69EC-474D-8CAF-D394D2930B8F}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5460	msedge.exe
5460	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5460 wrote to memory of 1428	5460	msedge.exe	81
PID 5460 wrote to memory of 1428	5460	msedge.exe	81
PID 5460 wrote to memory of 1684	5460	msedge.exe	82
PID 5460 wrote to memory of 1684	5460	msedge.exe	82
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3376	5460	msedge.exe	83
PID 5460 wrote to memory of 3440	5460	msedge.exe	84
PID 5460 wrote to memory of 3440	5460	msedge.exe	84
PID 5460 wrote to memory of 3440	5460	msedge.exe	84
PID 5460 wrote to memory of 3440	5460	msedge.exe	84
PID 5460 wrote to memory of 3440	5460	msedge.exe	84
PID 5460 wrote to memory of 3440	5460	msedge.exe	84
PID 5460 wrote to memory of 3440	5460	msedge.exe	84
PID 5460 wrote to memory of 3440	5460	msedge.exe	84
PID 5460 wrote to memory of 3440	5460	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://culturalintelligence.activehosted.com/box.php?nl=1&c=3&m=4&s=bf6758a6caea8f4e20f6e7d834fb253e&funcml=unsub2&luha=1
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x28c,0x7ffbecdff208,0x7ffbecdff214,0x7ffbecdff220
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1896,i,17872627225356528992,2146497666656664461,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2224,i,17872627225356528992,2146497666656664461,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2572,i,17872627225356528992,2146497666656664461,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3436,i,17872627225356528992,2146497666656664461,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3456,i,17872627225356528992,2146497666656664461,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4772,i,17872627225356528992,2146497666656664461,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4804,i,17872627225356528992,2146497666656664461,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5460,i,17872627225356528992,2146497666656664461,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5636,i,17872627225356528992,2146497666656664461,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5636,i,17872627225356528992,2146497666656664461,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5544,i,17872627225356528992,2146497666656664461,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6080,i,17872627225356528992,2146497666656664461,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x288,0x7ffbecdff208,0x7ffbecdff214,0x7ffbecdff220
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1884,i,4092046554677427267,10818216834866065487,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
    3⤵
    PID:1368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2220,i,4092046554677427267,10818216834866065487,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2556,i,4092046554677427267,10818216834866065487,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:8
    3⤵
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4356,i,4092046554677427267,10818216834866065487,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:8
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4532,i,4092046554677427267,10818216834866065487,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
    3⤵
    PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4532,i,4092046554677427267,10818216834866065487,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
    3⤵
    PID:3824

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:3100

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Filesize
16KB

MD5
3406d3b708dcef0116bffd8eaa181ad4

SHA1
3df64b48bff2b9d4160d900e91a7670046a24340

SHA256
fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd

SHA512
d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
6c3ba40e438b794a4630cfac27b4855f

SHA1
255cbd9d9013024a359b4ac1187fd0f39b89f46e

SHA256
44150c3a8ecd45408e7bb17ad9cd38d3191e8ffebfb8e09f9c41b8f59620a5b2

SHA512
344ad251942b3e6d2844145607029bfd2439cf5518fbc6e0e82fa6bec9f5ff391ecf38025dcddc8158591bd433b767126b2c7d520b7a97389f31aaff63f3188d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
f41bedbdd4d1fa72419428d5c51290ea

SHA1
300bac08bc18eab039fe2a14383d9bc047198682

SHA256
bc5513b046eea210605162bacc4ef2e8d053f528286fbe680c8a84dee21f2671

SHA512
4e189cb1aa87cb4dca13af3233a728aa810b81913f4545ea8a2d25808d93fe60a1e9ea52410cb72dbcc83dcec03a3fdb3967ece093d0c4e1f175be002b6bb2b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\103c089b-d605-4f31-a82e-78da41efdf0a.tmp

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9763281b-3002-469f-bc58-97aba9a5b286.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
eafecd616dec3259276b54e5435b7631

SHA1
b2e9d8ccc944145ff90dea6b841ed3bc267d17ec

SHA256
4a4c0461d55f2e60b989e15c30f3da48dfabc34864c69edb92479fb8cf24376c

SHA512
20f8b53f044b9376be92615bd93cc617a0598d0be9b03dbedb46b22b22a1456c88aaff4b61528ba9136958b7722ac77b3f269ed2805aed9c4a93e3dd6dc38be1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
cb9dc13bc9f20730c3528b5ee1e0241f

SHA1
5762d76e90d97652dbc0539921c8b974639440b8

SHA256
adc516279dab4d46bbcf9c42e92706e269cbcec10970eb676d75e776adedef07

SHA512
d39c6f12c27c93c2c88466dda5a0bcb99897b7d78b36e925ea36feb96896549b3c82da5d5a0acd6ade30bb6acfd98e008ed3ca7268465232f367ab0163683794

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
4313f9ae4dcc011363eb19b82c7352bd

SHA1
4fad5707a8d960123ed4dad85562079a693e0e68

SHA256
298ffdcc2ee9d0f9c5fc28226624e129ccf636d1ecf3f64104bcd142c74c3782

SHA512
0da849b75eaf7f06b69b85f76280c3f1a2995278a9eba626e66ca126a4f4393dab0ec463ef6d20127e9a668e9c70eaff6dd487aee47df63ea9a3de42c6ea11b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
8.0MB

MD5
2d7f2afbce60de2960685513e5d30223

SHA1
01a8a3b1cd6cd1f39cb2600f255720c05a48cb92

SHA256
dfdfb189dd3ad597ecd2a626638d862ecbbf43c4711a8c1ba616195c55eac217

SHA512
c4b3195ff19ab7d2430037d76cf6bd56dc40411047d9b18affcb5052c4feaad3618f4d25ab4516e77b29320164cf12367fb3659c2535ba4003f8039ae2307706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077

Filesize
196KB

MD5
666dad7b1a6056f84f1644e57618524d

SHA1
0db7416706c52a74cbe6601b35a262997f57c6d7

SHA256
93ac0ddba9af0a4cc46e2ddc43e89863de1db86e5ad86c2d06b051679e3233ef

SHA512
b3e455fbf52b5102448dd59c499cec5c4fe78bbf220e00e4e281ded54dc1af325c5aa0ca2112ee8936f98b682977471c32064a0d7a3cba167bb0ff4733f1ccf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078

Filesize
44KB

MD5
b2c9031d9fd6493ccda94908cdba4abd

SHA1
d8b4e62dbb826591e45b6b7245edbca76b4f48a4

SHA256
e2291e842cf5af167122a22881a740c7f2dda7716f1e8cd76680264f4a859470

SHA512
b2a0c2a42b5d755ec7bb3be02d8969f9847a85ec309f35d52ebc3c98ac5db261f88a6b70003295ad0a2e467e37b600694b2b8c8a5201036c3d0853b34515da5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079

Filesize
19KB

MD5
5e5ae2374ea57ea153558afd1c2c1372

SHA1
c1bef73c5b67c8866a607e3b8912ffa532d85ccc

SHA256
1ef458d087e95119808d5e5fecbc9604d7805ea4da98170e2c995e967da308f3

SHA512
46059e4a334e0a5295ebcef8401eb94b8fa0971b200f0f9e788ed61edae5018c917efd30b01631cbd6bdadc5240c9fcad2966ea0aa9c94b538bcc369e10bbbaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
4756f7cb6d14bda07b2d47a847d98fb2

SHA1
522747c3a8778bcc0625253a8dddd9e5de0fc540

SHA256
f037cee564f0c92a3fb1b36df016b0d8076371c7070213be14cca96b81f181d9

SHA512
02085339c84b6c8852b1851d412ae5dace6e33d1752bae835a8aa1da71de67afba132f53cdc3b24cffed9803c81770e913efc9a4df863987e36a66c24d553e79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Filesize
346B

MD5
f653d48741b6ebc152d379e17fe3ed5c

SHA1
655a2e89ef288da1b9977ad4cbd1bc80b0a6fb1f

SHA256
ee2c62fbf7ffc37b2b780aaf2155232ce2be8c61f987f8de0a41a71aa4bf11ff

SHA512
3d405dd097d0eec894f4f6aa896f11ba1bd58e793faba4a1a84655badb96e1476294784f58c65fa747958876b767dd54a501734cc60c4cad4844fdba9647d5ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Filesize
32KB

MD5
48493a0fe0dd77f20a7c885561da68b0

SHA1
f3488125918871dd78e03a20ca58847934ec0fe0

SHA256
3c5c5a2f13f630d588061605cf6be6ce846623868b9fb5dc75c93312de43dd31

SHA512
41158bec81aaa2079b2e27e75505c5969b3366e68b969eabf5d7d33cd44ade7504a2b63f9fceeca87082891fc2eedc8de723856d8c5fe03f844553d1f8e75ca6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Filesize
399B

MD5
a15ac2782bb6b4407d11979316f678fd

SHA1
b64eaf0810e180d99b83bba8e366b2e3416c5881

SHA256
55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a

SHA512
370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
322B

MD5
7b1a0326f94af20e28064a4772ae25ad

SHA1
e54485194928a702b15cfc8bee49d1f2618c5e8c

SHA256
590b1893feb2b73ed96c2b78f62f141b41c282ff6200f0eb751de92e2ba42780

SHA512
8e8be5e127241c7d48482927f9db4af1bc1bfe6a07b33d73b18ad4ec0e5a3a9a2557fd659582d9b57dd7a9064c75f2b8f1b511ed749e6fdbac894cd65788a0ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
c94f03961fc0eb341a401c7d58504fdf

SHA1
435195946446680833f9b2ecfe816f831a125df7

SHA256
2fff0aaec9976fb3c4de1e8ce403ad86b647655d75da11868ea9f4393156ba34

SHA512
6c10d4f2f7bd9d75a7ae2733e82dce5f260b37a4954fde5eb25b2934991315a81b0334a47c094c36a6369b75b2240d054035fbbc18d495349ebe9819915058d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
19b2b36f4ad2d83ad48454788a4d6414

SHA1
dfbbb101c5f701f73d43bf3f97a1b3f5755d6a79

SHA256
b12beb199eb6e41f71c7558e4fc4ff3723a284e546e838f646d8f36616b0efff

SHA512
9f13da1c9079809daf8efa6f9c73a143d24ddadd2cadb8d825462f7494f8dd4a5bb1059785a41c4cd5136cac9f9633d5f719db3aa676e9b3d0266ba8dddd39e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Filesize
20KB

MD5
dc5fe109a2cb165a685f358c5367e57d

SHA1
35cda1d127835118516138ea7f1f7926bc8955a3

SHA256
e00d79308aad5f6d7102e11c78d5924e33aecea64a2087a4ed01cae79e302184

SHA512
9572060424ed4436434d34aa3f71a9846338feb32fca324996f6c5c2200e7220f68b9c0b0abaeaeb0efe687ea48844af3b014ad9113d8ba439592b3dc59f5a13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
c2a87a3caf0d4ecfa3a7cbd9291a786f

SHA1
b2e6912337fdc855e561cc8e0a59f77f5fc7ef97

SHA256
c838822bfd3bd18632d350605fee2a042e56b6d77f62555e58fd77c22a13a806

SHA512
93f4206c9cadce0ac9849bd8d8ea7f4b669db035941ff06ff795d2f57e7274585e8cf3ad24f711173f0edb29e482d2d83181894d86ff268dfffbef9936f7b719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Filesize
36KB

MD5
93db3aff8e11c5c6c856dad12e319093

SHA1
ebaf47bf7053927f678b6b1771b6c14a770e251e

SHA256
0c38acedd4008a659337e8e8706834557247c5b962b7698a6cd9c70b7d507e30

SHA512
b6945884bdfccfee862cf29ca536e76328f413f04681924cf3157fb5775da12da15a8412360b0a28702e42c59101568e0be248ad1e2a417d0880f4107ea5163e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
ae55630a93b07c263a102b6c77595d8f

SHA1
55d6a946f60b5b64ebc7f6018ccc68a0da714cb3

SHA256
2b77374b3a4cce208558e465aae10826c38a0fb961db4ffa2d84239aa01b97fd

SHA512
71d0bbe67fc39ae02c07a9dbcba3069ad194d372a14741a6daa1f3bb981d7ef64734c50ad770f0dbabce2afca5fa8d33a0936a569220012b8b00684430204362

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
fb737c1d6a2c74a80cb6d85319272e44

SHA1
148b9c2af98fb3b7e6ad49ca99d13beb9d5c7b79

SHA256
1a0f3069d4899eb7a55392dab3de15217d84059afb965ae2747171fd421bea80

SHA512
80bfc274aef38043080c77dc0bcf346a4c9726384b845d33e3f6ed39c4e8d872a9389efba736d5a2def962b1351c5ae9ef5ad1622f5d0d1a611d319320289663

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
a26f600d10bd83f7cfa5fc2fe9326eb9

SHA1
2c332e250d31eb8f7f7d3ef923cbc5c31141c751

SHA256
e918d5261b5ebe0c63d785c9402f2a4cc3f2e34ec6e19be29f8acf634aaeac77

SHA512
693ca953037b7df3bb359cd7a29380493c3444db233a35dd32f6bf61ec9f8625539a418664cc3529065ba5c9f8a2a8bd1d70675990c3a3576c011f83e885cf0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
68e32a4bee6e4fe78e08341ba2334688

SHA1
d8982e550d7860b2b87a586a20daed886723ceb9

SHA256
0115749bd8ed3a4d005c460e60848ece897c0c78804732bd56359c22e22a180e

SHA512
1178d399a2508c0dc57cdd913736d8194a7feb2fe653c586944e1e3baa891b9f9559b8c9982dbeb6024a73dbcae16d92912109f1659bdc3661e4582b2542a2ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Filesize
335B

MD5
235917626d59bdd858dae18c525a181e

SHA1
8769b37dff7f521d067eda0806014e1284ce0d81

SHA256
a387aea0ea7b2b266298004766746efed8b28643faf4db3958734e949a4a8531

SHA512
8a4190ded77231dd1098a315fbcbd977f2bf6b4556f58c81b3ad2f50d0466a30583b7616219a7bc5d7fb2c530975856a60e743fc89d039890fc3ad8d4bb54ab2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
96281ba3ea2f32fd762af33ab56b0caf

SHA1
566fdd0562f63dceb67fd490564496953b434c69

SHA256
bb01000bd13937723bb0f461d7e517316157787c1a2bb6ca956af4788d445de6

SHA512
c65aac0f604a41ed093f9d845ae6894ee3c7b0056140f9e1099efcbe24d46de189902bdec67f9b01c375025a9daba084b95b6f7d11a6f9115fc9241af3898628

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
ddc3260d248a3a75fe27bf24eb79eb43

SHA1
ab1eea3191c4a62482fb52d55ba35a3d88157bab

SHA256
f6e4e89894afb6be56064f69bb86024209776b27cc0f14a3e5e053fc52ae01c2

SHA512
a853ab08908a90b746c3973c9fcf32942a0fd4d8437430b00553e3ec7806d41d6ed5d231b6a8f4cefd011ea326a44f892fd69ff8864327e362dd5b934a74f7ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
d0274040f1eb2b33cfa8642b3497397b

SHA1
b1fb3b3a582a879daf552c7327a14d0a1a1257c9

SHA256
33043c68e0b2e9bf88437b31e58a9d5d94696f27a3e74c65606cfd9ca6b2fa8e

SHA512
efc755289a2d96021ea7551421d00af613fb8bcfdee0590edd5a4758035dda54729b3b1c11a77905f324b682926a123f05e201b7a859ec824b71eb74d4d130e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
dac4e90dc67478faec51da81cd23bd22

SHA1
0c1433088f543dd03f85ddf41f2abdb90aedb7ef

SHA256
8308abd0f4eab353db6c53a0320da7f495cf3a2fd6c0891663baaf2cdddae09a

SHA512
af7e66b128d6e1efb20fa406eb5d14f201e5ba2816348122077a94e7d313920ce187d02d419c17c1e144824aa727b4bf6129f69029923d1283911559bd402c83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
24KB

MD5
32eabefefe567c97f9e7158fd62f2335

SHA1
7b4d33ccbd60b77ca3833ec8f680c9ca043714e4

SHA256
41b80be3c2179ddc07fc65e2d68849a80352c42e5cd2cbfcd6f05c6ff5ed9cc3

SHA512
b0bb4ae3d00daf62b255b5f43a66f9c3972d3d695001237001af16116351b3489e4421caa30252f4c276cf72f7272c0a4b19ffe9ac66ac35719abf5238b4d268

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
88b32a6f1202a283f56418ec106a510d

SHA1
48cd192b8ad0a7b1c8c1308ad458a839fcf7f357

SHA256
b8977acba52ca4b049c5d21f582d2e4254337767ddaf568cac5f75b3742a5258

SHA512
32c14277b5f02e371c9bc2c1948899f44859d43b1abbe42e35cf4c223a8ed2bd202f39ca944e8e7653155341cfe0cfc6c9401735d15e7429ffb95ce0249bca79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
228KB

MD5
3125f71dc474e9906e9ef8440bdbf9c0

SHA1
3c5c66f0c17f19fef8175f2a0a5bc4b1e6708ac2

SHA256
a6712367cfb329f20de59c43710c25e16cdf2e7289b8c9c3849d582e3d6f9beb

SHA512
6586a7e44da9cc2966a9754014f676a08857c979b8ce8384f3496e12657071e6a774026e0670cb3d97aed78173c43ed10820ec291e30611a04547625f82b63a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase

Filesize
14KB

MD5
beb101fcdedaebbbf6eb7adbcd12d583

SHA1
4f75181f4a7c5b1b02c7b48320b9347679e94207

SHA256
c4064926b6a8cb28da072c6052132509c93b74027cbc278d31d6cd98bda19bc9

SHA512
f320da8d8bbe0141df4f7fe3e040014b855f347a93998fe5944181ebac8c3b8fcb0d53936d0b9d73fe48529398f3f56f06a32775d3359c891bd0b8fa7d4e87cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json

Filesize
12KB

MD5
18261eb12378081f939fb9415ca0c9e1

SHA1
20d4ff782e17fe45e71c3f9fc60a94655f72ec7c

SHA256
12bbeec9a0af9e3ed945b28b9b8ef89b2f897768d1ba3ffd6f3fbb42fa5bc556

SHA512
fef634b4ce77c2f36ce1bdd63e8ac28e76cd089f0bff33f4425c757ddf37fe9fab30dea7b5bb51c91eb27012cf78800e03643e13d51a25bf624ce58ab3488a80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
10KB

MD5
8c0714776460df6bf2861d8799e02f01

SHA1
648618247bdd800393de879a669099d2f79ff0c6

SHA256
8e2c29f20e179ac1ceb6b5ffac876baab1fe7a83372088444016f400e3c39103

SHA512
b19bdf7f310523fa3d5aed6df0d5ec717d89879cea49ca93d05132179e7ce952703829383de7489ab4a872b4a6604fdaeeb547756657572df8179cc1598d6947

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
322B

MD5
2f02733cb251c840c4c5d3de1083c010

SHA1
cefd7ff727cf7011bc536315448b41d276fe7778

SHA256
44bfc04d7910dc84fcd75aefe4f78dc8895ae3702b8b4246c56078b6c45f8ee7

SHA512
b5a9266bb03f665f1533b2dede2264e4e393b20d67bd19c410fc471a952c7289a9975a7c7b2617d36f2e6a180e510a6db395243426cb14c84d8192e9955b78d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
1KB

MD5
799c0afacef91a02f0268a9090d52873

SHA1
4cfdb0cbafd5193c7ab14068c29be334395b62af

SHA256
9ade681c4b5f1a27bf5765dddd818acc11c577b520451a155094a89d82f8464b

SHA512
1ea0c86e7a58d02fa8c2bf34f4f7c89f37e56328e5e15f0bbf52e12c2db89b55da9e9226ee601d033d566c3613cce48e4b85e3170bc7e27d952327d673763257

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
fc2bad1b4ea5622bcadee627399a1909

SHA1
b2bd7e0759dd66af9c67a651cb734877b7502363

SHA256
75200f905a32877ad906115f89712d6ac10585eed3c4312e1b2c7d83fac60ae4

SHA512
747422419ce27c77d4e975d3147fa0b0df2497078c4bd9709ec81b1389b0fa604ab2725b350ac98df6596c9b8ced8bd511f2026f0406ea943f69eda7ef7886e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Filesize
44KB

MD5
49fb0bf53fd48df19ad9b0a0c9e56db7

SHA1
89e8a3f177d06b5cf632e5298dc42a029cfa5815

SHA256
c6bc36bc5bbdf5947ef714592aed50be0f033970760ffe9a2d6fa81b61d89326

SHA512
1b2d332afa782ba9a2b57fd7e7f9bf11b62d1e130e689179339627a14be873fa6673ad7a41bc3a36c0cc6108a975762483b9cecea11c1a0bd06900065e374478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
5201e9cd673d5be517bb7b46d8cda78a

SHA1
c571baa5e98282da54b5dcda523fb6d82ca27763

SHA256
4957f90fe4bdf9f66e6edad5bc44dd0cb7e055c03bba791915e2e9d21fb7a734

SHA512
9332247a0660edbe0cc7c40d07584713da967b8a0890f483977142cd28213efacfb468b753cf2c94eba350285c2aa089e6a652cf5a90e9b6bafd465c8c27a383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Filesize
4.0MB

MD5
95dd9cc75495ad9c8740db97d1a9555b

SHA1
27972fa7ba0a93a075535769d0f3d78d2a9410f9

SHA256
5b92b67fa3bc1079a4af4fb71e9a790948e6bddb8ed347bd937fc1274f190337

SHA512
c25bbd3f0f37e24ab7c5134662996669d9443f58c4f864b56599e044989c7e4b93db8c4ac683d96d25b21b49a07263345c41406a031eaf9ff2b18044cc135bbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
fff1784705d06551def43688918d0fe5

SHA1
f6766a106ec58a629609283eb7bfcd6ba89b97d7

SHA256
cef18782af9e3573da1560f6776102fcf9182ffe41e27305dfcc5bbe3b8889f3

SHA512
3dc038ae177ea88df5ea3412887926dbafbb1e70fc280587fffc0af6f1f1e3ed7630960d61770e129a50777b76ba2164bb96dde3e3ec21ca191801c22dd95ea6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
56KB

MD5
4c02450ea957c64a041e99099f0b01ad

SHA1
3604ec36d19ad0f022c26e5c664ea646b4c49eaa

SHA256
1a183623d453e20c955f45b529869cac9bfdacd8facec05b94e5131f8ebada83

SHA512
7a0cf0bec0784d9d8bd894ea786296a399573961efa2701411cef188ab3e2df53fc2eb0bbb19b8054b3ab74ca9daca9b8fb54d1bdf7c1fe87b32b9f8ba661136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
64cfea8a534a222aa92bdbec97699874

SHA1
124c3642923633d72677cd81a94e101aecb00586

SHA256
c23ce534bd3f86f6801b938c7f8158cf5d77d9ccbe24eccf0da39e16c9608d51

SHA512
e8ec5af34073ae18851543ec82c2a574a6eee36bd5edba931cdfc6d2e66991f60e14f234c2c9f20da7884d3a712747c4ef25021806d5c4e8d6c4587d2f38582e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
56KB

MD5
002698bb9e897296c865997112eb1ff2

SHA1
31797ad121c03e42c3056177deab6bc6e42ff932

SHA256
9be9b0862cb07a320e4291f1189386e66f063da87b30b7a494a91a0fe88160c7

SHA512
26fe51831c9cbcdfddbd6bde3f895b471ae740061460c54a74b76fc8641c3eb7515a7496c1b07b335c8ddf26d7c1b6175982deae2eee9dbc5e20fd00f1fbfdbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
27053808e518d91e8a696badfaec466a

SHA1
1698fb967c029efc0429abe7c42d774fc6f6bb12

SHA256
e4e66818f89fa699e0529daae5fafa897c142326faee6feb1be8388874184c79

SHA512
36b1bb89ccb6a5c42a31b6de172c1a3f25832e2918cad4e8ca72bc4a432ccc1a2f1f53ca04be43aac8e102d918ccffd1d2ff130b451314d3d30126378748f7ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Filesize
264KB

MD5
80f6c0e06c8cd48a6cd6d9fe6a09a01a

SHA1
66556e4fcb63c471b85fe0adc3b2257a3d57aa80

SHA256
76b595fdb92830f8a1e7cb3d98909346b8b65aa22c328043d3ec5692f1445b03

SHA512
3192f75d930d5b74b12670398220192a81e2f0ed128bc217cbae75706dcfeff4b8f2240cf762d111c0ea6f2365b6483cc60088a92bb080a1f2ab1b4668a6ce2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
9df8d1b300363c7227c87b0efcb43f6f

SHA1
df3144b1efb9fed918972d0eb42bce004cddaeff

SHA256
81e6d74289145c385fe1d5cbc60df7c53ffce0023ae9b0504a02d7f76f7b0952

SHA512
d6d59d343fcfcd545dcc428d124db261ced1c6284ad0420fc2c0b540ad4a98b350ecc30a47ac775ca692697b3fd5ff72472495f3ba4549689b8dc96eda1b8b75

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads