hxxps://gofile[.]io/d/gTmuiU

Resubmissions

28/03/2025, 18:21

250328-wzrfra1pt6 6

28/03/2025, 17:55

250328-whgj8a1mx4 8

Analysis

max time kernel
24s
max time network
26s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2025, 18:21

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://gofile.io/d/gTmuiU

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
33	api.gofile.io
34	api.gofile.io
38	api.gofile.io
52	api.gofile.io

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_5724_1590939810\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5724_1173451168\_locales\cy\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "185"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133876597215939422"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-814918696-1585701690-3140955116-1000\{CD215998-6892-49E8-B84F-7718B04E3D33}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-814918696-1585701690-3140955116-1000\{9FBB914C-2E05-4BFB-B72B-E5D13726AA27}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4180	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5724 wrote to memory of 3732	5724	msedge.exe	87
PID 5724 wrote to memory of 3732	5724	msedge.exe	87
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 3412	5724	msedge.exe	89
PID 5724 wrote to memory of 3412	5724	msedge.exe	89
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 4180	5724	msedge.exe	88
PID 5724 wrote to memory of 5884	5724	msedge.exe	90
PID 5724 wrote to memory of 5884	5724	msedge.exe	90
PID 5724 wrote to memory of 5884	5724	msedge.exe	90
PID 5724 wrote to memory of 5884	5724	msedge.exe	90
PID 5724 wrote to memory of 5884	5724	msedge.exe	90
PID 5724 wrote to memory of 5884	5724	msedge.exe	90
PID 5724 wrote to memory of 5884	5724	msedge.exe	90
PID 5724 wrote to memory of 5884	5724	msedge.exe	90
PID 5724 wrote to memory of 5884	5724	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/gTmuiU
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2e4,0x7ffe32a0f208,0x7ffe32a0f214,0x7ffe32a0f220
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2160,i,1340846588096626487,3618988652071257035,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1844,i,1340846588096626487,3618988652071257035,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2444,i,1340846588096626487,3618988652071257035,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:8
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3520,i,1340846588096626487,3618988652071257035,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3528,i,1340846588096626487,3618988652071257035,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4920,i,1340846588096626487,3618988652071257035,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4844,i,1340846588096626487,3618988652071257035,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4836,i,1340846588096626487,3618988652071257035,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5688,i,1340846588096626487,3618988652071257035,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5884,i,1340846588096626487,3618988652071257035,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5884,i,1340846588096626487,3618988652071257035,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6068,i,1340846588096626487,3618988652071257035,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6240,i,1340846588096626487,3618988652071257035,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:1376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x210,0x7ffe32a0f208,0x7ffe32a0f214,0x7ffe32a0f220
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1888,i,14520591887855608587,10037527979730408355,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
    3⤵
    PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2292,i,14520591887855608587,10037527979730408355,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
    3⤵
    PID:5204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2368,i,14520591887855608587,10037527979730408355,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:8
    3⤵
    PID:116
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1664,i,14520591887855608587,10037527979730408355,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:8
    3⤵
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1664,i,14520591887855608587,10037527979730408355,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:8
    3⤵
    PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4628,i,14520591887855608587,10037527979730408355,262144 --variations-seed-version --mojo-platform-channel-handle=1656 /prefetch:8
    3⤵
    PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:1236

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3836

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3901055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Filesize
16KB

MD5
cfab81b800edabacbf6cb61aa78d5258

SHA1
2730d4da1be7238d701dc84eb708a064b8d1cf27

SHA256
452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f

SHA512
ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
60d40d2b37759323c10800b75df359b8

SHA1
f5890e7d8fc1976fe036fea293832d2e9968c05c

SHA256
c3a2f26d5aef8b5ed1d23b59ed6fce952b48194bed69e108a48f78aec72126e0

SHA512
0c339563594cc9f930a64903281589886308d4412ee267e976520a58d86b2c339d7b2320e1b3fd6fbf81f092ff1735f0710c669af2986ea5b63d2c1e0a6df902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
bcb2b5ac8f087061630d0e974fa5b184

SHA1
d93324cb5173471544374d626452b427fa04c212

SHA256
dff5f4f28e13df2babe3bf77f97c6459fb491a4b4cd7699e5637e651eec0297b

SHA512
60eb0fbab81457a187ab54d4bad686a7efaf5cfd71bd15f87602771545412153d38337e911122598e36a6c4f7e62b68329e95279ed25106836e206319e7f1043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
72196e9664d5dfa053429dfcec146d45

SHA1
37e88f3c289309d5b295fcf6eda71c141badd451

SHA256
779991e50a0bacb4c7b4662008462902ac2ea213258eab4cb15d95259e503dba

SHA512
b02b9ead3ecec66d9d221eac0f620bb2fad9120a364c186ddd232640c97306c04fc653ea10c58485c735e99af8d6a26424942cbcfb0049f4c52144ce5100002e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
86148da094b9e0050b1c33f95f2a733f

SHA1
7e420b13f6fa3e05aecfaa2dd1bd3a1dc9247c1c

SHA256
0aa22c66cdd380370e8e3ae89ef9dda12d93e637c7c77667dc097bdce922b10b

SHA512
3984e1fdbfaadca9f676a4e4d13ae47fcb6292397d5607db983d8e470493db6a81a0d6d81be42fbe7b0ca8689a968ec9bdecbcd49b812e6e06dced2a90a2fa83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
9899793c31a4a278b9fb05d18421226e

SHA1
1d361de969b1bd9e9d62c71c23fe215ad7dd279f

SHA256
47fa797805fd29876a4ea6f6ae6890b72b6b1bef81d3da8e741a5701e8c2165b

SHA512
5ee9ca09140daad0ffff302daa21b7a4964dcacdb3df713a14982eaa239e521afd5a68dba412c4f2c8e54b7b31df4df9439ca961252fae209b84d664dbadf767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
f3b67a6312e17e5a6cffd0b670c72d9c

SHA1
52057267893fa5e171f1f536101f6c1211cd3af5

SHA256
f35dd9e94dcb26a6764651255afe1f7fc193aba5c4a68b316210f2b69305688b

SHA512
ea43191478933c423035f7948350d463635cb40b177e1128677546ee87347885e2395d5ce000a40a9c38736d94f90f738a73c2c86def6dbe4a1572984ebb1855

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
8.0MB

MD5
0e58e3e924ce5ac493ee1284d7900e8d

SHA1
1a365e88855e192781c8645503504be323aabc73

SHA256
5b36a2cdafccb0a2980b5f328716f7c799268a3a87bf1272bab05c4030abdc90

SHA512
3d870b8d4b9b8bf9779e40ed1140dfda73e4583f382200fcba0d35dfe0f491d9720af86f7857a66e749e7fa4ed5cf9dc78ca3e057858996fa07ed8011c93336c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073

Filesize
26KB

MD5
3db01f3289b7517e321aac642a91c7f3

SHA1
4d54518f6f94dbe3e4e0cd7cc0d13698272d197f

SHA256
45c8217bf1571647763788b5472b9621330f6b065ea3107e2c6340a60ccb73a1

SHA512
69e7726636a206b910a971c00bb9a2a79835e5f98bc588158f62484ae77cfed138f8741e68b6d69ce77830420bb87df46762c51862a80f01d04112a3561673cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074

Filesize
74KB

MD5
6eb12835d362dbc711c5d68b7f8b824c

SHA1
9d419feab94ca0d8e3c60ec1172eb56ebe5684b6

SHA256
4d62c2581f8d869f0e7c62a48d7790fcd01f1ee6d5b811759703609c18d1605d

SHA512
b9115b5aa227feb408c9397dfa0c9480f7d637fbb161b5e8d53bfcf44ba00a7af50e92f0c40a157e14864571da1a13afb3c68dbbb464753051c7b7c34fe995a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075

Filesize
115KB

MD5
715d593456fa02fe72a008a72398f5be

SHA1
e948290773216dc1b50c2121314a8cf918c22b54

SHA256
c411f11975d26eb04cd2aa3c071181d4b18e489f1fb97060d4176a3531dfb36e

SHA512
1f63209c93a462c2690442c9cf1c3e5a67f2df7a67dfcda2cb81292a2dbb90641aa0ab81c25323a1f2d9f0fa09b3421d136ae5228c47e581c51912ba284de46e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076

Filesize
153KB

MD5
237f4a0afbdb652fb2330ee7e1567dd3

SHA1
69335cd6a6ac82253ea5545899cccde35af39131

SHA256
1f0189e087fcefbf654fad74a3a06668b782c01353a61d5c0b7f0bf23e33c020

SHA512
27e8e1f91507179c207f93a19485738ed5d372a977eb27d44a4ed163013097d38b117c7a5bf4336ecc9862ca514d78ffcd2b8a07e304bbfe1b2cce9c087baa38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077

Filesize
19KB

MD5
5e5ae2374ea57ea153558afd1c2c1372

SHA1
c1bef73c5b67c8866a607e3b8912ffa532d85ccc

SHA256
1ef458d087e95119808d5e5fecbc9604d7805ea4da98170e2c995e967da308f3

SHA512
46059e4a334e0a5295ebcef8401eb94b8fa0971b200f0f9e788ed61edae5018c917efd30b01631cbd6bdadc5240c9fcad2966ea0aa9c94b538bcc369e10bbbaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
11ecd19bcdcd837de8cee089c7f938ce

SHA1
aefde9feb488f020637134395385ec4c4affcf5b

SHA256
b551b86962daffe14c6295df23163b3718545fc44de3de5abea8b5217ecdff74

SHA512
7302ea00c61ac276ea3d81a18aaf73647e8a342175aacb861870a8332ba8aab768469044f664c18cfa145531ad273eaf5964ea6b11720d9e56b809b53c109a3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe576f35.TMP

Filesize
3KB

MD5
46538c2ff99e4988d41626efb3100980

SHA1
781f06d46511366a6b51c4d525a6393dd0f49353

SHA256
952a871a50ae6dbda2a438779f91d68fc5c25615f40637b2534dfc2a42a53064

SHA512
b95b65b57d14cdfbbaed5d8c376c5fcb281356fded15d0b6f5b8607c3fd6da0d1e16eb7527cce35db589126809433b7bfeba61edd021856058cf2248e613ea6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Filesize
343B

MD5
9235035ee5c471270e016b684744a604

SHA1
9ea6343d54d148fef16c3dbd7efdb5e46be7c6bf

SHA256
f81d27737bbb6a24479d2a630f022416718c73f5b8f03b5f45d11a994b9a3616

SHA512
09e01ed4e3bd03646473e0b770bebb2bb4633acfe111cb5c08c655feff714c30fc77a383726936c4bdb1673e5dbe23b059182f5a43affdee3af21fbff06da160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Filesize
32KB

MD5
e9eb0de0107dc0feb499afbfa4c3b160

SHA1
d1832c4eb092bc95caf60920107caf3db7682171

SHA256
e2b4411dcc9e799510546f6f8ab4cf85a5386cbdca1cd58bc2ebc7165d9ae5a1

SHA512
1bbe2ef83e9311de8a83c3b8d7d2ad5aaf90f54ad655e9d367b21dbf7aad1db4393e754776d0e39f1f991a8e3e4a57caa47cad489ab0c003ae4f1c3f0ea7f1f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Filesize
399B

MD5
a15ac2782bb6b4407d11979316f678fd

SHA1
b64eaf0810e180d99b83bba8e366b2e3416c5881

SHA256
55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a

SHA512
370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
322B

MD5
ea0fc4cb0b91d605898a58800e05c728

SHA1
4e7734e666fcfb2a40650ce935c46a06d8a599ea

SHA256
9723ed7204d73b286bf2957571b3049d6827cc5a2ef0b90db963ed7363f79299

SHA512
9fd0d7008f700047923e66dfba9c18c0033884ffeb1d14795a03b55f4cd967125ce48ad5193b4547b89926ee8e2777927a72799bb67930e0c593b1904345d27a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
e2a1bf1b726858936cd6a12d7e5bdb94

SHA1
bc92fdda74965f667328f32287510d865aa12e3c

SHA256
89b4c9cb9b7e15d6b9530097be45f4f94b39f10fd4888dc65cd7f3281feabd22

SHA512
fef2c1020b6977408b438a07045948b7ff18ae61420e20199fc936958a9643cc1b77a4150ecc191be3a546b6293b268d91d7d788c572e5fde2a446463be276cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
02d137afdab46c3e3b7bfa5fa04bdbfa

SHA1
fc099559783e0fd4a12521517d5ab60bff19ea9a

SHA256
e2ba589f7caf6db7c926e7805b3d3f86b6a55eb4c65acdbe7980b7ad9c48939e

SHA512
039fca1b80604217428e5b5c60a72b228d6ab24da35369c0139f878b342c0b4a1994e10d5141ae9aba3f55773dc57fd25d5540144cf3b44699c3e32ae8bfb4f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
1KB

MD5
3dc7548e30f035861207f7a4c9ab96d3

SHA1
ca7611d057fe86f712160ce32c2f98d3b1f6b268

SHA256
d2e8a8e8b05647d8801999ae1d342980bf3a52dd57fea12a151595a120f9cdbf

SHA512
c672f6ee3c2869591ecd968961c4c4e9343bb5d37d418accdb53d0265eceb4db3f24b53bed640a59e1abc0da1165d93b870728187231dae2a038d4d24cf60c33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
2761781cbbbd6b2140c20425108ff088

SHA1
ccdeb7c6dd5279b21a4640835b1640bf4d918e64

SHA256
45cde83b8a5180796674e6337dfdf76f28d88089e54c274a27ebfb28bcfe1ea2

SHA512
fdfa19f959c278c548ce475a7f446899632b699cc59285d626d20188d616f82c20704f97eaa63e930dff11783ec171295f27c284ef1f2a95385632d546220adf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
fd3f961a285ddd6e5a406931f5965fe6

SHA1
db54aeeebe1f6993ca1bd2ec2326fdfd50c9aada

SHA256
66421025a9f03760518d3fd1057f877f7ebea0089c5ea906184fefac4ad4de0b

SHA512
2ce5b8bc884bf99e58186bf7a0be3de3ca2abf4bf91c97e84814e32298d4d9f9567b2aa4e6d939f98ba5dbd44851874c001f49b3a012c588ab722e8f4714225b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
7279a5ddc8b3942c96d0b3cab13b03a4

SHA1
c3eb530999a94a7736af182eb05b1d972f3ebe2b

SHA256
0460da7ef8543a8a92911a557d813ac5406ae3f248f3cba0821ed3cbe68043ca

SHA512
ad9085f7add38fa239b8fe1f2618781825eb6b969a66028a15871c5ad8441519ddc30a02497d02bc0b0713cda98a85fe23b4e26fca451901fd0cef14289a04cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
516B

MD5
9e44ec34120fcafb6df8829386d87bec

SHA1
63890fe7a96ac11bee193057ab2f3f4c90df8f1a

SHA256
2adce6bfb6c945a44547469c6c3f42d98fbe3401d669bc06f9ec37c92e064353

SHA512
2283381b5fc73ae2a299f12240242108ec1da8c8f1f67977850af625e3218b7fae6cc59d4746e2d1f76307983467571272721202678c237b87b8a402927694ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
43f4a89ff024791413dd307c70c1d304

SHA1
20c846b4f764660a8371647297f4aea1cb7b6533

SHA256
67e2ff7707af7dcbb883b443d5d67ef7643610a18bff3a1a1bd970f2fe0780c4

SHA512
ab08a7cb4bf1b273c2fab4900615f79b56a80c103f3e6795d9ab312117afdde70b4b5546307a6998609a388b73252c30ad02fa62857f16fc6aae6815919b0322

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
35c83efa925d491a047d4c7c6be597fa

SHA1
4cbe706e0123756a1f51db3f2ebedf2a22a1afa6

SHA256
7d85154d30bebb5b46f9c074da1daa026978f895a99facdb2c083fe5fc7b2e8d

SHA512
820226f93f94962b36850ac3c3b3696b2da4fb9c81e02da4f26cc3999d920c78afc2d66a615f07b52db45306eed7ba78109583496f9db5d468218c1f13f3f496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
bd7fc0ec8b233096afd15106a945c76d

SHA1
c8a0242d8075a0080a25fae3e15beb62b32f1e1f

SHA256
10e5838f44743a9a9eb33cfc70b7df6d545b64ff999cd458b70709e987d21e0d

SHA512
c2cdca7e9b5b0ff93283b00e3eee425c7d7210ed8a7b38923288fb74a15205ad03e0cf6ad378977ad5d46461a3bf5b69b49279d75b3162db45b3656bb05e330b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Filesize
338B

MD5
a0817e7c7ddc057fe8dd04eb4a3cdda1

SHA1
c0fc41a3b578db031643c420aa449fac52705ff8

SHA256
abfd28eedc4d92e9897806a52dac86ff374268b5b50bf7c19884df0e6cb8652b

SHA512
933a28785b916bcb1d4723564819b2ab281a026c292df1efec2c1f61d3fd7d0b9d15591dd9d28ed72b64c6b7881eb7b6a954ab6c25d2d966c45d21753e2394aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
fc406087660962f8651f5680836c72ec

SHA1
b05533bf07acd634f0ae2c7eed423539eb0a865b

SHA256
71d459b7575895fe060bdec06f48c4f2ab7514c6df3966dd06f0761b068161a5

SHA512
a9ee631b34a54ac19b8896d42ca74956890a20ba8af1281615846c4b1e72363bb2b7b8fb000950a225c2c14c019c3602c5388ddc39b6b2028368f10f81dad3bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
8915e7bf9f4468708fc5be3a710c3669

SHA1
7d35d8300348501aa54af39d82fef7aaf230cfa8

SHA256
ee96cb55a961c75c3ef65201b38e9417eed5c992db79ad59b9556932dd8bc61f

SHA512
559603bb27ddc88c7228097359b4ef02f9dd7b9c19c0cf9eff6dddff3452aacf910c4202749398e7ddacbc6d6b2506f417e44bcffce878bf44f337f708a647f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
f140579724716355b0472dcdf1e93f8d

SHA1
da0a65f7fc8b48854e66ac1db2e9dca4a712ed14

SHA256
d6dcf719e21d4de4c3aca5d741b426866fdd059cf2045cbce7578a0e723ed755

SHA512
e66e759a277de3a775e893c8c7d9f5854818c10c8e02e6339feb7e127a26732d43f73f4c71425ebf1c304fc25c38929aa026b2bb5873c845dacf750c73b56ffa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
25KB

MD5
a78ca17b731fa0936bdc92ed329906db

SHA1
418f1e071f4767528ccdcd87ab57dd110538fc57

SHA256
f750364008d5e20f76a8302eb2fd7b28d59eebbd78fa5af0f29b6f91f80d95fc

SHA512
2aa675d4100121bebd5afa6e4c109f35250043f46a6e0a9a219af7b61e0ad630688bc1bb0b006ffd8b2713779a6cc8121f81b4b5b99e5db86f68f8bf53ea3399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
5466a9e27ffb1275837a927d6e47ba31

SHA1
f4f8f503c9f151e3adf6c9d94c9599e5995d7907

SHA256
5582eb4a4e2242952c07c0cfa6c27d3af5e218ac3aacf519bc8412fde68d6c84

SHA512
c2db580a8682b3290aa48e39b6934c81fe0f2dfb3c669c70f308aa7418708bb2691475409773ac43a33f7ef480cf2547dc801f78f191b7d822540d07321b9a7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
8a8f159a852db88cb67844a8ff6f6d65

SHA1
6ca1425ea851128fb0224a9b8be6da291cd0f8e5

SHA256
fbd07f4a32f68258768f99980221c041d43df64fd244ca5b0bad6abfb2dab9fb

SHA512
71b00a520028613bc1c4499ea80935f3a966fcd42d974f9a3cb467127f9df8de6d82cfcc8d7ab386dcf35e1f494fe6319d785d56810638ae440c8e0191103a26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase

Filesize
14KB

MD5
715f74ab2425e27f660eb19c9331d243

SHA1
5371a34066a2df8dbb215f71c35aca69dfafa209

SHA256
dde1ae57799a4e4df0a44a5d0292ae212a302ca9991fda57e4fdb593cfb71142

SHA512
7d7f9f654fbf834d8c6f67dc7a5bc8ec3b603bb587a11a10ccd8aadf7496567fae77c92cce2f2fe67ab812316dd341f2bf707bdb49275f6cf35dfc1e4a4b8b6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b217e427-b373-4b09-b58c-4f63ca002194.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json

Filesize
12KB

MD5
18261eb12378081f939fb9415ca0c9e1

SHA1
20d4ff782e17fe45e71c3f9fc60a94655f72ec7c

SHA256
12bbeec9a0af9e3ed945b28b9b8ef89b2f897768d1ba3ffd6f3fbb42fa5bc556

SHA512
fef634b4ce77c2f36ce1bdd63e8ac28e76cd089f0bff33f4425c757ddf37fe9fab30dea7b5bb51c91eb27012cf78800e03643e13d51a25bf624ce58ab3488a80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log

Filesize
2KB

MD5
5d449a62483daa673d239bfaac8d8e15

SHA1
16d3dc7f44587fe25668ceb30c7e333e07214d5b

SHA256
dd20449c2d252b7f37e92783fd86dbed53d2f564f936a4252c8f567a868e5d67

SHA512
83036a57d392a224f2d6c870bed96850f92ffa8a936efbda216152aefb94e66e874db1844f3790184e20d5b41a1fd2fdcbd7fcde71d4fa637f54af93a05f5f9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
10KB

MD5
917e5cc71a14bcd55ffbf64d87b337c3

SHA1
b7bd5f2c25b02e7182bf88accd88600bddb7b41f

SHA256
e7dfce2ba331e83e76a4fa87c1f7f5d6f596b481a079edebb2bff03eab7fbd0c

SHA512
8fe9b784622efbfaf2748f17f895f5b8d464d880641bc9ea9c7f482c09eb9cfedb3848ac9ee56ebb68b46eb8de56b29a742e9f87730f0811fec6ae7962510766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
322B

MD5
6e985f4c7e8d7dd2a2df8933bc92adb0

SHA1
6f3c584d0ac880e2992219cbca3b332623fbe4f3

SHA256
f4b6a080113d047107c4369fd40e1d9762189e3c59c35a5f7e33a3a8004b859d

SHA512
e9db43b83a51909dccd5da3ef4dbd5a16655573ee8b63f83d5b9d3b70fb142c76a875ebfca02d52252432ad16ddfaedbcaab15c38049fbe2d3508cbbfc38ccb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
1KB

MD5
281a4ccfce95e3e2b59b6846c653c7b6

SHA1
278ea76874cc7202fc5e6849a3442d4bf7af9e75

SHA256
d80fe6619fe74e9aa81a56069f2bf15dd4f515e0911b42a9ecc581fd950b9c4b

SHA512
03cebde38482f3cb235f7b8198116eaad1465ba659f217b0bf98c27fb8d51dd6fd2d737c8dee0bb79fe6fbafb854c0ffeeb4246bfa14cb3817b5c201fae34f11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
ca59d202feca7d7604c3d471e5675ab2

SHA1
adfdc32d7e7bbf3530f963359ec14ebb4fe50613

SHA256
c49f2dbe45ba0d85e233474b08cf522029270b420bd9ac3e4cf059fb5446f32e

SHA512
b196d7fd455d7d70bd779d041be377f414aeab9598cd79a3c2dd13664f4254608d5bd13f1477457b7fefc2527443b848a67ab4c507e0967bae7e65c0aee2096b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Filesize
44KB

MD5
b715bf0f3903fa3b8abaea3d44d6ac0e

SHA1
f3e200f2eceed3721543b62a752370646d155595

SHA256
1eb34afa9c6a62227eb5a2ae18fd3fdcbe3fd9d748c73fcc01dddcde8b95b64f

SHA512
78370df5cf6345eb6fd798a94eb697bbfdbee1a6f8cc02b132f44d993c718f3ef083fca513123d95bec6a354fd4b4bfe9c89cf6c597f0e1fb57bb414bb15cbd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
f04331c6ac41f0865d07fdeb4b0dfd1d

SHA1
5ba2ec43622032c5c2f64509657c4bc0157eb6ed

SHA256
00fa9de69ac028aa5b15f8d56fb57613754b01fb8cae364749b64c634a990d00

SHA512
01e8f25076726838d3deab33eac927fa88764c044fa375c4e3eb42509083d3f09ed8241a88fe59fd39fb1c9e56356737c2b0da247204ceb06063a82ec00dde18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
ec2185627d47e74aea6bb657897c8374

SHA1
cb5cce406e9567a6ea1424ee0a8d2eeb9de38e92

SHA256
277669b98f82e97e0d625051ca0a26ee74ed164e06d35f39cd49a641a5a3d64a

SHA512
814e133e1f72ae00110b99ec101c92abf32a66afc40fe6f6c5999a1e6e6fea67a29bb9320501d13eb20232abb6358ee5a1c28d8af649cb6c6bec6a75c7d7a075

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
feafa3a602f3c7b085297c679cb9a31f

SHA1
9c6e5f1ca368926ee4e72d9fd36009a1d1107c85

SHA256
284ce9400403786ff5bed570e5fddcf8658f0b50726854ec0c2abd4ad4554321

SHA512
ea2a8e19f8d0bb94020a0dff7b099d09d80361a3dad421bbc86bd9c64a3164ae5acc56363a0fd1fb5215976d4d2376f74a6f7709bc676d9b89b9874f633a7248

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
de1d8e6cf9639c92b412714106bd1339

SHA1
63f0c4a07ea7260e0a664bd1dd6b292a0a186b12

SHA256
23a16817e9c222a1e675eb0f8f959ee45c6697f47eac4b8095040c592016585b

SHA512
7529db9c89bd0b44c08d612909617b158cdcf83a29ba1b3ac3d04a3bc037f2c71a4b63107d4fa47a3fbfc85b4bbb516bf55e5c3049d6c71b842d9e3bf908d5d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
ec722244e0a080d320e40f8b49346fb6

SHA1
f7a6feacb5d973adafc8cdc0f0b883ac2105aff1

SHA256
d688624acf5ab1b8b0dedb9029237436074dc08af9d41225e2d401e4cd5a3fb8

SHA512
8bfba412768e72b684a2d677ec0fbf3165a2e2fe99912b014f5be9c425372598e7cbaa5e48f5ca50e5972ea5c4c3b4b2bed77690e94cd77aa972bf091c2be84d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Filesize
264KB

MD5
e5b1681136456e17a040e074332eb6f6

SHA1
46ce0f723cf37ddd54ba0e2e639c6741ead73acb

SHA256
fd51298a5f8d313b12d9be17ac1878b6c1f0e5129415eda9e2b18fbdbfdb1d4f

SHA512
99192bd38039bbf3bfca60e16b5fbbd543e9f468f94bca5419a171236165ba3e593f08900ad79bab6365969d0268fe6bab9714c544502a497df1c48b624daff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\adb7a7c6-7da7-469f-909b-1d2e1f1de460.tmp

Filesize
55KB

MD5
dff0792fbdf35598525cb8596022c575

SHA1
4af5af1a0c11917e99daa9b655398ed6e8a11771

SHA256
0787cbf46beba55ea1fe67c711a6cdb367ba7ddbd70c2ab8c6e2edbe2e421d36

SHA512
273439fe148d87b8a2ac89dc8c2708fb29d422b97631b5f979d772f83f4afa220e852365871cc8de94e8362794d00e78878d331f1b4345d9bdc84d9df03b5bf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
74e3db391d32b553378f23e746a7eb16

SHA1
8dee68728bd3806b11373007c96644c0807f8277

SHA256
54439665defb15bfd00eacf5ba30171eebc0708a3129cecb6de05ccfec04dc2d

SHA512
1362884fedc2396f7b4aec40b537ff24198b1916901b67cde4fafec164c2aea158dd6dbef17d1939ab5cf3fbc0ddfd6e160162808ad7c15ace5e641052f41ac7

Download Submit
C:\Users\Admin\AppData\Local\Temp\cv_debug.log

Filesize
2KB

MD5
d1387aeefc7a48b8d305b3397d599b8d

SHA1
b3b949f372b3cf5f750ef79be0d3e2a630be1438

SHA256
8b04af97f74a0facdfa726f733bfb2a94ff8b4782f7de2b5d78eaa5b63e257c8

SHA512
3640764f87826c6721ceccaef162ecc93e1bc9dc0302e55d5923247731c70e056e2f1225becd938585b3e6bba36c439246dde45787b4c8ee400f9a7ed1f359d4

Download Submit

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads