8d1e766adade56f9a22114450d8b18ec774d14fa8b4f9eca611ae11be63976fe

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2025, 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9450922a84c12621260335d5c72700ae.html
Size

164KB
MD5

9450922a84c12621260335d5c72700ae
SHA1

ecd29d0124888c50cf8e1b6f4a1342c4340441ee
SHA256

8d1e766adade56f9a22114450d8b18ec774d14fa8b4f9eca611ae11be63976fe
SHA512

2a1a2f0396ecadc5a8b52f83d5cdcbb21a5e123c81e00b6c429ad9e15a2def274e02b0d85fa34bc76e8f83193c3c921392628059e3f3ad75448974e992a59f68
SSDEEP

3072:MoI0cY+PTGpOr7Vn7NjXmJzYHYMl5bSbUbyKtNaU:Mt0cR7Br7Vn7NjXmJzYHYMl5bSbUby7U

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1828_1111648025\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1828_1207081907\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1828_927326523\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1828_653102430\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1828_1795857239\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1828_1207081907\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1828_1207081907\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1828_653102430\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1828_1795857239\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1828_927326523\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1828_927326523\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1828_653102430\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1828_1111648025\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1828_653102430\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1828_1795857239\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1828_1795857239\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1828_1795857239\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133877801135042201"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-869607583-2483572573-2297019986-1000\{4DA17073-A84D-4D42-9C00-88C1E4BD6859}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 4124	1828	msedge.exe	86
PID 1828 wrote to memory of 4124	1828	msedge.exe	86
PID 1828 wrote to memory of 3724	1828	msedge.exe	87
PID 1828 wrote to memory of 3724	1828	msedge.exe	87
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 4132	1828	msedge.exe	89
PID 1828 wrote to memory of 2680	1828	msedge.exe	88
PID 1828 wrote to memory of 2680	1828	msedge.exe	88
PID 1828 wrote to memory of 2680	1828	msedge.exe	88
PID 1828 wrote to memory of 2680	1828	msedge.exe	88
PID 1828 wrote to memory of 2680	1828	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9450922a84c12621260335d5c72700ae.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffb62b2f208,0x7ffb62b2f214,0x7ffb62b2f220
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1840,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2208,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2468,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3488,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3496,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4168,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:2
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4280,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3744,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5392,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5384,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5212,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5904,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5904,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6056,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6208,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6324,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6536,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6552,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6660,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6564,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6672,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=4424,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=4836,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4540,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4448,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5088,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5472,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6352,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6656,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6340,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6400,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5780,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5656,i,10844339441169472726,10119970704118179555,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:8
  2⤵
  PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping1828_1111648025\manifest.json

Filesize
43B

MD5
af3a9104ca46f35bb5f6123d89c25966

SHA1
1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

SHA256
81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

SHA512
6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1828_1207081907\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1828_1795857239\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1828_653102430\manifest.json

Filesize
160B

MD5
a24a1941bbb8d90784f5ef76712002f5

SHA1
5c2b6323c7ed8913b5d0d65a4d21062c96df24eb

SHA256
2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747

SHA512
fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
4facd0ff10154cde70c99baa7df81001

SHA1
65267ea75bcb63edd2905e288d7b96b543708205

SHA256
a13534df0cd0a79a3a1b91085a6d575b47d5a9aad7fc6d712fd2616c0e95a23b

SHA512
ad8d2b965851c0ddc23e92ae151b3b0b2bcda850c446f4278bdb0754d6b42ead8fc034b394749578a27b33ad7e4ab0633f974dfd4773fbe4d93ae477f00b73f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
049e5a246ed025dee243db0ba8e2984c

SHA1
15ec2d2b28dcfc17c1cfb5d0c13482d0706f942d

SHA256
33071ca42c472861a2fabd0f82f8b03ef0daaa6796b24b83f3df02587e4c3d12

SHA512
bc5f6fa6a8cae20ab40eae4552650d75f38ebb158c95288a79d9f332623bb507946513c39d19c00a5aee323df01f0f1a51c54594ef1c293289baf45f4ae2145b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
e995a7ab7c776ba64f91ba5140880a0c

SHA1
347b2123281b98f4de71a6c761be73896b0f74b4

SHA256
d7c59240375739aaabcae7cff08b6f28fe5a2fc3c7f60f1698f8bd5e5eb94668

SHA512
e2edf121dc47bc7151ff8e7f388d41d58b23413ee3829f64993f03ee78da0b523442597b7eb890ce4d4eaeafc5b7d92d2ec987de235117f53853d7d0932e5ad8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b67e40440fd50d9171de5e4b1d374925

SHA1
9d0a59844abfc94f0ffa45b8e8dbf9a999aff5c9

SHA256
98bf3d238e36634376ae6c1a948f205680bb69188f3c0608434e89d5a829dea2

SHA512
317ec14c446d239f1468fbd60f7016ca61b5e9b62677b5982ea021ac35c7d0e5d79d60d67a127bb216381ae44f3a01fb41165db0b88c8ca903abaa3191db7288

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57db1e.TMP

Filesize
3KB

MD5
6f119bcb0d38419ce58c9373f9102cff

SHA1
53b453d7dab6058782b53f278e7a358998a20c2d

SHA256
851574bf0a058a2346d4b3ef3a34541fa60a15a01eeb12e23c9c8b4005b637d7

SHA512
cbae23d5f41aa78b2413836472dbf5bafb18734bd63b04d2d368d632b42ad4fafeb34abf353d9c203f1c6fc55154e40dcb7e091e38db1a37bfd2eef7cced77fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir1828_1544408184\CRX_INSTALL\_metadata\verified_contents.json

Filesize
1KB

MD5
738e757b92939b24cdbbd0efc2601315

SHA1
77058cbafa625aafbea867052136c11ad3332143

SHA256
d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947

SHA512
dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\en_US\messages.json

Filesize
1KB

MD5
578215fbb8c12cb7e6cd73fbd16ec994

SHA1
9471d71fa6d82ce1863b74e24237ad4fd9477187

SHA256
102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1

SHA512
e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\manifest.json

Filesize
2KB

MD5
1048f1f4d861f5c812e5bc268eb68a06

SHA1
4c9495a3202f63fd0878086f27310db6d3bf5be9

SHA256
8b3b5b96a5d6d7c613052b4a751c6632f5f91cb0a912c96e515978999b6f43f5

SHA512
158ca9fc4e59568c8d04b8f6ad16fd8216ee10d8869ce1e2dec844e52d3d3b19bd98433665fa003552e8896a2691531141ee11fef212d8d66283d7002ece8c76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\manifest.json

Filesize
962B

MD5
e805e9e69fd6ecdca65136957b1fb3be

SHA1
2356f60884130c86a45d4b232a26062c7830e622

SHA256
5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a

SHA512
049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
05dd1a848b09cc0ebac9a0114d773c17

SHA1
97b31b44c1a1fd6be4a6b44713dd763aef064829

SHA256
271707a54fa1986ee3683742247c1d185bd4b392ddfd7f4ca4f5f4c81ee4eeee

SHA512
25797b1ff32ca2327caf75b0588afb71d87dfa572741936f311102a95d61ed6ee252443c13da00a1003b4a9837c9a14bd47089e754bd8cc3802d7c8153ac4a3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
051405295b093fb36d0aeae29af5a6c5

SHA1
ba3f1cfa0a6a7979aaddcd8df360ab6417d8bb9b

SHA256
998a1dba529ebaacbd67261f26064da613e10df5e2f851340b456e658bade1d4

SHA512
2aa1863fa8fc25ae98953c337c7e8e0c5b9fe4d8ec5128112d6268cc5daa39a3a8476e4858be441025bf9d6f420fb39278ba506a91c024933b03d5e26917db71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
6a21d333429573d30fdbf636d3ce86d8

SHA1
f893817a9bdfa8eff13807e9f344c6cd13691e22

SHA256
82fb6829f70c1beb9b3d361220fd6553b60f2b0f66903652824a73b483e0babd

SHA512
24888bb6a2b711f4b23965ac731608dfb5eff0d4642df69977e7b3292b11888311f120de81d098e76c79b932c722d42317a1fa4da9ffa3d16a22943bd14f23e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
ebcf19426a1271b7b0f2033ab9ebecfb

SHA1
dc5222cb2d734b509074832fd7352ade90b3a3af

SHA256
f4a50a1fc9888052a0f719fa133379f48814144cd3c5302e2f8b2a98c18bf9df

SHA512
5ef10555c7ce37db82544f2d011d04a6e26e2e95c4ae0cc9a0a07c0b44135c580a599d24f2a50a0fd782c2fafe22ad6fdffaa9d246db1a3d229c64e773131e05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
df3f51e4ee364413dac44f3670c2ef01

SHA1
a49fb8d591497e0bc98bcb5895e75a5e997d9802

SHA256
bc07f219e98272549e0f655a598cdf86274d1b62666b07b63c3f563c49b36d28

SHA512
e381683a52da5ea7d5a4367c4d51b50eccfa719b1e92da0f367f1d35e4bed4390407f8d2809b5e750c03816983bbbb3e8eaa311ab202da6c07c0582aa2d34e31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
ed1e34f3b602065b21c5368b7130a3f4

SHA1
657bac0eadbda993622c4bb4c3ae929f0be99c49

SHA256
e4b68bd2473753cae4fc7f12455751f6399d5ce98cf00bfdf1a980f7c0af35d0

SHA512
05b2706ec9109dc3c94257000f31c4effb43622c0662bdd6d5b54902204866467aba63ff1bc527821fa77501be7cd76f984422d3bd4543e5d369944d19350c19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt

Filesize
65B

MD5
f012cdf7eed009b6531e662c6b34787d

SHA1
b0cf0127db406b6184aa1230ceaef87f6d0f7c01

SHA256
26e78cb8e189406e12ca36d7fe0eee3d0757dcb21dd8c84917e09c50bff3b708

SHA512
89ab98a58175d02e277f293cd9cd021d3dffd012d12bd15f4163b6a90216d6bc3fabeaf18fbefb17b9d007eb734624065a9ce52fa418ee5216d4250c588573f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt

Filesize
129B

MD5
012b14c91da7353092e5551de9366389

SHA1
a5407ab22088c673d9c80440192b3aeebb18c042

SHA256
b2e96c7ec8c30f53f419548dfd192f893ec23f830503add93415fa6962c2f97e

SHA512
f152e9034d9e2d4ace4c576daa533c0d92f448710d12f4150d436ecb4b3ad60585365c8c3a5ced1123ede7f3ac788b92d0fa8b39a79a2593dcd95e7b5ff3c763

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe57e5bc.TMP

Filesize
129B

MD5
89cf0c1ad0f6f642dd29aebf39bf6191

SHA1
1799e308c542ff5a7eb730d82517cb08cdcebde3

SHA256
dee6b29a4973f44bb11249b3c529f683d70e5df2b501047ed404053458c94368

SHA512
83b42be5f07848ac88135de56509c6f3cc8c99c0aca3f720664d2610a247a56fd6da3714c71a81bda6f9f37703c7000c378dd082ae50966892363b2b0cd48339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log

Filesize
1KB

MD5
b1633940a0cf619be47de42e1d94f0dc

SHA1
0ffe2c8fc94c158b5d39bb9a6efb87c2e6ee82e5

SHA256
34c78c512287495f60cfc3360b93d765c8c0211893307c164a267f8bc5a4e30c

SHA512
bf4c90552030c89958198b9b8d98fa8acc047d328984905e333821a11c5edee9f995434baf6e78c847ca1e0b2b86c2b29970a2544aa939aed4e4a58959236b99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
ffdd8f6657b2e9e444ea1fd33cf67cc9

SHA1
41b58217eb1d31279c373f80ccd3632c310d057c

SHA256
2a25ca0e2f98ff028ba86412374d6f57e1f713d1c316d0140e98dbe476dae54a

SHA512
61c34fcdb33af1c4334321c3545b50978850d05c35b449455b95f9352ca49048f4e455b8a82fa61697d78afe6b698c8a5926aea49e20feca0ba00e088ce59432

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
876B

MD5
8fd2c3353e83257a1e9cde0168ca3d3b

SHA1
c0fbe922d8ea0a6440ee1dfb6fd5324d53dda030

SHA256
bcd523e9b3c861f45ffa0e5008cfdb65627dafb0cb9088dfb15473d4471719e1

SHA512
e1382bca2950500f51df10017e836ffdfa10279d9d536d6fe59682f88336f85fbe72635d09209c31ddac47569a677c16902754c198e15e9bb509fea28ea397a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe58774e.TMP

Filesize
467B

MD5
1c1fe1fa603d68ef8495b8d9ed8f8ab9

SHA1
397135a622d43d2030aa385e063b7632dc9a3257

SHA256
b2df3c21ee650ba4d8a17637df42a309d0a87f0fedb0b99ceb96350da4f6afa9

SHA512
148634a4d56820cb8b1b1d56c75eca84b0c35757ae8d69939168ff6104ec49b2a89e7a1620f7c7d5ba4f620451cd47c56cfec4d71a3c813ba8baddb680903c30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
56a63f182b2938fbe3e59fbf9681dc08

SHA1
b76578ca24fb20b8bd5dafad4296e5a46735a5e1

SHA256
36edc2510fb072092e4c6b95efe4521857d9dcb7f0b45afdf5e8ef02e5d19593

SHA512
b17246b7c61e26fce1f211311b578d6b3d22c03a042137bb2bb5b23018ce5290a8fbf7a34b2f66fa30b2027296b8a570478f66a144385c320d63c1cef64434f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
3KB

MD5
c7569efb2fa9fe93c0ea2f0896f54036

SHA1
e231c700b778b624f6065b035e5803fdd8b4db4b

SHA256
2422f055fd21adce7a027c3eaab1bbc474345a26cb1b9762b3d7572ebde67d3f

SHA512
c394da9a75cca87f6e20cb2abbc2e087d3e374b613bbc960f255ebfc8f01d4349fc8a487ec56ff8141f47566cf021dc33196e42b6295ce5399ff78e5ce4b066f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json

Filesize
3KB

MD5
94406cdd51b55c0f006cfea05745effb

SHA1
a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9

SHA256
8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e

SHA512
d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
bae71f746021ce552353e213aa94ec2b

SHA1
c976af38f1b6d12239be4807f79025ba4e6e67b5

SHA256
057905fd261e705d46c5e9d2117173bdbc6cbd245e48b2dbcd78f4e4112ec5b0

SHA512
1f9ea4a66791fcf2fb0cb4e72efa0ae5918775d162cdeae69fe12445ce73da352d8c24e1a8d5be70322585c8d72b8ed6049568c6c6393687ec20be192afb182a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
b87ba3ec85983e6c3eb3bfd7fc5c65c9

SHA1
9acf5972dd7981c0e5eb998a63547c1f172f175f

SHA256
095be3d4778a3c7bb5ffc755ddb0bfc347c26cb3ac574f196df6c6ec26887812

SHA512
2eea99f6ffb86efffaab44b24045375f22b846bd8950590778fd14ac638c6b78391a85c2dfc6bf61dbb0a6824e7064387e7d13d8f01b4c78224dbe37c732f243

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
34KB

MD5
72b37436649e48606f1da1b3aaed2732

SHA1
c032ca9589c599d60356cd386ec8077b6df70359

SHA256
d9e77fe2673b5047393b945b2d7fea42da2af739ead8063c3694eba516a7a919

SHA512
f6a6c3d5bbd9f6f99a6fc2e182f440c3d2602394dd1d4d742bafd6e70fe1a6b670b9fb1eb5fdc0a1b5730ad4663cb6e540f472352a63e0ab876da787a44d3fc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
9027398942a810de0fd7a995d5fff535

SHA1
24a70cb23341b58fafbfa7bd1c882882a8ab7bb9

SHA256
4a650cdc2803305efbc977168a0c7a4ccffe19b0aa7d7252fa612e688158d94f

SHA512
ab28ee475c060fe98942c8424b55a60fb4443b0c2b80a82b920f80d6ebbcc280d2f92eec3919191d7b260ee4fe393a6fa7c83ad0e739f115a20d60c100532412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
c903e7694b7f62cf16250c24d70df874

SHA1
5cb62da1979abb527b3b4e47587ca2400497b41f

SHA256
3721ab485a9572801aceba6d0aeb1bfe9b8c09c6e138b6b32b3b1f4811083330

SHA512
7a41b948fa4f45db9791b45df8e27a7f12a609ffa4a21db8c350bac5e89adf24190b4985fe910e35edbc4d0310cbb252854877bdba63bcde8c195a507f82cec2

Download Submit
C:\Users\Admin\AppData\Local\Temp\26870001-34a1-407a-b20e-231b9c84958d.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\5526a0de-faee-4235-879b-19f1e54b9b33.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1828_1067140429\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1828_1067140429\CRX_INSTALL\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1828_1067140429\b03bdad8-457d-4071-a64b-b415c62af046.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1828_740184255\CRX_INSTALL\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit