hxxps://u[.]to/xD82Ig

Resubmissions

30/03/2025, 03:44

250330-ealqjay1hw 5

30/03/2025, 03:41

250330-d8zvday1fx 5

30/03/2025, 03:37

250330-d6zrla1qy5 5

Analysis

max time kernel
88s
max time network
89s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2025, 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://u.to/xD82Ig

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM. 1 IoCs

phishing steam

flow	pid	Process
128	2496	msedge.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2008_700032392\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2008_700032392\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133877794957470546"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-869607583-2483572573-2297019986-1000\{45992231-EBF8-4DE9-92B0-6FD4A33371FF}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1816	2008	msedge.exe	87
PID 2008 wrote to memory of 1816	2008	msedge.exe	87
PID 2008 wrote to memory of 2496	2008	msedge.exe	88
PID 2008 wrote to memory of 2496	2008	msedge.exe	88
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 2280	2008	msedge.exe	89
PID 2008 wrote to memory of 5116	2008	msedge.exe	90
PID 2008 wrote to memory of 5116	2008	msedge.exe	90
PID 2008 wrote to memory of 5116	2008	msedge.exe	90
PID 2008 wrote to memory of 5116	2008	msedge.exe	90
PID 2008 wrote to memory of 5116	2008	msedge.exe	90
PID 2008 wrote to memory of 5116	2008	msedge.exe	90
PID 2008 wrote to memory of 5116	2008	msedge.exe	90
PID 2008 wrote to memory of 5116	2008	msedge.exe	90
PID 2008 wrote to memory of 5116	2008	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://u.to/xD82Ig
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffb62b2f208,0x7ffb62b2f214,0x7ffb62b2f220
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=1928,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand STEAM.
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --subproc-heap-profiling --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2256,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=1912,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3536,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3540,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4212,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4248,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:2
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=5204,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=3516,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=5136,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=5220,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=5292,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=5948,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=5948,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6088,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=5144,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6192,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6364,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6520,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6688,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6724,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6556,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:8
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=7016,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6708,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=6800,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6772,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6436,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:8
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6792,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6404,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=6592,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=7340,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=7480,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:8
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6920,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:8
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6596,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=7372,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=7112,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=5300,i,17591506617286527436,4367025995385656935,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:3880

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping2008_700032392\manifest.json

Filesize
43B

MD5
af3a9104ca46f35bb5f6123d89c25966

SHA1
1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

SHA256
81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

SHA512
6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
4facd0ff10154cde70c99baa7df81001

SHA1
65267ea75bcb63edd2905e288d7b96b543708205

SHA256
a13534df0cd0a79a3a1b91085a6d575b47d5a9aad7fc6d712fd2616c0e95a23b

SHA512
ad8d2b965851c0ddc23e92ae151b3b0b2bcda850c446f4278bdb0754d6b42ead8fc034b394749578a27b33ad7e4ab0633f974dfd4773fbe4d93ae477f00b73f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
049e5a246ed025dee243db0ba8e2984c

SHA1
15ec2d2b28dcfc17c1cfb5d0c13482d0706f942d

SHA256
33071ca42c472861a2fabd0f82f8b03ef0daaa6796b24b83f3df02587e4c3d12

SHA512
bc5f6fa6a8cae20ab40eae4552650d75f38ebb158c95288a79d9f332623bb507946513c39d19c00a5aee323df01f0f1a51c54594ef1c293289baf45f4ae2145b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\223bfeaa-d683-43dc-8f3d-f891c6c6b28a.tmp

Filesize
24KB

MD5
f98f3862ea8f5fa8bce8e2ff88d50ce2

SHA1
570bd2859a78cd6d80877144a44c7f59b5d7750d

SHA256
70e35e96809bad59d9d4e79ca431c987dcce792305773f13579beb336523d2c9

SHA512
57284c1cdeab5d3e9d42b39c609784807fb58b7b324b2de9f4f86bac9e19d36930b4f5ec4dbe873cc2a888dc43e5fe603a8ed584c0484017fe99e2c50517f8dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
fdb46f85a703f71662833be8cefcff77

SHA1
9fd022fcc5a50487cb8cea29db320b1ff5ed31ab

SHA256
678bfe379b6165ca445aaae3988ad1c6617d1955983dab8cf5f1676ee4d1e305

SHA512
cd4abe328562a10ac1620ed8ce17aca58b766924496aa517070be0e39bf52be040364555842955da6130708fc70f6b3e94c1aba666a03effdb3cd374a0051eed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
7fbd0bc12375da3365b6603f9349f186

SHA1
1fd9a6f3e74407bc6222214155be338acb2b5c74

SHA256
58837b0c601d078886d33c9deef1f0a1cf9b9bb6d1f36f1afe8de2067103f118

SHA512
a2f8faaa5bb15a19a7b23137c5d9adb0c5ed344b4f6cc05ee96f8eb4fdf2e8b34ce4fcdd575bc54becee48023a1a52c05a4863d174ff92ff3b675fbc60dfe9b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57e762.TMP

Filesize
3KB

MD5
6f119bcb0d38419ce58c9373f9102cff

SHA1
53b453d7dab6058782b53f278e7a358998a20c2d

SHA256
851574bf0a058a2346d4b3ef3a34541fa60a15a01eeb12e23c9c8b4005b637d7

SHA512
cbae23d5f41aa78b2413836472dbf5bafb18734bd63b04d2d368d632b42ad4fafeb34abf353d9c203f1c6fc55154e40dcb7e091e38db1a37bfd2eef7cced77fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\_metadata\verified_contents.json

Filesize
2KB

MD5
c7182c4ef7a2cd6a57e48d44bfd4af9b

SHA1
2e1e4746da948d83baf4bcebee618784f8ab209c

SHA256
6f64306515428487987fabde07ddf1646f64ad4e3dc4841e982d40ad91459822

SHA512
d8af16336b66e4f264eda4ea68de4c1763a9c9b99635184d9ece67a9ed69a09bc1088bed254b3d2a8877ba3218e043065d1e4a06c20f18b58d312d93fb84bc83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\filelist.txt

Filesize
134B

MD5
3bf6b4eae5af15288bf0d79702f9cb78

SHA1
b8a052dc4973757ae865661ea0300dea1d27f3b6

SHA256
543c0e50c16159439d3dfb3f1151bc64e2f5b60a0e3824c5f93c4c5c14dd945b

SHA512
25e2502ad314635035f303aa1f0f195c28af91d0b51280e5a4c9310aae65aad857073137196f41a9a2fd7ef96e54ce9b329c448d5acf87b10134168ee7652c0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\manifest.json

Filesize
658B

MD5
2cf796650e5ad5bfb6c4a421d81734be

SHA1
79298d3cdd584b290d825d6fff4b857012e71992

SHA256
fea905b763b26db02673c6ab14f422b21eff64de59351f0818b501dd4e7f9430

SHA512
1ee7604bd7293d6296cf1368ed0dadaad7359f4d00be75e7730a9704b2205438a06ba7361554437b3e6ef352482011a90500769ff713949716c24355ee742e33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\third_party\babylon\LICENSE.md

Filesize
9KB

MD5
e57b8dbca804bf4a2db759fa1a70b3cc

SHA1
8acc131b3698964249b08a0178f7c8c467337048

SHA256
4135d3051e1bfdccf0440f6d8867a6dc1e39587694995479c3e29826e53aff63

SHA512
d2ca91851daeadedcda21ecee4cf7c9244cf21a15709e472014ba6a332a374cba80acd165b2650ce2c3994c7d0156376c22db00fe0c47833e0fca466bcb8c627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\third_party\babylon\babylon.js

Filesize
1.2MB

MD5
e1adfd8f62854c2d9ce65f13268c1ac1

SHA1
d564ea1d59305bbec12995ee43f1c28838e82519

SHA256
b5a426a0769b378e196ab2698c14a326d86ab2443010e16e4ac3cdde06371e6d

SHA512
ffdf74b8bba179c7d5d6d49205b8aebfc7b27395852d05f1ae5de5c23b5dfbd87776f2046fad20b652a7663dacf90da0336a802985bad14ba3591bbfd9ca4caa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\third_party\typescript\LICENSE.txt

Filesize
9KB

MD5
f632dfdde0adc0da86f701c6f2df38af

SHA1
5a7612b4d9977a7e79f60e88df556b09a90df828

SHA256
43692cfafa6a5c09136cfa0138b9c78efeb56ee6b9174553dbf704b888771f6a

SHA512
87722a2d675028d18ea276dcf18c24e891a0bad5f85f7387702310976d2fb8e1d0687321b0844b6c47947e6fbb489fe08bd1ffbe9772955ac7191ba4e274c8a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\third_party\typescript\typescript.js

Filesize
10.4MB

MD5
d931cf27eb964f239e5bec661810abf5

SHA1
1616508213014fa7cdb50e691cf737169019c6ed

SHA256
986134e07f34257fd85c084441c825d7d8951705a0b8c76b0d7c5499536cc959

SHA512
9c2bae1025c1c9579e5e7ba8119e11bc298bbf968aaaaea94f12b8a96155f63bcdbce60deb1445c484aeef3fcfdf96156fc804c2867726617e7b772440989fb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
5fa2cbbe895c8c9098dab195f1f4c5cb

SHA1
51af60c46b606750efe92a2323c391fb6329c6f2

SHA256
62bd2e1e25e645c5e96ff1cca0aeb872e1652003058fd0d2d23f2d0ef738d63a

SHA512
2481affcc7a3c5e5c291f43977498667c25e09d2c5a5fbad8514aa66aa274a669442d49ebe312f23b85bb7b371a1a86e937e0e61ecd9923d5224237401dcd309

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
c0588fe64902be438d976c344fa0a934

SHA1
6f52f0e69916e0613360233e712b72a81d6ed828

SHA256
16d3de522cc2b9bc1a0157aee308f8ea4c885f50dda6db8c66868e3f68d0f9f6

SHA512
56c01e0032fbb065e65816cddda8fffedbd72ce30ecc53e7422dd2ef6fc8beff23598ef228e3b87e1e6556a2b07c70b754a76e412d184cf92efc54655a234b82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
436a5a1abb108647c147b39bd0bf1dac

SHA1
d43de2f1698963648f09fc1de1041d9bdf4f4254

SHA256
cbc7426c6a8f20fef3affb043bc706bf94903d3c315cda32aaf0df1318f74f93

SHA512
a34d196982301cab5288a9324541f9d46853fd8c625147b0f68e002f2a26b3bb940134b74211f7bb68e0f7da87cc0e7c5d9ae3a052f48fc80c7e0bed0cec0fa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
5a39fde39ddc35cf38cee5188de9877f

SHA1
16035a6e7c55df2d72e7e937c3e31aa2ba7f45a1

SHA256
c50cc5f4d674236e229439afb86e8586acce62ac9c8fa9abebf8219165a62fc3

SHA512
3c4b4823ac31458558653f727025a5a2008f20480fe895ee830fcb89edc0e70b3292f2eaa1d32f90593cb02bd3d14ad6a71916f709743f0ea5a86195c5517181

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\41efda2b-fb7e-4a15-b9cb-a26cb928c605.tmp

Filesize
22KB

MD5
56a63f182b2938fbe3e59fbf9681dc08

SHA1
b76578ca24fb20b8bd5dafad4296e5a46735a5e1

SHA256
36edc2510fb072092e4c6b95efe4521857d9dcb7f0b45afdf5e8ef02e5d19593

SHA512
b17246b7c61e26fce1f211311b578d6b3d22c03a042137bb2bb5b23018ce5290a8fbf7a34b2f66fa30b2027296b8a570478f66a144385c320d63c1cef64434f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
e7749efd42db59de006973a6a454c36b

SHA1
a2a76e3db5598058f03903a944d80fef0d9ea476

SHA256
91b274adf071a1df4d33962e9fdf2534058861866da57e1101f47f45d7e536e2

SHA512
c9de7ed78d34676894ef42ecdfd8bc3e378f28c74ccd10b5284388d146ed13ccbb04aa717e03b3368608aca01f9f4132b6f8ac54635b5f09d25ef8d3c0a75656

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
876B

MD5
9c7644db738d87be59c6ef0400e845ba

SHA1
62b1a79708db41ee3dc3459e32017a5f4e876cc5

SHA256
614a9ee869bf81d395891b2b691de04d8b217431adb88967de7d65af7d247b84

SHA512
4d506dcf2010e316cfa8f7f27d2627d123c4f0b79d9feb0c53f95d127f01015a0ff99230988f1edde163f86afb94db7c5ef5eaf653cf3a9d209f36475629a452

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe5876e1.TMP

Filesize
467B

MD5
032e8dbb84492ac85835f51033cd68b3

SHA1
9f6a7a3655b35709738416727833b0891b0ca191

SHA256
7fa5bdb04601c243dde81a617698a09328649fcd5682e5180460dc3dca1bb9d6

SHA512
7de87e3d1bb351ed7b409bbc90ba5e9e0b64109638c0a545040d34ac4edcb8e5b621fb49ad3e4de0a0dced58c2ddf25bc768afc4408d1bff09e8e4d8b4f35b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
825dd67e63bf4f77c839eec634ed8488

SHA1
64b741a437a866d8a97fc87c4c33ab366d762ebc

SHA256
2dec456d03665cc3e0f354c26cd8fc4ceab48a999d0af111e046002d8004a96b

SHA512
92d7a7d4b331b9c085fa36985fc46821d80dcce9dc3a5eed9e94ab4dfaad7063294dc95b903b84ca1cd3e7187b65eeeb96f9c1a8b1708752fdfeb3c358a43d99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
7d5acb0c90dcdefc0125e6e2a111b54c

SHA1
db3618b3a17cdf79cf505fa0586042ed7b348913

SHA256
46ccb79d7e54a3493a0e4feddf0d97bb87c1a504be56f1ce1e31379550765d37

SHA512
23ee85dd054a05d815d33461f349a08046deb8eb052ac3ac60ef7c384f545c556f309c1e03642b60305f58cbfe350128ce65a1e4a06e1f85615ef5bc632d184c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
a008b71903d5e64fc6c8cda773071104

SHA1
5097c1cf7a654868656ed0fa49b2ce4234fdb69f

SHA256
7ae084eba60ef37ff260d6b528b4ccd1a5bd64bb22aece696c30fdb1a526015d

SHA512
b2d8430ee426f301716fc377668fcec75ce5a860916ebb7bff1f836d6013ac6720cece83e2cacb44e168cc7fb16fe3f1ea2aaee13e2b485bd3d4de47567b4ff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
55ded9c383b306b05a45267b8f6cc1af

SHA1
6174d041055d56da5350dd422362c87170c8d567

SHA256
b684edccdcbbb2cf338cbcc38b4a42f6989687ab1059b6676c38e7b841acc90d

SHA512
f3199c3577b91568104527f3f1ec36d70c40f35ded71b50ed94adcbf8a4f5a6610d5166cbfa2022fe760941db55f056e3a623577142363ce990b56641e7c5628

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
8b253957b0aad06348c82b5c8277a656

SHA1
6968f587920cefe77e5cc36353a298d1f9da15eb

SHA256
80199bf27fb169ab3c8653f5241da204c7bc5ef40fc74f1d3250725e37216e82

SHA512
82fe38c8d80f4da6d210f1d57ff4862b9d798d8789419e6fd2f61cf99171db91c81c0ce4523df1aceeea58ff558e03b0d6c7d377d9fbdc97cdf94e8c70e1030e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
0738a4c42902e056011829b4c4384ea7

SHA1
7f78926a32c4f093f29cc7372478ed25831d47cb

SHA256
b5e4ffd3f001dc6aba29db66f6ab4daa398bb103e3ffdf8fbc8aa19c37d15e3e

SHA512
44f8b84d74e3e26a24f4d6a4779f347df532a8c63d835fbd6406481fb347bed520fb273e6113ec150adcf9066be46759e62b90f20ca770803dac0bdf21504993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58142f.TMP

Filesize
392B

MD5
0ff9e184167b67f663679e8b31e207af

SHA1
757a5ec7292a1537230ae3118419c9d7bb11e840

SHA256
0c0a9628a1683ffddbe6859df2e7da0cc00b6a30c3ba45168217716f00853c32

SHA512
48118b9545a5f3e822024246775fda0439336f450510dcb142b0c8293b659790d667634c87e065cfb0c642000fa753f56e80f8d0a8f7ec2b01e69fea911ad15d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
8332c33cb37d6f43f7a2225339971886

SHA1
8212065ed4c9724eeb83d7c7841ffa83329a125f

SHA256
791662d78dffb1243dd105e4663854e9dea392fc56dc32376af3c1dbefab8369

SHA512
432ac71f111737c5e76888fbb005eb55bb8e52fc99ab2a3cb08ab8842804da465189b747dd33e2af28389f60dc38510e3dcd5aaea593185ac7d7b40f0c1bc0bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\58df746e-98b3-4fcb-829e-ee623be77bcf.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\75181ad3-8ec2-447e-a5d2-7c2cd02dce08.tmp

Filesize
2.1MB

MD5
4cd67032e35fa92f5182df10df289906

SHA1
9210bfc66bd808ffcd7c6443e160dc8d6754c416

SHA256
efdad7555293ec2d14399c2c2fc9d07228de1f6e3746b27da621b76fe5ceea07

SHA512
f3d83f6e77e4568d2dae539c95acf0a886926a001b4d80f0ea602387530fc333f688ac031b3057e1c2b0375426cf47ae33315f7da9ffaec601102be0bb7221cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\e58e0034-20a9-4eb1-9374-6df58f7ed3a2.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2008_511531761\da53d565-d7e1-4098-b8ad-2f0e541ca909.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads