hxxps://drive[.]google[.]com/file/d/11G7JdJ_Y26kuXfQgbVTF5Nkx-ZbjUoUl/view?usp=sharing

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2025, 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/11G7JdJ_Y26kuXfQgbVTF5Nkx-ZbjUoUl/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
275	drive.google.com
276	drive.google.com
8	drive.google.com
9	drive.google.com
13	drive.google.com
39	drive.google.com
246	drive.google.com
247	drive.google.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1007157472\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_647523199\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_893085232\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1128893627\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_893085232\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_893085232\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1007157472\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1128893627\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_647523199\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1639141481\_locales\sk\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133879276955652509"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-308834014-1004923324-1191300197-1000\{872BD9CD-5604-4660-B88D-5393EDAD4AB2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
432	msedge.exe
432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3740	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3740	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 3280	5016	msedge.exe	87
PID 5016 wrote to memory of 3280	5016	msedge.exe	87
PID 5016 wrote to memory of 4384	5016	msedge.exe	88
PID 5016 wrote to memory of 4384	5016	msedge.exe	88
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 5480	5016	msedge.exe	89
PID 5016 wrote to memory of 464	5016	msedge.exe	90
PID 5016 wrote to memory of 464	5016	msedge.exe	90
PID 5016 wrote to memory of 464	5016	msedge.exe	90
PID 5016 wrote to memory of 464	5016	msedge.exe	90
PID 5016 wrote to memory of 464	5016	msedge.exe	90
PID 5016 wrote to memory of 464	5016	msedge.exe	90
PID 5016 wrote to memory of 464	5016	msedge.exe	90
PID 5016 wrote to memory of 464	5016	msedge.exe	90
PID 5016 wrote to memory of 464	5016	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/11G7JdJ_Y26kuXfQgbVTF5Nkx-ZbjUoUl/view?usp=sharing
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x218,0x264,0x7ffa0301f208,0x7ffa0301f214,0x7ffa0301f220
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1840,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2392,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2632,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3472,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3496,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4880,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:2
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5236,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5536,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5548,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5968,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6452,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6452,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5488,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6200,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6552,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6564,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6504,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:8
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=5604,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=5784,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:2
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2620,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5156,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6568,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6036,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6876,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=764,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1236,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5476,i,10344483272434240405,12798184187970842844,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:8
  2⤵
  PID:3040

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4932

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x40c 0x508
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1007157472\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1007157472\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1128893627\manifest.fingerprint

Filesize
66B

MD5
496b05677135db1c74d82f948538c21c

SHA1
e736e675ca5195b5fc16e59fb7de582437fb9f9a

SHA256
df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

SHA512
8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5016_1128893627\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5016_647523199\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5016_893085232\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
01cc3a42395638ce669dd0d7aba1f929

SHA1
89aa0871fa8e25b55823dd0db9a028ef46dfbdd8

SHA256
d0c6ee43e769188d8a32f782b44cb00052099222be21cbe8bf119469c6612dee

SHA512
d3b88e797333416a4bc6c7f7e224ba68362706747e191a1cd8846a080329473b8f1bfebee5e3fe21faa4d24c8a7683041705e995777714330316e9b563d38e41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071

Filesize
38KB

MD5
f53236bc138719b68ccd1c7efb02a276

SHA1
26b7d3eea5d3b12d0b0e173ebf2af50a7d7e56d6

SHA256
787c14f8cc865430c03c96a345044b7c5b8dc8a032511a500d4a42228533acd8

SHA512
5485bc7ccce8ec75f60bca3be846086a4bd4466009c8e22da9cdd16bb1154529af2fb2667cd3a97485cc4f6635fb79ac0fdda4f3e1f39f25f6196f708a92d740

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
8c620266e6cc5227e7f2084f4011123d

SHA1
1658315ece5f3604d461890045c3a61a38e80a3e

SHA256
45872d557d42a3dfd09cf519a98a0bda6d9e252ffffd802680668b56a0057500

SHA512
d76d960e2aa4aaa4024eb15b67894d7324dcc97745a2c7010be18c7c69e2d37aff5c70236d986c5c5b3e3655e3273c04654ac6ff0051b68d0bbe4fdf3be0673b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
079d6da6a16b09459e42a972bb2f983f

SHA1
ac935bbace5aaaed4e7ffabb0d928ac06599b8ca

SHA256
0a8987f0d101acb3491e0b9344c45c56650edbba3003496561f1d567e9bca7e2

SHA512
76fd2c018054d2c0b81538cfe41ad3c4c96ba25aa3826b1cf4b8b54dd4df576158a4971cfaa96859e0014c35690af7aa64ad8fb027423500ec0eb1548edb483b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe580f2e.TMP

Filesize
3KB

MD5
5e991ce1dac785e7eda036987318a225

SHA1
51e14c3b8f887014d8ccaf704b6468d1adea9f17

SHA256
9a3077b27ca8294818433425d32470bebb4825d662843440622588ddaac60edc

SHA512
0910a170050206e7bf5b260d7eb88da7e785de25a8516760f637e8978bbb7de8bd1df064d38338520f4456148674d86ee4fd370aaed7dda042adb66c5a66c9fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
f3ecc140d0713c9c8bdef3f19d74d397

SHA1
c69dc39049240032c71d2cb4bfb3c392ee58e780

SHA256
c41838b033f816534a61145cdeea8bbddc0d9f187ad653c671349565d32a482d

SHA512
1e808964f2c229a3768b6405aef14e196f4f4e75bb870e0fe546d88be1233f8f2064c66647369d3654a7e730d5054763b483948999ed544fc8b97c59566ba107

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
f019680b58f28a4731c5708b428a6a1e

SHA1
514337ec9330486e41da5620e2802d5aaf4300f8

SHA256
ed1fbd987bb7b59ef68554ff5a52890d7a8427ee6d6d57d40857a2131f6054ab

SHA512
bc9a98d84fef8e466614cb7ca209134804806d92859bc92e8c2af472e399c993b423c74d62127098ce3e6aa2792d441aad12f0636f0e47cca461c4241aa82806

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
a3f598dada12907baa7d4ae6b4cbb3f9

SHA1
27884bf29f76113c6f16f9fd45d79c9213a326af

SHA256
2f57e4a1ab36731b561799fb9e4371bb7d490e1fdf5c4d0dbdc566cfe22187d2

SHA512
029e326bad2334091ff8da8722db4e8d2f1b2cb52dc376b51768c078bc6417c40f5fe85f7c177b0e71145fb262a75aed7145db2998985459f6951ea07470760b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
254551077042664c7bb054de9d41eeb7

SHA1
19d42d0ef5c0de6c3a7446002b1e9cbb3a9b24ab

SHA256
992839b8e69f5da7524c91599b901c3a1c0616d12ef8b9c59b6f18ad263e9189

SHA512
d0f1b5da651e15f60e33d93f3efd27948c8792702e1faa753f92a11603ad02fc714f36ac23dd6b942129540b1420509a4157d01fdeacb14cbd52052a73089f8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
39KB

MD5
45c3318de5c4318c577a28cef1344cf9

SHA1
36f1beeee5308c0be613910fe9bbb28946431fd3

SHA256
719363ee91ba87da7660ef7c0ca37e0a3b4b13756208100975a8b4eb52d157c6

SHA512
b0720f7f16ef1e241f4de425310d5af873d463c864bb3975e951d38fa673d99e605e1a57fa2045268df6735330dc6c9a8ef44e57034480b54e1fb4137a05d547

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
11fa6cd0bd33910527f8b26379519640

SHA1
f9ba0323dc3de27c4cbff3c7f238baf17147f4d8

SHA256
aa306fb845b2626bdd2203b87c971dec548e6f711064286bfd0414e668d84530

SHA512
8387c3b3affb5fe835e7fc133b6990e9261a4bf1e46b7d1abddd5c1745f39970f2706f5befa58b400e92b6c0770a0d4f2fb6c63835304158b9603851837b652b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
bb67240f940f3a1a6336c2d7d89a4db9

SHA1
71d41194e768d2092145db397a6e33caed035b78

SHA256
5c754c6eb89d178ac5431becac1206fccc2a0ded6c1f1f789e191a14cf12b844

SHA512
2d58301cd0666d4a5dc3b9f9f15751e54627a728986494cfba733635aaa6072f18e2caf1a8ccd9a9f3fb9cc152ce264b0e19c27266af622b8ba59b58350a423c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f174.TMP

Filesize
72B

MD5
9fdfff424375003c9720b30a9fb8dbeb

SHA1
be9050cddc7b53ac45627fa996bce61943496b41

SHA256
62cae94c40823c21d6da6c91ebbb7700257b4ddb86371fb3dfc79b93d7a3ea6e

SHA512
0ccd0b8cf36269b206a0939c70c82f087a52944be83f3300cf4a1932d3bfcdd8dd47a3003ad13bd38a65782e935ea1ffb8bfca80bc20c32b2205e5d894b5e128

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
23KB

MD5
337182d7e0e0e46d503acd0161ad443b

SHA1
3be01793ba81f9492413a5f86c49a5bd797bed5c

SHA256
ca6738452c161800f8737311c5563485772d3bb199d4ee140949d7bbd36c0534

SHA512
78856e87961e509afa1fd4c2c3eeaa812ed1b8df8747339c10f1e65a810db016919aaeafa3a89a3bed4c951bdda25da3a827772c24ccca7aa1c204c70590f622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt

Filesize
90B

MD5
ad4845e49f7c87b0d1900f13ff8fe80b

SHA1
dddcb82be4e688ee54f666114ead955e23f3cbca

SHA256
e9cf04bb9efe08c5d949188f7d07c1003209bd4decd95895fd60fdec80b356b5

SHA512
74169b9c4255bc514d834b2c3f4f1ac453c8bd89466718a8682b35cebdcea4b6617b34ba96db7d887657875efbc231f896ff2d90eace7367fc7f4777b6b8f469

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe587441.TMP

Filesize
154B

MD5
25d6f1132589f4e14d559f3f81945bc8

SHA1
3993c7d31170f1294724ae153978bc8a92e55fe5

SHA256
84fd8aa6a3fdd29737d47801d82de546924eb92c7514028910de0b6f13a2a60a

SHA512
3458b3ecb32197635150e4de49d5e789e185d443fcaed52db06927565ed90f692143143c8c1486b0c7fbe38cf535fbfc526e71a28041562a7d0e679f3efcdd28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
34d0a3ba682282be57f69348587e0daf

SHA1
658022194daf2e49140c5989d3b7675fc7a8ebcb

SHA256
5b4d7d06e48263f96a29529d7edfeec1061603c62c78061f361485963b5d1124

SHA512
13f32fb0d2e22488bedc25660199ef3bb901db00c16977332e71c314eeaf62d3521e96612396932128f6c6783441c38ce66a22a152b9d429583381676326ea79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
ec19cd67c5be2d094e40996518352339

SHA1
8f14a354548f7458be88305ff8ea33dee9f20b99

SHA256
0c465cabf7e6162b87e8367ac3d10035fa424afcb4e26559667aa022f4eb7fa9

SHA512
14ae5e58db00fe12ccf0a05cad55b8b4ef0f602c29ec00051526ef4e6d9339e80288c3f19c07e39de66d6e47f34acc4ad9343291ffbabc8dae9a2d8375143214

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
fed6008d446ef325be66d48f249a46ed

SHA1
771bd11564f4f4f623b9c446bdd97812133741a2

SHA256
1f18b4f57bb95e9368843fd15774e0762c2a63791992f4d24d26eb51a9230010

SHA512
b6c5a095f335fc8143d7956e0af9d2de7fb4f967b131d336edaa92b4a8bd62a5732e0db5f8d1d39689b553bec56dcedb6762d57791bad9b22b412dcd18c65856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
1f2f7166535e85d7d474d959c1c22a93

SHA1
31ac854f16466ab689116d7e0dd69f08c670a9bc

SHA256
e71ec706bb9582bcd35151213320ff0ec146a02beaccbb43d504bb9f57845d82

SHA512
aaac9b769f17e127074f873e9d8082cd636a9d6f19f73361cf69b49ebdea0e0c329a14d6cdc76a126f334ebe3a7b11019d059f191390850df07e03e89d72286d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
2f06a1d0983696d9b922eb5d0c3fe8d2

SHA1
a858f8f2ab4919dd3c432ee0f8deeee7c7adb3ff

SHA256
ad52af053e36f4087ad63b887268f3ad923c234927f920120ec56ba986bd3499

SHA512
19dc8e4db2d68371c5d9e6d77ecb19a847fcbcbb03719a8e606da7794a5caf24ba823fd58b055e8b2b2bdc65e5d09d56a6689b2384ccf75db17031e0d192494a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
3f5ee06e364432cafeedf0b5d50949e9

SHA1
8e4a49effc6fc86604121a6a5d2f60384dc6d6d7

SHA256
c74fa9ead8f11eb23154d634d4ea54400be1351f28b2f0ec901ac021c6dc305d

SHA512
8b2204754bd9c993d0fb071a4a92bda81643a5315a568804422cdc626ea37ed7ed5c1c2aae4dc5ae05e727f0319e5295f99aa02994068b1fd8077f4eec7c84df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
1c4d65c4b36a0cc7ae2979b6f6e1dde2

SHA1
3fe2153c4f22b0daf209e1339d95da4f950e53d5

SHA256
3be19b44e37db380a60e62c29b2d4538488082796a89b771aecbe05aed2d4f95

SHA512
132550b16f70170dc3ba595685bbf5de95cfc1756c8a0f85fdd0c5c31175114ec59d919762ef380cc14fa111a94d6ed801c569849c7bf29254a60391f47fccc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58b11b.TMP

Filesize
392B

MD5
1af12df8d89cba26eec3376ff8501b8b

SHA1
17d56e57ad66eb7d1447c3e6701becd0727e8f2f

SHA256
bdaccb30cfe5f18c17ff22be8b7944fcbccef6d8ecb35127e537f9042f744018

SHA512
aa1d7e01f99bf8d5aefaab1cd500c28dd3a7124700b18d9c55143eb12bdac1c44a927bc15102e3a27e15af8a67d1bf2cb0daae9eab07f410216f439f5e802fcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
38b8d3eec6ad45066f71bdaa5d0ecffd

SHA1
1a5821acefd3842c3dc24e4563ce14705f848950

SHA256
5b7a15040fcf6883bbb8113eedcaf6d22c495889c6e9a7a30a1701ba19841866

SHA512
fcc6741a60c55fd22fa91eb5559caca3e045ed4ac951b918ddcdeaab164868bbb248718ff58211d830ace4d061581d82fd7785dadebdc0b6990a01d43f66ab20

Download Submit