hxxp://lockbit 3 download

Analysis

max time kernel
870s
max time network
527s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
01/04/2025, 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://lockbit 3 download

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_627971694\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_86214941\keys.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_502273374\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_1073788952\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_627971694\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2041819102\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_502273374\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_86214941\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_502273374\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_502273374\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_86214941\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2041819102\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_1073788952\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_1073788952\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2041819102\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2094741263\dasherSettingSchema.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133880147058488048"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-976934595-4290022905-4081117292-1000\{088DB294-00F5-46D0-9042-8BE3FB795AE5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5404	msedge.exe
5404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 3388	3896	msedge.exe	82
PID 3896 wrote to memory of 3388	3896	msedge.exe	82
PID 3896 wrote to memory of 3276	3896	msedge.exe	83
PID 3896 wrote to memory of 3276	3896	msedge.exe	83
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 2308	3896	msedge.exe	84
PID 3896 wrote to memory of 4256	3896	msedge.exe	85
PID 3896 wrote to memory of 4256	3896	msedge.exe	85
PID 3896 wrote to memory of 4256	3896	msedge.exe	85
PID 3896 wrote to memory of 4256	3896	msedge.exe	85
PID 3896 wrote to memory of 4256	3896	msedge.exe	85
PID 3896 wrote to memory of 4256	3896	msedge.exe	85
PID 3896 wrote to memory of 4256	3896	msedge.exe	85
PID 3896 wrote to memory of 4256	3896	msedge.exe	85
PID 3896 wrote to memory of 4256	3896	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://lockbit 3 download
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f4,0x7ffa0083f208,0x7ffa0083f214,0x7ffa0083f220
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1920,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:11
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2220,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2532,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:13
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3396,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3400,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4788,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2908,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4856,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4840,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5236,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5332,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5332,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5560,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
  2⤵
  PID:5536
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6036,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6076,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=5824,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3628,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3632,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3660,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:14
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=4824,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5516,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6128,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5864,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=5132,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4888,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:14
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4652,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5216,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5744,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3940,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6092,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1040,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=5576,i,3739951701603567025,5499350242794208615,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:5256

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3a37e511-28f7-4274-9219-6c6b26fc0e35.tmp

Filesize
50KB

MD5
98d513de1a7b2971fda7739fb197e70b

SHA1
5b3075822aa9993c8b4f205349c962be7712ee17

SHA256
cf2aac626dcbe941cd3bf8d36ed305bcf3c3e976236aba65d3685e21ca6630fb

SHA512
10d9dc63471fc126a7ebf983b569e2dc17d12ce74ce5c208eec32084d90f5aa6875a76ed2237a9149fde5beaaf40557b2b421fdc1e91b8d7b91b05ec3ccf6d8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.15\autofill_bypass_cache_forms.json

Filesize
175B

MD5
8060c129d08468ed3f3f3d09f13540ce

SHA1
f979419a76d5abfc89007d91f35412420aeae611

SHA256
b32bfdb89e35959aaf3e61ae58d0be1da94a12b6667e281c9567295efdd92f92

SHA512
99d0d9c816a680d7c0a28845aab7e8f33084688b1f3be4845f9cca596384b7a0811b9586c86ba9152de54cafcdea5871a6febbee1d5b3df6c778cdcb66f42cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.15\edge_autofill_global_block_list.json

Filesize
4KB

MD5
afb6f8315b244d03b262d28e1c5f6fae

SHA1
a92aaff896f4c07bdea5c5d0ab6fdb035e9ec71e

SHA256
a3bcb682dd63c048cd9ca88c49100333651b4f50de43b60ec681de5f8208d742

SHA512
d80e232da16f94a93cfe95339f0db4ff4f385e0aa2ba9cbd454e43666a915f8e730b615085b45cc7c029aa45803e5aca61b86e63dac0cf5f1128beed431f9df0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.15\v1FieldTypes.json

Filesize
509KB

MD5
c1a0d30e5eebef19db1b7e68fc79d2be

SHA1
de4ccb9e7ea5850363d0e7124c01da766425039c

SHA256
f3232a4e83ffc6ee2447aba5a49b8fd7ba13bcfd82fa09ae744c44996f7fcdd1

SHA512
f0eafae0260783ea3e85fe34cc0f145db7f402949a2ae809d37578e49baf767ad408bf2e79e2275d04891cd1977e8a018d6eeb5b95e839083f3722a960ccb57a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
623d0eb0c4a36135a270354557aae018

SHA1
864d2599207960d2aedba50ada4a3b1b2a5a8b87

SHA256
52b485675b621aa85ff48f5cef95a29f845616b63d9a683bb7503f324cee3d03

SHA512
685e69631c295fee7ddb6bedccb9ddab7ac0fd5d5476f5236ee22d7b8af871f9705be8f30ec71b0bfdeabc69927be677942bf8bfcfbdb7ed1151e7dfe80105ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000007.log

Filesize
21KB

MD5
c3810de61fd606ea0db332e7b1ae4e84

SHA1
12ff6758c1a785ac38e24e244749730b49098e65

SHA256
b3df081788710f25f3b0b8f1e9a17989f7dd49db66aa6e754fd9476d9648efc0

SHA512
00b790f4408c765cac5ffafba7c654beffbf672702314271a1db3a4c3d666d165cbbde37140ed5ff25058e67748ef2c2ca0535dacefd80c655e14801703695c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
2c87fbd8e69526abe08edca9d837ff5a

SHA1
c951842cdcf2496dcd3dd6c1ef48e6be417b4907

SHA256
f8cf1eea6b9b47b139d4807b609260232cb18728098b7fb7c52e36f75e9d3722

SHA512
fea202e42f0eacaffb9a5b5fe7a7b27d99d13638915899a2960d7f9d72df9d95079e06d429d7c6d622d1faa7dd59c527b91e83a00224533647d24d91b5c9fa3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
304e62075cde12d49b6612e5db1d645a

SHA1
e80f5362aed6e312074a48cdbc28dd5d48a7566f

SHA256
51cf5eecf1c71ab970249eeaead77626b8dec191cb6c412d2899ad62369a336d

SHA512
7f2ca91836e2978e49d46446d455c45c829c6192523839ae225399cb035309bfb5e8d533e7517a1033dd4c2c83a6c08fc99ed91b18b17e61a9136a7c786a0948

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
b856a8a397079b7f94ad6294b82d97e1

SHA1
af17c68f12fa693c64a5b73c91b3a5093e0c5b6b

SHA256
b1a49069b60cb856610b45114e5d6fe5357c435bb7a9ec536abcd74cea529873

SHA512
4c052a6e1847d1ad9ea3d81db4e419f21fdc3e8483f24e4be0f4f347687b7cc8b62ec87caceab0e8edf4d0ba5a6ae40bf2931eac666def703aa350ca7d07272b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
10a9325257c0ec47c89ba709ef0ce2ab

SHA1
a0c830d918f2974dcb5c100d6f6a092970c816f4

SHA256
b8690b5bedfb9e91351353f57720bbd0b68177714d76c4b9b9249249ed009a4d

SHA512
29eec0a18c0d2b907d34a0989b38edb82f9f97d10a55dba9d4c4e97489ab342466a7345553bad3c55c3cb25499c93372c9355f12508583a2875420656e42ce30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
0ed322c34336303fd2f108204d51d124

SHA1
33d471a1546a07574c9ea8aa17f5cee9436b7133

SHA256
df0011c3e9e245865a7f6d29e9f90b7c04e20b5721bd62d4aa11b24e1af1a935

SHA512
e5d9673aefa1a3c577fbab77e7a0eb67d52d2c1514af3cdab5d97209cf85bf169edd239cb055dcbd41c76b3a8796bfa3cae2a4afd24aa15483d53421e4d17d61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
c3cdf5ae908e7f38fd719ea381ede767

SHA1
2d1d04559550e5c1f7cdc8392e5c7f879d17d32f

SHA256
87bd2aaccfc47ba5dd577a04ef1172fd146ad023d7c7d7451a24a217ef29d93f

SHA512
892ece0379182fabbdb0a3a1a1727127d9ab2905edc02ad0d4e216f9f7bfc9cec3c761286ba9c9e1330cb926fc23b897920d03b86c90681a1a5c1f8f8301a296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
e778fbc6f28c8cbd7a370290d8eb4b7c

SHA1
5bedc020053840950b4ede45c1ddc012442b400d

SHA256
318fdd5f1237e5ef59e81ddb658014c8cafe979c2eaf3ae7f0da1af3e656b594

SHA512
9a3fb254a828689a8abf21e638d38b18e4d1fdd49217a7f171f4fe099b2fbc072bfe00a87a7d38b836e0f786625f2ad321c97afe6e2500f171ac6948acd1e79c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\be244aad-7875-423b-af87-4ad8c3128e20.tmp

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
e132b07ca5fa386308e7c9ee6935504b

SHA1
ae93f09e918dad250c50fe5c9403690f37932de7

SHA256
af93ce7447ff799649558c3baca5e68cd2dfa2f840bb21f2a58b8fc7041ef58c

SHA512
e767fe3a4651a78e53823bbbc83f6377423a25f843fbda1656957c874976a09af765fdeb8dee313d5a497ec50fe2d507a8775029f813d3b1b34bfbc099bf197f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
1aa38da51379cc1467228093c7d1a716

SHA1
97e3a65b34b9b02a5062c7bce6b499fa91d28d87

SHA256
74845922f83205291edbb19949917502f4af7587a324b094ea6ff2a9a7117ca5

SHA512
d2b00326966a42bd0dbe14047bff0c0b504d41d0e062521af998e8c21496b825a3b7281e3a3314b2d4415be686b8b6283b224bd10fb0fa0ed0f1081c0112ca47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
02d49f042612f4f4552cea47418eb986

SHA1
6e93722e2f7ed390e8aeb84f0c3ad8938b350ae0

SHA256
6c03b52f55f3cf17829262f723dfcf4550281e015823b91d0c9c4983092174a8

SHA512
46a70614f63e02bb49401894d661e0160b4fd25a44019e09bd2e863ee96533635c83f6772114a2a259c00531a3c8b93d282687d1c982b52eea3b37caec8d4649

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
ba4743e63d6574872760eeb31d4e2caf

SHA1
63936a7c08960d5c094c9bf78e02e658799a0436

SHA256
463098bc28b41df0bd1b853bf3e6ed84f6b18aee59495d5ba977b52d44ac23a9

SHA512
d3aac229273ab09fda088a80fdcc8a18944e01beaa4ab8334f4a8b273fdf75776aa79cc69d45a8db8e37e76bb4d49d905263558fe35a9b8b40fb9cf233d2485f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
df58cb7045f0148a258e267f06417f38

SHA1
9ac6f1e07051e6f433b17f530b3f9278320e09ee

SHA256
ca2d584496abe4b958410164394bf672bb60dacd3e83be9c2b79b2592691c697

SHA512
c2db169e8c092794394aacd020cdcb245325a1387d742730b094d2d12d393a084cbd304f95bb823165f74476d7267ab1b068d80021218572bc1ebc3eac2a374c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
a63ae59e27235385c491d53163a5f972

SHA1
26d50c5434ca08031e8693bc3be2801b741c5492

SHA256
9ae2883816222141944fc257b401d9f6f1712bbd7d1eb54bf1fc96eb439c5f8f

SHA512
8d7a6086041a10cad7d557a4622d5415455cea2737c3805398d537973cf097070d7241cbd68a49cb8c6252d804934e9cc52f798be369618353d7e915c10ff139

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
3ac342ade5fae676f1121cfe9f514353

SHA1
6923d88fe60f194d4e053472a9e6817d8680ddc2

SHA256
1bd6b56d97515ac731be1e97c579004a3ffe4eac42959c9419f78ec92e714c3f

SHA512
088c4a3f963d78a15a6a66c2558e5a9453cf5a102bd791d50f23223d86fa8551523521cb44fa5ba6e177196c41d9487abbc6bd9a011f470ff066d480d75c0247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
5ef70e426e3ba6e5ec08dd1c62f64bcb

SHA1
0671620c3c69228e4259b7f237047beb6ead3822

SHA256
3577fcd894d0850826f09305179f56bae61cdb76e6958ce57db74afbf3a09f4d

SHA512
b4a2e0aa9d90d431b8af385b2e270376fa49ccbdcbad1842ab4bcf40994be030fe428af1062734fff3358b978faef430695eca2b98dc3e5ca69d27be31ee2dee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
a6530175273a40afe97dbb2e2ddf3c31

SHA1
c1a80d7668ca6c06b4c62e49e6f62748e1f3f890

SHA256
fd39194fa85d4a6636520e987e909fa1869401be20f49fad587237129379a9ef

SHA512
ab3a04ebb2a4e59f229edb2bea365a5795193152d536ccba8afc5171d7cecd3fbb05f77a8e9ae46af88841811737c6710bdaef90db3b4f51ad7861182ba568c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
d0f83389ade80feef784d5098efecee8

SHA1
923c8f74c085634853401130e94f35250141524d

SHA256
6ab0b8314f41c01fb7e552a9743f842dc283579c88a5df95cf25c9815ad08a5d

SHA512
424b1090f163a620c36a49b88c5e3ba1443c58a470c0a351c9db02f1c26f33718ecdf48113c924374ab17e5d2ef51bd0545ab4397ec10204a669cccc99e5af5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_2041819102\manifest.json

Filesize
119B

MD5
cb10c4ca2266e0cce5fefdcb2f0c1998

SHA1
8f5528079c05f4173978db7b596cc16f6b7592af

SHA256
82dff3cc4e595de91dc73802ac803c5d5e7ab33024bdc118f00a4431dd529713

SHA512
7c690c8d36227bb27183bacaf80a161b4084e5ad61759b559b19c2cdfb9c0814ad0030d42736285ee8e6132164d69f5becdcf83ac142a42879aa54a60c6d201b

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_502273374\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_627971694\manifest.fingerprint

Filesize
66B

MD5
496b05677135db1c74d82f948538c21c

SHA1
e736e675ca5195b5fc16e59fb7de582437fb9f9a

SHA256
df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

SHA512
8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_627971694\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_86214941\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3896_86214941\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit