hxxps://steamgiftcard[.]cfd/1053910953

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2025, 04:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamgiftcard.cfd/1053910953

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM. 1 IoCs

phishing steam

flow	pid	Process
52	1900	msedge.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1988_1893154278\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1988_750177248\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1988_750177248\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1988_2025576630\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1988_2025576630\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1988_2025576630\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1988_750177248\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1988_750177248\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1988_1482921968\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1988_1482921968\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1988_1893154278\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1988_1893154278\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133880404485401580"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-805952410-2104024357-1716932545-1000\{359B7824-9209-4E2B-8C46-44D74143C137}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
868	msedge.exe
868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 216	1988	msedge.exe	87
PID 1988 wrote to memory of 216	1988	msedge.exe	87
PID 1988 wrote to memory of 1900	1988	msedge.exe	88
PID 1988 wrote to memory of 1900	1988	msedge.exe	88
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 700	1988	msedge.exe	89
PID 1988 wrote to memory of 3084	1988	msedge.exe	90
PID 1988 wrote to memory of 3084	1988	msedge.exe	90
PID 1988 wrote to memory of 3084	1988	msedge.exe	90
PID 1988 wrote to memory of 3084	1988	msedge.exe	90
PID 1988 wrote to memory of 3084	1988	msedge.exe	90
PID 1988 wrote to memory of 3084	1988	msedge.exe	90
PID 1988 wrote to memory of 3084	1988	msedge.exe	90
PID 1988 wrote to memory of 3084	1988	msedge.exe	90
PID 1988 wrote to memory of 3084	1988	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://steamgiftcard.cfd/1053910953
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffbfce0f208,0x7ffbfce0f214,0x7ffbfce0f220
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1776,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand STEAM.
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2296,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2076,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3504,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3512,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4276,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4344,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5300,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5372,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5532,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3648,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5180,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5244,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5244,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6416,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6608,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6080,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:8
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6724,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6740,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6884,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6936,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6928,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3772,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5672,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:8
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5664,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6156,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6880,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3792,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6696,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6348,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3540,i,14547425128264539345,14570245007359647898,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2056

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping1988_1482921968\manifest.json

Filesize
43B

MD5
af3a9104ca46f35bb5f6123d89c25966

SHA1
1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

SHA256
81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

SHA512
6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1988_1893154278\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1988_2025576630\manifest.json

Filesize
160B

MD5
c3911ceb35539db42e5654bdd60ac956

SHA1
71be0751e5fc583b119730dbceb2c723f2389f6c

SHA256
31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d

SHA512
d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1988_750177248\manifest.json

Filesize
160B

MD5
a24a1941bbb8d90784f5ef76712002f5

SHA1
5c2b6323c7ed8913b5d0d65a4d21062c96df24eb

SHA256
2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747

SHA512
fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
0db1d88802048ff847bfcf47035335bd

SHA1
bb54059e5b145da464f6521ae67353889ce00771

SHA256
416525d2bfeaeab0950175c0eab55ad35e84518ef5299f10565023800788cf9a

SHA512
32c5b42febdb38c3a30eb5179b8aa20a5e731b0e83aab16ec73d27b4108bfc89eb6316f71a988388cb5df19267ba823f6d0220fab5584667ba0adb0da1152a30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
8734b4a181214bb62f91cfa36c7e2c98

SHA1
9cff323f10778a23d73ac3dcffc038d3bf661b78

SHA256
e06afe980fa56c8dad3e7c6b8d0d8f1e7eb9a4860ac715e966026fb7631c3ba5

SHA512
e8648a54da9aa24b6cba1f0377a0ce33979ea097554bb6347f252cad894ad4134e1fe839abc80eb48e2510061d5c6937e80374d32f95afd4cc8567b57694ac36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\52edffe6-5a31-421b-ab99-1e9bc810976b.tmp

Filesize
13KB

MD5
74a2a6fef4e05e02ddd345f2eca150b5

SHA1
3e3daa8a928f19471e2c7a1219a24dd1853d0ae7

SHA256
8863d8182f5ddef1e8bc1dcb5b694e7ca9a03d250ba2ce4cce938ccf55e59d2d

SHA512
2a614314c7645127c1d0fa6c8bf7b782811cb6046c940d36239f8e64c7f9abf1931ef78c4afff93c4ffd8b77d124e6058b9ea6251475399ecf4bdd307e9bfecb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\581a28c0-2014-4ad5-b050-7044665db203.tmp

Filesize
14KB

MD5
5629b6554459ef4a1c0603de6362ff12

SHA1
2f41b38ba3fcc09bbe2f5ea662b5d6b029856063

SHA256
fa861dbec3cf93216db3bd0f57caec8c1c8598f5da3099ebe8cf925824a02846

SHA512
88e36b2facb9e22d81b8c968056ba2806c40f5bd4ff1b8510b21680b26b0094dee2c6f5f48abebcdeee7dfe8d5997d33706674831821777440c26b48c707f988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
3abff5635b89cc6f1d83c1f0cf728c0f

SHA1
bef5876a546b706c500a65096b51e360d095e551

SHA256
a642e789f9a364bb0b3488e51f49386cbf4932bfb99944c5d48e51ee3f6e3cca

SHA512
a4f52f86af60adc8d105469738c5efcde4d373a32448fa8e31e146310051b7035ff90bd28111e3ab8c03ddeb4f5eb702500a3055f041ce44ba2deef68fa208ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5831b9.TMP

Filesize
3KB

MD5
2fe70a194753f09a905f34b4ce3fa6b1

SHA1
3a0f95eb7bbedd4f62c0da878bef07123d1ce96c

SHA256
ff9b893b10ad6ef7657a664fb97348a0b06d40541dbf8e739ce59a10a7be85fb

SHA512
a27387d939b3953df94e43410664813b4acff192783ef4d6d94bb54051740d91cdadc209b798ff956cc6c5a43f79e3e5bd86f85e8a4d1366d070397044e69a24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
6a7718c02ebdda7a6de54e2df85d9735

SHA1
3bfb87e12287700682428b58686c0e6546c4d93f

SHA256
296ad42552deb51a47f8fd7c48394e505dd95f35e6f7d83f1101a447a49f28d2

SHA512
a1268652e9ee84d9b335429137f98d6806469bab0d0d24e7d7c7a84022a9e73306c21c071c45297d892fa4ba77dd7a1fda406dd7aebaab5153858ada417578c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
73118c3ceb26f65ae16b0dffe0674a24

SHA1
093c8a037c8aff7534191b7ab46f42ad3c998e0f

SHA256
ecd56a7d53e4a52b5da264f3c842542647bbede4f6c072b97e2ab8ef6624c943

SHA512
4df894eadc057dc51d5afdbd753468e5cbde04c3557921879cb75b6750af2498d21a481deb6d437ebaea16ae9118f67b9d4399e655d1b4a05e65353b81c5ec15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
336a548a6f7bde2002f48b00afab567e

SHA1
b9ef36f76719e90b88e4830490c65ab7b06818ca

SHA256
908271fc5379a0e7a8479e7b03597503a596a8ae253e75d34545f2a6711468d2

SHA512
fb383240975c3b41c534514a526cefdb36f23b5b1a85dfa1c15a2df5af2a141c8748edfadc0dad3044e3e27f8314529d62e3856c3da2f5dd01d15e394aaf0c51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
2b58aed8df17cd4299676380ea70c7ed

SHA1
e57a2097e6d77a09b627d67638e5355f4f4c3051

SHA256
d3c815deb3e9c3f04224bc44b25563a4b76c64c211773b5ce9f86e87aa52e39e

SHA512
b1f89ec24777bcdaac7c41c8aff18ec24a09ebb32514f3f9430539510330a2d4cbadd3decd23e91cf319f3042194925153a71f0a4a8cd0212b1083889bd4a989

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
ad929f37361dcfee9d7637475460b2e9

SHA1
23b8899a22cc2f7515c61d3c7a4005f042ea324d

SHA256
5269f990b755031228f48a406db0b27024500ad5b9b0667589db9fee967c2098

SHA512
d12d83ed01db987a04c6a4db1e9ba59a345d4acbdaa14b8c3a48ccc6babdfe0f3921658719ef4e29fdc2a96d31a0db4331b46c94849f3959d88b0c2a97cd6b0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
bb6ca3d813db5b2dc0101aba581f5d85

SHA1
d8ae1e07e3136cabaddc3c530e4335e01749de80

SHA256
479e1c65c3667e7544124659a6e3b3b16bc3a93fbd320d945bee3638f7269d97

SHA512
f13e2fee7cf07c0ae49151daa9f56cf006d82e5d13e47f12b8d408af8225eafac2954aa0b2c268da666b3fd22681a2e74fa7715ca7ee7e29c53f5c877287ba67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
868B

MD5
21897e0037ed3b23f12aca797b497bc8

SHA1
663baf31346c5a3b1b94903a87bef29b3b0c4e0a

SHA256
9bec528cde3015812b63f08e0bf23951d9e65dc24e9a085c3a42616f18c09d37

SHA512
a2bc9054ef53191b68a4c5d39fd087cc86e80fed67a4ee7de01ba04f33952405082b89bd273e4fa8a9fbb84b922598468aa9feccfbcd9552ce9d88577dd68c1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
3b0f2ae2f4620c192e5ead7cdc5431b4

SHA1
ad8fcac5b2ec66cc3c86389d59fdccadc3e5c528

SHA256
eeb7c0a59a457a95a1ca20d03cc23d43b5ba2c4888c54d5f69c6841eeade91a2

SHA512
8fd184fdcf0ce23a7779099b7fb9df4282fe4c5ea47b42eb818dd1472caeea925dc3191035995d14f8baedd2794bbbd515f89e07086abac4ff2ea575e91bcfa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe5887f8.TMP

Filesize
463B

MD5
c71d16a4ca5410f11f79df82c90db7a0

SHA1
4df1f5593943feb110fe42e224f87dce1dcae3aa

SHA256
9bf5b2018a6a9fa0185d895dea4fe7978a588a1d74d2f59fe3f49ead924dc931

SHA512
0f1fd5f8aad4d86a351f5eeee8d030a390436a3092252c15521a228597ac1f2b9b9b38e101ce792bb600897115d491fe334f7a2021dfec7e9239b224a9272450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b2c330cb-44d7-4b74-bfb7-36a02cec1fb0.tmp

Filesize
22KB

MD5
650e9334c4c2b1df2a30de8b71135993

SHA1
0559643b218c43fcce2183a814ac12385b9a80b7

SHA256
a072d79625d42e80c5e634610800f68f8413b2560bef8f2716d3d63cd5841de0

SHA512
47be63d7fe283458928e15ba43df9c18a908dd84be5ebb379db9434004ccceca8aa589f506fbecbe16b1f6840f3d45ca54fc78f087dc32f9b5feea8508ecbdba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json

Filesize
3KB

MD5
94406cdd51b55c0f006cfea05745effb

SHA1
a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9

SHA256
8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e

SHA512
d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
3cb199c09aed472c77c79c09fd2148f0

SHA1
e298820e972abfab16804f17b2f45dee8eee64a4

SHA256
464ba8f1f0ff6a2f34c7fc647b50cc4863226fb6350d6e0e9fad96ff8312d96c

SHA512
b1fe3c6d98c3388e17ee343a2b8d2af7aa272cf34c4d783bdf31d3fdc77feae6888453fc48022b06954d83ae3de3cbe998246dcaa633b428a5aaad146ed228cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
d9a479a5261a192cabd131ecfd6dc1e0

SHA1
b3d4f2ff16ccaac979b24ac8ab943b5a2d2bc893

SHA256
c4dc30260df979960821f9c4ea6eead7b34427d1f5c430c14777da546d21bf54

SHA512
d6ac5f9287efd68572839ba16cc3950dbd48296e34a176e75cd545b7d4c1d0e969e493860904420b9e7fe64f170c2960142f90ab9d1da046f00b389b35f1aad0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
4c5561f14d1a88e89b4fbb582fba19c2

SHA1
43cef3f194fc03f57059241cb75ec7892f0952c0

SHA256
87c01fe82049ca3cb3fa62114ae3635bbcb063059c38ff14670ec184833ece72

SHA512
3c93c64085b9e21479ab2fa2a38e746223f356fdc26166abb1706c8355bc953a9f5e64969938e7883f90c8bdfd0d73cebe9500b7e7607e0170d23f4565c1d05c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
ad6417a0090054bd31168a0e179b8fe2

SHA1
650f0417efae73dcdd8c595d6d42426b0fbe0bef

SHA256
f531ad790fb2af1a40f8f8dabba53c4fddafe931559aedb8bd17ad2b205efe87

SHA512
ba379ac93353029ba161c9ed9a06b6ab075bcc42f9fb8f58de6e6c8c40e6b01cb5c8f02623d512ca9c6ce208cae96e8637e76507b4679e024db50d49963bfea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json

Filesize
2KB

MD5
499d9e568b96e759959dc69635470211

SHA1
2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6

SHA256
98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d

SHA512
3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
2d14bbc546d322b3093dea83aecc716d

SHA1
6ed0a8e9f6cb7e037c6e2e49c60685b2875c92c8

SHA256
d68eb8d2c7f421966d1f460f40994c4c5dad30647bcd61588357d7def419f7d2

SHA512
667f0b2a87eaf0361ac25807d3131855d48168ffd58f64db116b3643feda0bdb2a2230e27c4b841bcb28dba9add27c753fa83b7c1a13b8a109d27d48c1fcf6a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\35082432-0f24-4038-bb3c-27ea0695cab7.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\d03c92bd-c6a4-47c3-b35d-973a7ced1634.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1988_1833381637\50590446-7c2e-40d4-b874-d7841c53d0ea.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit