5bb25fc64fa856142f6f86cd069dda1698badd8a1a9c69bdfa06ec7770de239e

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2025, 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5bb25fc64fa856142f6f86cd069dda1698badd8a1a9c69bdfa06ec7770de239e.exe
Size

43KB
MD5

a7c044faa843b4ddc7332e8682b8908b
SHA1

32570c7a0a1401e0c81d1d212d62c910e3813619
SHA256

5bb25fc64fa856142f6f86cd069dda1698badd8a1a9c69bdfa06ec7770de239e
SHA512

1a0b855ce193b9e9d07a4e7f3e7eaac34e12388908907ca6f36d150565acad977130af0b5781a9cbd4de9c7fd7f759f3e1dc0db02d583320d897d4cfa0854913
SSDEEP

384:UZy+Hl9n1iDcsyEqt3ptKwQsElGhOEazcIij+ZsNO3PlpJKkkjh/TzF7pWnPmgra:i99nU4pEqt5tKhohuuXQ/oiC+L

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1113209072\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1467994507\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1467994507\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_530765131\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1488677828\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_530765131\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1113209072\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1113209072\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1389077023\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_1488677828\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping968_530765131\deny_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5bb25fc64fa856142f6f86cd069dda1698badd8a1a9c69bdfa06ec7770de239e.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133883086471367245"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1062200478-553497403-3857448183-1000\{25FAC80A-1D3C-4CA0-90E3-9BE3B2092AFC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 968	1588	5bb25fc64fa856142f6f86cd069dda1698badd8a1a9c69bdfa06ec7770de239e.exe	94
PID 1588 wrote to memory of 968	1588	5bb25fc64fa856142f6f86cd069dda1698badd8a1a9c69bdfa06ec7770de239e.exe	94
PID 968 wrote to memory of 6136	968	msedge.exe	95
PID 968 wrote to memory of 6136	968	msedge.exe	95
PID 968 wrote to memory of 4812	968	msedge.exe	98
PID 968 wrote to memory of 4812	968	msedge.exe	98
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 1080	968	msedge.exe	99
PID 968 wrote to memory of 5536	968	msedge.exe	100
PID 968 wrote to memory of 5536	968	msedge.exe	100
PID 968 wrote to memory of 5536	968	msedge.exe	100
PID 968 wrote to memory of 5536	968	msedge.exe	100
PID 968 wrote to memory of 5536	968	msedge.exe	100
PID 968 wrote to memory of 5536	968	msedge.exe	100
PID 968 wrote to memory of 5536	968	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\5bb25fc64fa856142f6f86cd069dda1698badd8a1a9c69bdfa06ec7770de239e.exe
"C:\Users\Admin\AppData\Local\Temp\5bb25fc64fa856142f6f86cd069dda1698badd8a1a9c69bdfa06ec7770de239e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=5bb25fc64fa856142f6f86cd069dda1698badd8a1a9c69bdfa06ec7770de239e.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x350,0x7ff97a1ff208,0x7ff97a1ff214,0x7ff97a1ff220
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=1780,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:3
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --subproc-heap-profiling --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1976,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=2584,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
    3⤵
    PID:5536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3444,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3452,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:3872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4816,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=5096,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:8
    3⤵
    PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=4800,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
    3⤵
    PID:808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=5592,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:8
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6032,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6032,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=5720,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6156,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6420,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
    3⤵
    PID:884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3584,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=2760,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6412,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
    3⤵
    PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6324,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
    3⤵
    PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=5288,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=5132,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:8
    3⤵
    PID:6028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=5156,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=4796,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:8
    3⤵
    PID:632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --subproc-heap-profiling --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=860,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=5388,i,7877251520806787379,11271401428060561782,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
    3⤵
    PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=5bb25fc64fa856142f6f86cd069dda1698badd8a1a9c69bdfa06ec7770de239e.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2928

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping968_1113209072\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping968_1467994507\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping968_1467994507\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping968_1488677828\manifest.fingerprint

Filesize
66B

MD5
496b05677135db1c74d82f948538c21c

SHA1
e736e675ca5195b5fc16e59fb7de582437fb9f9a

SHA256
df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

SHA512
8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping968_1488677828\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
690f9d619434781cadb75580a074a84d

SHA1
9c952a5597941ab800cae7262842ab6ac0b82ab1

SHA256
fc2e4954dbe6b72d5b09e1dc6360ea699437a2551355c2950da0b3d3a4779fc1

SHA512
d6b1da8e7febf926e8b6c316164efbbac22c7c3d9e4933a19fffba3d1667e1993cdeb5064aa53816c0c53f9d2c53e204772de987eb18adbb094a0fb84ae61fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
a7b5f6e0b87ff075630395f1c9dfc2ca

SHA1
c66e7041f0bf60f6be0812d9ae25e5001a580ccb

SHA256
5ce12912a4945bdbd95f6e4a776cc6eb87f0022bb7db3379bc4b852cba0881eb

SHA512
e57e585bb84759e8a437f4d14323d3de68f1f4fbaf1569eaba49c6faa64873d5a4862a9bab208c7072771fb87a5a081bdb5099255634601fbafd0d8e57cb9c16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57fbd5.TMP

Filesize
3KB

MD5
9da5e54eedbb26c458decd3b6e407c2d

SHA1
c55118bc92e64c605b78b719cc6818bb6e9ea9d3

SHA256
db677fb690dc3ac0f3730693cdfbea4d72f285c05088744597e24f56dd7a6359

SHA512
83efa81ea47360bb0f7b2c40faa03e139c00f99511f63d61a7d56da4044127af626ff2e9f987ca0ba7d3e03cfe893e7dde856cc8009d7aeb407ce98217abb067

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
7cb4ce02b9ee675a73c4814ab0a581de

SHA1
c601ab21609049ca78af1015a13dbeda53b5fb36

SHA256
4765b55ee3c7266926b7d1192259d838c5ffd8b408f108b378ea2c2295fb4ffd

SHA512
65b3748b84e41739b601853c00f0cfd9fc6978dc0c1af73dfe6457a12fdd4401b971c5e530454532e2d2b198809c48bafdc95670818e321c02915c4c9e6cb803

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
0ce98a9c121c702376f83ec211042917

SHA1
2b2ea7e8979269f5230304f6d4f8ef54e8f9a9c9

SHA256
f62575295cc72098cb6dadc484c507f65d35297d0309c15242ecccc1b138306a

SHA512
05a58f4a342a304bae78c7d677b44713c78120ccb24cc39939265b9d4c2ee33914a90940c517f655ca87d53ab3cfe80ea1ba673c5078c47f9a2d98b82d95307b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
77621a34e0f767d49cd13ab4749a3b3a

SHA1
4b737ff55f28eee574454cfb599acaaaad3ac5c8

SHA256
4b4b26330b07d414153d1234d1b5acb2755e477a67975fa0329ac7870975343e

SHA512
911fd3f31c3c6349775048e5630168f25a8eeaf6ea194a2f09d6df6b7c2521e0af258f371525edd66e0b9955720b7c2a2181bdc6acb60845ae8d86f02c8465c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
1a48fa9b7d304987ab6c5568cdc955c8

SHA1
209c65668f8ae3e7726035f95b9672901e036ce9

SHA256
21a95f48d44e2a4644f898bd6154f3ca8390d156432136cb1e1e5ed361877a6d

SHA512
cd24587882fd0942a7a0744f8e7cdf9b02821e46f72fa21875b7ef080ed586d6a0c5c8f76509a689eef8a1917098e08b173ca0332faf031fa4adae70d937e0a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
7f722746f096a65e6fc7c63717a26bd7

SHA1
02ac3bdea26b64e392fc4d2e38020a2d4b51779c

SHA256
f38a9a715df044947526cc99b7937f5095f94e63aaef68c316f2af3a4669d5d5

SHA512
2e1199f78e6f1f667c54eb91b18667da1cff6b84dc1b672a9a3f8c7bc2fe0640bf2885b24cbfd4f3ce02aeb104907679d254bf3bcf545907b521444fcb5064ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
5b673f4c5c33626908930b4b6bffc3bf

SHA1
f4818457e41c9ee05f6bd8177eea15e735148048

SHA256
6e8622d336316d54276eedfd24b7cd7106de6f317ea72a6a706c87b0fb544c6e

SHA512
3691acbe76dddb4919985fd03040fa162a1bfd824fffdcd0f176f8edf65954220a618886ee772e0c5f7b564e5b9cea818c1c5a5dfb852fc434dad188beccb601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
894B

MD5
f1b6aec9a7382d7d1eee93e5041ad504

SHA1
eb17e6628a56b553d2fcb8cf4f3d4b956805994c

SHA256
b2268208690b39795c1dc7b5dc11badd94dc9b1ff9fb69a1ba1d4746b1f4e2e5

SHA512
236e3c328c48314f0c18e8392ea9a6d7bd663582e5858aaa5575be81f677da21a575aa026bc4e0801f47581af4eb07e03b499584402b1ec193a70a2a24788c0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
463B

MD5
0468d82bb24655f324b052ee021ebd6e

SHA1
c7db293a348e738952bcc15c73ecd7d6485013f9

SHA256
b05ff1e8026c355428700c6343c98bcde970881c9b8bbb0675169192aec58450

SHA512
1bef5634747a2764b5134d06d52864175bbf4a06f76e84c370d12f81dbc867ef1f8cea96c004a04835e861b8a0b52033360fbf34fdaf93ae429f6ca8f5c66d45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
b285d5168ef36a3ab960fb27bb4ba9ab

SHA1
bf6f9c3a868b2927cf4e4d41bde991106770897a

SHA256
0c7a8c1dcf788a6888be669af8135eaf09e0159b6952a52e69c22d87c8cef1d8

SHA512
1ec648ccf65c5beb6afc73eea799906b5a95d48666264fe7a06e7bdf46cdecfeb549c3ab99555556eb766bbe65e1966bb52817769f16ccd7048de4b8b819d913

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
a5458e9ac4ae6be327f928373c4ae7d8

SHA1
70f02bf5d77155cff465b7c9362d475a3622965d

SHA256
62d2c980371e27284b3e0e82259a346b9e8a1c7f85208e92e35e2336f6b0c65b

SHA512
eadc594149c2279c65457a6449434c17e38210b676bcd2eb0886fe7a008bbe0d79474f5738a33f1e22d8585de8bd594c1190fe6541093987503f7725d881fa0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
61ad54dd48419533c795b26f4f35af6d

SHA1
b0897c3c7dfbc00d1d08fea0df125080f63fb3d7

SHA256
c14142b4a59992ba8016aec2198d8032798438365f7b385c20f662881dcbaadb

SHA512
e5f6dc08ff366d7b1ebbdecd3bca4165d07601105ebcc82e01e5d579a2c6880a0d1415aba9d64491c66f7f1431781c95f000e6a24e2a7d15373b403a3958ca54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
7fb0d6dc6203348f716bd625fd8efe62

SHA1
eee074dcc9d86202833711a3132cf22135ed565f

SHA256
001a144d33772168d728cf7e6b817f6d2cf010a8b75095957ae77ef7055f59b6

SHA512
9873ffb275c89beb9648f2037e70862a10c0a388092bb1970c7779474a86bdaaa88a3c02f3861afbb9350fb6d3596b38904ba3f42dbbde5e7dd3a7a11311e27e

Download Submit