4f4633179c5c7d689a8760868d1fa87354e81071f1195fe61509f9cce794b1ac

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2025, 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f4633179c5c7d689a8760868d1fa87354e81071f1195fe61509f9cce794b1ac.exe
Size

43KB
MD5

5d2295c228115000fb1671183d10b1be
SHA1

6043f5e9b28f01e1386e4303da2daa345bd6cfd3
SHA256

4f4633179c5c7d689a8760868d1fa87354e81071f1195fe61509f9cce794b1ac
SHA512

ff9c3471a2d0a2ab74912650b7ca5f3d883e1207e08c8229519dda369166168a1651b6f1ffda690554b4b5c5a9974fb4e32dbaca2008b30b6d047dbe03b1d6ce
SSDEEP

384:MZy+Hl9n1iDcsyEqt3ptKwQsElGhOEazcIij+ZsNO3PlpJKkkjh/TzF7pWnPmgra:q99nU4pEqt5tKhohuuXQ/oiC+L

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1777583125\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1782572232\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1782572232\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1777583125\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1782572232\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1019079513\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1019079513\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_4512_714856082\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1777583125\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1777583125\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1782572232\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1808946122\_locales\da\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f4633179c5c7d689a8760868d1fa87354e81071f1195fe61509f9cce794b1ac.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133883374668673975"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1279544337-3716153908-718418795-1000\{3CF7379A-8267-4A1F-8D2A-B786AF7C6FDE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4512	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5784 wrote to memory of 4512	5784	4f4633179c5c7d689a8760868d1fa87354e81071f1195fe61509f9cce794b1ac.exe	96
PID 5784 wrote to memory of 4512	5784	4f4633179c5c7d689a8760868d1fa87354e81071f1195fe61509f9cce794b1ac.exe	96
PID 4512 wrote to memory of 4948	4512	msedge.exe	97
PID 4512 wrote to memory of 4948	4512	msedge.exe	97
PID 4512 wrote to memory of 5648	4512	msedge.exe	98
PID 4512 wrote to memory of 5648	4512	msedge.exe	98
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 3904	4512	msedge.exe	99
PID 4512 wrote to memory of 2856	4512	msedge.exe	100
PID 4512 wrote to memory of 2856	4512	msedge.exe	100
PID 4512 wrote to memory of 2856	4512	msedge.exe	100
PID 4512 wrote to memory of 2856	4512	msedge.exe	100
PID 4512 wrote to memory of 2856	4512	msedge.exe	100
PID 4512 wrote to memory of 2856	4512	msedge.exe	100
PID 4512 wrote to memory of 2856	4512	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\4f4633179c5c7d689a8760868d1fa87354e81071f1195fe61509f9cce794b1ac.exe
"C:\Users\Admin\AppData\Local\Temp\4f4633179c5c7d689a8760868d1fa87354e81071f1195fe61509f9cce794b1ac.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4f4633179c5c7d689a8760868d1fa87354e81071f1195fe61509f9cce794b1ac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2d8,0x7ffae3ccf208,0x7ffae3ccf214,0x7ffae3ccf220
    3⤵
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1916,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
    3⤵
    PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2304,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2552,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
    3⤵
    PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3512,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3536,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4368,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
    3⤵
    PID:3112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4872,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:8
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4824,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
    3⤵
    PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5432,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
    3⤵
    PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5824,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
    3⤵
    PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5824,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6124,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6156,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6196,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
    3⤵
    PID:5536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6388,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:1
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6264,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
    3⤵
    PID:3696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5932,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5500,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
    3⤵
    PID:5204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6120,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
    3⤵
    PID:3104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6592,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:8
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5556,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=868 /prefetch:8
    3⤵
    PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5216,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6720,i,12798515539022910283,15312506298415430359,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:8
    3⤵
    PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4f4633179c5c7d689a8760868d1fa87354e81071f1195fe61509f9cce794b1ac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1019079513\manifest.fingerprint

Filesize
66B

MD5
496b05677135db1c74d82f948538c21c

SHA1
e736e675ca5195b5fc16e59fb7de582437fb9f9a

SHA256
df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

SHA512
8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1019079513\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1782572232\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4512_1782572232\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
998db8a9f40f71e2f3d9e19aac4db4a9

SHA1
dade0e68faef54a59d68ae8cb3b8314b6947b6d7

SHA256
1b28744565eb600485d9800703f2fb635ecf4187036c12d47f86bbd1e078e06b

SHA512
0e66fd26a11507f78fb1b173fd50555dbd95b0d330e095cdd93206757c6af2780ece914a11a23cd4c840636a59470f44c6db35fa392303fb583806264e652016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
1a1418d8e9f9a445ad06b6409df61ba9

SHA1
e2d902d031312576f9d56cb37bd6735660cd82d5

SHA256
827c3df0b072affffdc77c0a355577f756a2cd347f4152a6496ec2d90111a167

SHA512
4d7ef7feb2754d0fbe74d8a7a686c3cc99fde9ac783ace515fa46d7c0e46341347b1b3d7b32c19aaef733c27154da952afa10c3ea2c2493d5f2cb4a7d60c2835

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58269e.TMP

Filesize
3KB

MD5
c2976fc3ad86effdedceae8bb87d6adb

SHA1
d63272301cc47cf35cca85ee5fa6a4724a76bb86

SHA256
419cdf34aa5f55e41a6cb4564785637708c6faa5aa8789b6094763801223a64e

SHA512
78f2beb2bf8d60e49f4cf5ebb48a96ff04b796b2acc98c29a1ef94fcb6b7fb4290d0389585e0b36302e00827164cdef720444db50555cb00f8879ded4835dcd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
76729a9df64f9ec4542582a0f52f2c1b

SHA1
287b6b1ad3228ce270bd79fbf73f423fb8bf2e27

SHA256
53ffc192357cca9bbb3beb232f469134e626e1dd6adcf664ec5c6f851c7f7280

SHA512
f2458efdca983d4fbf60fc733ec15de252a7bade160050e947027bb764e5fdca7eef12a9cd6c6a48d4d162647aeda46cc037e891675a045531d7a7b98432c28e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
b151c4525e8885cb6382fb50e819da75

SHA1
2f010180dd3b072e50eade6f9bc468691e0081a1

SHA256
270e01a4b06f01c20c9f2d1091836aa9e440c64c393b259cdc64a27bcb8b1f83

SHA512
1376f86535bc34b9f9ca07cb7d57f68340878fce5695ffa92d0471ecd353455be6329a42abb6a2c56e6556e8dbdb61f1fe9db04f868e4308d5d5afaf2737f723

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
daf198da89acef408c8b3185df3556ae

SHA1
757c6ec5b94b9bc0996f3adb0ca48955726c5c19

SHA256
6f097f13901dae6453961fa0e8ccfb4a33722429e1f5ad54cae58b6dc522e08a

SHA512
70b9c3a257d47fa358fc1c763e13ff4b3de527d6eb15d63d1da25f1b3d6261457f8b42fcfcde998e3255b2ec30362bd6f5aab7ff80d0ca6c24ff806c1701fe32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
75564439d19ba08622ef1672a95f8ec6

SHA1
7ee814f98198802a5b81b81a89b10b261d856b37

SHA256
fb792c9344a2d2c1876b93abe18960d7b1789e845ad05d8c07d9b4ed64ecf111

SHA512
6e854e4a21d2ea0bc61b533450c6ac85029fbc469f4be80d2fe076078a364ef095e14c00b4bdcba897c36583e1ddc7ebe375e07f69214813883c4f79685d5ed5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
23KB

MD5
7e02500526ebacb333f3474af6ee2de2

SHA1
9c2ac16667ace06c012220a98d94462838355718

SHA256
bfe3e50389336a6b8908c5f70e3ae72398ecefcf81f01863f400f962c9dd300b

SHA512
0b60e94590cea612712eda1dad7a9324df68afe47abae4dbc81e244e27a2d519ecb726f9325c433fdae3d84e5e91021a64195af7240000d11c4e18456919daf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
d2ba0743dfcea744e557c0b1cad67d25

SHA1
6117f718700f5f1353f765c90dedbc6a082a9425

SHA256
670bcc15c68b7b0136a7b0410686a3906dc92243530962dce92e7433f5e06eb3

SHA512
7e220c3f54451a4ae3a681b5e51e846daf19e492f953ccf91c5dc4da8c44d54584d415bbfc2d3d3861d8047b204abdaab689bbdd5e720abed652a31086896a9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
b8db352d6124062eb6fd734131fc694f

SHA1
6f2856c47fb3edce383d622433ea1757f6630cb8

SHA256
3fa759b222ec75cf4fc1baf9814698ea8e5d4c6af6b32e8228fc9939bb8d4098

SHA512
6837df3c3d023046b46eadc04fc31f53eb517b7a2066c5106556d98654669499b3e26ec9228cb7334b669e7a94a6f537550ced891cab5c3441489f53482cbdc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
4046a4facbe730165f79aff048669596

SHA1
4ac7ad0c2f06251d137fd3c6493351b9fcd21ea0

SHA256
f87d104dc2aff175d413a3f19b8e2786dcea308c44e737342132de02b22346d8

SHA512
3ed45bfff5043ad244f7058977fc0b51dba74547afd615fd4d566139606df79ed3794fca7608cb5e0ce5f80b945e25c63d6ced69bb136d4a06103b36f16ca1b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
9ad5c2ce9ee4dcdbedf0bb6a47eef360

SHA1
953960c617ee27838ba500a3d0fb3cc7c760bbf6

SHA256
3b386630113313475b980fb819e53f2628c306b66b416ac7e298b17b64dc1ad3

SHA512
514daa4903034cadfed1e52d6a3dc8ac508b66927edfcb3688a3f44a82ac070c11cee9c98157d963107b0bd35e71252e13d2735833039b241d908c07ae499e81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
7caa312dbee6d22f2d853cee1aaa1921

SHA1
feba32689ddfb47c16a132d62352e5ada9cb2005

SHA256
82763872a25469dc94b33a49f3f1782ef2353c8eb8e0b23e451a448db763cefd

SHA512
87ce2fe7c00adb9e5682fceb72edc9b51cf012e3b44bb8f0e5a99ffb7b3ba82a7fc113107695808d4c547c572d80ea6119e16b79f978a09a2b0662dd31009235

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
19e1007fdc6f0b11d5e556f9dfdfc2a2

SHA1
d554a103370906f56fa0cad5f1a1e7081fbf903f

SHA256
5b7605c18c1d4860f2f72b91535930131da6e58b417e80ba692bd0b860111183

SHA512
28d95a74102c422a6899e50e600f8a9a743b5269f3792cc5dc0b923b7411a508686b4213d0c729f69d1c52492b1998f19bf4cfd84330388fe3029cf5f83e0853

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
06722e0b3672d2a583eee4628b6ac0d8

SHA1
6b629618dc7b9ded417801d757edae36b16911c8

SHA256
7f32db38a60b0dedc7d58509cb79880e634dba79770797a3dbfaeab898dc861c

SHA512
a65ffe451b9f7bed42395165776724593e8f4f37c3738d3aff423b31513c0b98d4e73d7fe1f1345867534d7ae05bdbf80fc700eed571a532a78bc0f938652744

Download Submit