hxxps://wetransfer[.]com/downloads/124d7c135a148c967e6a2683b4b1d89120250411142010/a02aa0b43fd3558f853eb668676b689a20250411142010/647eb8?t_exp=1744640410&t_lsid=8f875e58-3d0c-46af-a7b2-0a09b618b5e8&t_network=email&t_rid=YXV0aDB8YWRyb2l0fGMxYzExYTg4LTNmNDMtNGFlYi05YTNiLTgxMDBhZDg5NzMzYQ%3D%3D&t_s=download_link&t_ts=1744381210&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2025, 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://wetransfer.com/downloads/124d7c135a148c967e6a2683b4b1d89120250411142010/a02aa0b43fd3558f853eb668676b689a20250411142010/647eb8?t_exp=1744640410&t_lsid=8f875e58-3d0c-46af-a7b2-0a09b618b5e8&t_network=email&t_rid=YXV0aDB8YWRyb2l0fGMxYzExYTg4LTNmNDMtNGFlYi05YTNiLTgxMDBhZDg5NzMzYQ%3D%3D&t_s=download_link&t_ts=1744381210&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
275	3564	msedge.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1552_1416610276\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1552_1241480397\safety_tips.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1552_1241480397\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1552_2100050744\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1552_1143388590\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1552_1143388590\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1552_1143388590\regex_patterns.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1552_1143388590\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1552_1241480397\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1552_2100050744\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1552_1416610276\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1552_1416610276\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1552_1143388590\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1552_1241480397\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1552_2100050744\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1552_1416610276\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1552_1416610276\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1552_1143388590\v1FieldTypes.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1552_1241480397\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1552_2100050744\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1552_2100050744\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3078542121-369484597-920690335-1000\{67DA23C7-F8C1-444F-B0F4-8DEE58F0605A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5408	msedge.exe
5408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 2088	1552	msedge.exe	84
PID 1552 wrote to memory of 2088	1552	msedge.exe	84
PID 1552 wrote to memory of 3564	1552	msedge.exe	85
PID 1552 wrote to memory of 3564	1552	msedge.exe	85
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 4916	1552	msedge.exe	87
PID 1552 wrote to memory of 3408	1552	msedge.exe	86
PID 1552 wrote to memory of 3408	1552	msedge.exe	86
PID 1552 wrote to memory of 3408	1552	msedge.exe	86
PID 1552 wrote to memory of 3408	1552	msedge.exe	86
PID 1552 wrote to memory of 3408	1552	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://wetransfer.com/downloads/124d7c135a148c967e6a2683b4b1d89120250411142010/a02aa0b43fd3558f853eb668676b689a20250411142010/647eb8?t_exp=1744640410&t_lsid=8f875e58-3d0c-46af-a7b2-0a09b618b5e8&t_network=email&t_rid=YXV0aDB8YWRyb2l0fGMxYzExYTg4LTNmNDMtNGFlYi05YTNiLTgxMDBhZDg5NzMzYQ%3D%3D&t_s=download_link&t_ts=1744381210&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2f0,0x7ffb9ae0f208,0x7ffb9ae0f214,0x7ffb9ae0f220
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1856,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2268,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2428,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3488,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3496,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4964,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4724,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4372,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4700,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6072,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6204,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6204,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6252,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6200,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6568,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6564,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6496,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6484,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6212,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7200,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7072,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7308,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=7304 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=7036,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=6132,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=7060,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=6824,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6964,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6724,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7488,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6752,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5448,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5720,i,13155501188451545720,5776036101422118039,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:8
  2⤵
  PID:2484

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping1552_1143388590\manifest.json

Filesize
119B

MD5
cb10c4ca2266e0cce5fefdcb2f0c1998

SHA1
8f5528079c05f4173978db7b596cc16f6b7592af

SHA256
82dff3cc4e595de91dc73802ac803c5d5e7ab33024bdc118f00a4431dd529713

SHA512
7c690c8d36227bb27183bacaf80a161b4084e5ad61759b559b19c2cdfb9c0814ad0030d42736285ee8e6132164d69f5becdcf83ac142a42879aa54a60c6d201b

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1552_1241480397\manifest.json

Filesize
72B

MD5
a30b19bb414d78fff00fc7855d6ed5fd

SHA1
2a6408f2829e964c578751bf29ec4f702412c11e

SHA256
9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f

SHA512
66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1552_1416610276\deny_domains.list

Filesize
12B

MD5
085a334bdb7c8e27b7d925a596bfc19a

SHA1
1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2

SHA256
f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85

SHA512
c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1552_1416610276\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.15\autofill_bypass_cache_forms.json

Filesize
175B

MD5
8060c129d08468ed3f3f3d09f13540ce

SHA1
f979419a76d5abfc89007d91f35412420aeae611

SHA256
b32bfdb89e35959aaf3e61ae58d0be1da94a12b6667e281c9567295efdd92f92

SHA512
99d0d9c816a680d7c0a28845aab7e8f33084688b1f3be4845f9cca596384b7a0811b9586c86ba9152de54cafcdea5871a6febbee1d5b3df6c778cdcb66f42cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.15\edge_autofill_global_block_list.json

Filesize
4KB

MD5
afb6f8315b244d03b262d28e1c5f6fae

SHA1
a92aaff896f4c07bdea5c5d0ab6fdb035e9ec71e

SHA256
a3bcb682dd63c048cd9ca88c49100333651b4f50de43b60ec681de5f8208d742

SHA512
d80e232da16f94a93cfe95339f0db4ff4f385e0aa2ba9cbd454e43666a915f8e730b615085b45cc7c029aa45803e5aca61b86e63dac0cf5f1128beed431f9df0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.15\v1FieldTypes.json

Filesize
509KB

MD5
c1a0d30e5eebef19db1b7e68fc79d2be

SHA1
de4ccb9e7ea5850363d0e7124c01da766425039c

SHA256
f3232a4e83ffc6ee2447aba5a49b8fd7ba13bcfd82fa09ae744c44996f7fcdd1

SHA512
f0eafae0260783ea3e85fe34cc0f145db7f402949a2ae809d37578e49baf767ad408bf2e79e2275d04891cd1977e8a018d6eeb5b95e839083f3722a960ccb57a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
576f64b8f21f4203eed3f6c7b065f527

SHA1
e0c4e8f914319e112a4b3562d2d6f4107750aba8

SHA256
c39a636afaeae67ebd98682bf35ff7afafceac020ed21cb564ab954ab1ef6f87

SHA512
af606a5d7d4d96afd80d8e0117f2d5f02cc82b810149f50e26d46a5b8fd7c6b2aa119aa1b7123c54d2ef19d05ca92ca738994e047e24e567e53765fc1c52f653

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094

Filesize
24KB

MD5
36a1d73bfbadc61bbff427b079548a67

SHA1
2d023c207c99af66ffe818a8c13146172d4d9b00

SHA256
e159c217e6297a50cb65e1bc27a36ed498e6219d54d3dde428ac6162928e1cc1

SHA512
4f1601ad527ce970747cb2b3798a0da98a265d0e5e8714727f87997254fabcf5bd0b506f12db631374401296e06d9ca68affeb4d67ecd33ca38459fd8e8a1d77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
0a9d533cbb3d7b46aa2346959fc4fb4f

SHA1
d59cd0bf7856b83adb24d247f90dee7f5ccaf4c7

SHA256
55024c5f272ea04f766c22e415d353ca6e3788091aea72aa771b154793c24dc0

SHA512
7699231eeb81ba8e6a559711fe44d7cd016b2531317a03b81b3d01b2228853dba32527cba946d2ca46d25ca6a10a3ad5d4f064dde1277b2ed4416139d7823b77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
da7d03ac40bdaf86f67b5a53fe91ca80

SHA1
e491135654b3d6e5a3385c6779496d397d485792

SHA256
fc9060a91a897fc8a782bc60f48a8e16ed0058d0b790da8db8f77edf4ca63f40

SHA512
21cacb283df595c8562fdf7e672e29f6eb877d85ef963bcc5dde0b5e6d7f2129446394fd73ed8e1e9f4dec5be39c8901763839d8a4b9fad028d98e6922daa649

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c5fb.TMP

Filesize
3KB

MD5
cd6e6d49380afd870dc4bbe27324091f

SHA1
5cc83e9029927dd1c0ce0da296fe7177b09a5164

SHA256
88cafd196f986ddb27e50cfea01521fb0aca5537d7161aa1813eb135a5c56735

SHA512
3ab4137f9c80edfe740fcc865eae429c49ab788c1d8dc15e335a36af1d832af06521c43d80956fcc48fe262e3e602fb8341fd976c9f1ec503a85de9bf98aabce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\000003.log

Filesize
234KB

MD5
a637c56de337da0045900441ac72da0c

SHA1
fb88790b3abfe582c4d790de2f2e016326f42e72

SHA256
4540fb540734480293be78a6326d850c3609c513436fcebc070981b9882eb992

SHA512
fb65d8618b9c3f79163b7754fb2642ef099f020f72d6e2205b43380a4c31b7b6b6ab6ca2482e68aae6d1da8a58e7c0b0a87e0c25e5b975de0ba34f16a9fc956b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\LOG

Filesize
351B

MD5
e8cad6e71fe3b82d70accf708a3d4b06

SHA1
7e4741da76bc16b0d4530053465f308ec8996987

SHA256
544944807d1986f52584401fcb3deb102520070c835eced922652dea88739394

SHA512
1f2494f934f82f43413dd5aadb4de8a117cc75faea16a5f75dbceb41ffcc80db0301aceace10d6fdf2cbab9286a963e6261c22d1c84f6729157b967e51a6e10c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
7974b096c222727e8f993f1239fe299b

SHA1
86e242f864f571c863f8b550f751aeca19e4b1a4

SHA256
cb4a4469ec93bf41bdeef0628b1e56bd2d859ebf2bec48ea94e4b433c1a66ea0

SHA512
be2e771f1bedb859f3d96bc905d6c365a3923e283c792985a97efdd4e6368a4baf89339f543677ba2b287b9bf8838f59a9268b65024eb2cdb289c9be9b4015fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
3311bd5378e9801db3795709b8f867f9

SHA1
3d31d3651c06477103f183578cee9f34c27fba06

SHA256
8bac2c702ba0aaa3e0e9e5663c8c4d1865b685990339b6eb7b6e086e204c17b1

SHA512
fb3d16ed8e7fe9dd433637f6d49da5fe6797864f2905ee04872bd392625115c0883655e0d12ba480e63790dd0f22f8b77c5f7069fc6166b37a0d7d6a75f3b114

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
7429a795bf73766b33f87156d4eadb25

SHA1
3a72901b422116aa76af216f68beee396f480ad6

SHA256
136b68f80359928175db4c1e6caff4ec2ea31a96ca6f48060cd6890875f088cb

SHA512
d665c6efb9a3e919db46c2bccabf177877d42665acfe27954a2f534ebc15e3279dc12949307de2a4d0a103dce2bb6e405cf5c3d45c72e8027ebd6f8e19d4aba8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
39f7228cb264f8a86c19d4d3d57465b6

SHA1
5476115a51da05fe5678bd3b0dc386aec736b48a

SHA256
01b1ade9cb7988654ed21b6364dbff37f7123073b1ead57c9dd4fb4b4c98d01d

SHA512
cda2d9c7c626b9c33cc8f26f02759c2b3e273b1d5b863a176eb059c8312925daa566a7581099a15e1b0f5279b9f96ff540da4dc3b3327bab32817e3788e96140

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4da2c6b687ed399a2cf40246874e662b88529703\7c51a053-d256-451f-aeb7-eb1fe8a50d74\index-dir\the-real-index

Filesize
72B

MD5
ea32c2380c6eb3fb8cb9180bc3975655

SHA1
2f44e92b81f8654aeecda33bae1c4f9fbe6fa6c0

SHA256
d15d9aa6e3d212c7b0b2df2faf688aec82c844c5299f9a427166fa7842e40466

SHA512
da9ccb5452eedb70aa764b7185db7f8eea36e7a61e5541ed7b27c0c2e02ab827011af489b8d19fe884a55352ff99512dfe9e50305034982b9cd9c32a7ceca599

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4da2c6b687ed399a2cf40246874e662b88529703\7c51a053-d256-451f-aeb7-eb1fe8a50d74\index-dir\the-real-index~RFe57befa.TMP

Filesize
48B

MD5
3e06f1ea26a9a2cdd883d9ee48104972

SHA1
bf58a57fe970c4baaeed4c242eb8cd9551c82b05

SHA256
6dcd560a2b052e62f4efab2e1e6cc8f6003d1ecc7610c52be94bd7cf47b90af5

SHA512
b841e3a6183669357fc17a3ac25f7c61b30ebb4a86f5aab14d548ee5293961a2e77f6d76a5c50a09f934b72ee80e290c49988585672b5688372f4ce62e3c021f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4da2c6b687ed399a2cf40246874e662b88529703\index.txt

Filesize
176B

MD5
5f0980007e09b7c27a2e90f45b1f26fb

SHA1
cd65cc605a40597b23e7fdfd741ae111045c58a0

SHA256
bcad06278c9938a7aa45c45b91b437335c5e345779f534ea844e3fd921bdd8ee

SHA512
09c77ae3a341c27598efcacfd3d2750c533f403ba09e868b4ba1a493a160cdab52156aa42b921ee6a6960d657463f6e3730e8c10975a0609785f08d67c346af4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4da2c6b687ed399a2cf40246874e662b88529703\index.txt

Filesize
169B

MD5
fcfa5c601476d8141eda0e2616f20b03

SHA1
6ddc80af9c7f5e6ede36b7411b1bd76eda99aea7

SHA256
7d6c1ce36af06e1247879dfdf87b786bc8a447ca17436cec5a7a6880e86620d7

SHA512
3fa727315d61e6d6b2dc61052e658d2be00832c18652aabdee72778405ed62f0cb464fb1001875b4dde78fcce66c3096976b5265a85af6a7b1c7ee79eeffde20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4da2c6b687ed399a2cf40246874e662b88529703\index.txt~RFe57700f.TMP

Filesize
118B

MD5
b9a7e0c8de43ee7e27292cb4247d54f9

SHA1
8666c27c8954bb487b54630151f6406dd0560291

SHA256
cc788c4116d03969fde81fffecc9f85afc48ed66c0d8d2c5de998cf884959536

SHA512
36cd4404c0a13734a1e3d22b56d024e876a94693e67054ba1a882dfd0b11d782402b3a5cc215208d30eee3191fe2a3f59e899fa30291b960a60d27bd13c4ccac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
144B

MD5
5b1557e9a3164d95b32428e8fb32a5b5

SHA1
30a38fd43bff6298f78f8801d2873e268ec61193

SHA256
a87e3a40ebd34f64b87b8f2f9596479d122799acd0cd3ebf806de52235100ef2

SHA512
5d18e61aa4d9469876a93678bc23385b8ab3f174211fd70ef510c35d4206678f18358246928502dd46e34e13e97743c7b73274b89945d36f2c38db9b3f598c88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57be2f.TMP

Filesize
48B

MD5
ab820d49fc79f160ba1fcc014d9f1a94

SHA1
5ff990427e70eebc49b37a378babc524ebe11101

SHA256
1fb2648ebb112fcbf3fc9645ec010fee2901ea012ced625ffeb26dc0e91a41cc

SHA512
52ee9eca7379254c5d6bc92e021a4f1e623081eecfaee43c8a369034d1b2515fa19d706137ded1769d572e6fff565afe7ff1a72150378da48214efaa6780189c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
4d7e31c9d0474f35d5b4c88b56d11a2e

SHA1
4d76efb2ee50a168c2d86e07cb3a2bab4ac7179b

SHA256
43b7340f26b502e078b54e9811ee832590f40a2c0f4111f0a5b9df4bfc23d7ea

SHA512
7cded2a0d51f52a705e3cec33c4b9baf1c6b5d38bfe2e8778709c5c23239ce45ffde560fce1e0712558db37cfdbd766cec326ea953974b60166385fe9a753d91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
cf429755afc97c459e3fd667a3868b83

SHA1
08bc1bdbf98d819744b18722576bc9e950c69319

SHA256
69332a9851f5400303d4410edcefc04176e9b997ae2e90c77008e5c506f4745b

SHA512
49d6b8a731be705088a61540ec3b55fb7fda01a873068e31cca29c52c6746997f0257d6bacbe28f24ca93a44b4e97b9e3167ef6e5cc47304b7f60a595f9f73e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
c5bf862e66aa8d9e2a8fc875b8642d5a

SHA1
5e6beaffc8099a2939ffcd85c9276d6f2ffc9278

SHA256
f3b9d0bb356110aa62e6a8667b55116eb0717200e67112c137a20cbb53b51b98

SHA512
f8c0ab54cbba62f27fd3cf3d57252a71ddc69440e42774089a821b7f8f12ca61c83d4245542675b641b134b1e5831bceb5c5e5061910ee4b1c4a14cea726446e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
0eb3b04195c545143c25dcbc5c631ff8

SHA1
8768d398abadf5d0fb5177622461cb34aa7a91ee

SHA256
ba036719ef8eb1be78f14be83a40f722ade26102873853dd173ccdb823123b8f

SHA512
04b6f3e15cff4bab33c921e23c55606bb019e370025cc4792c356d47460256f644fc029a965c71e8791fd66f9ce7b398d278d57effa633f9b1ee5daaa268e8fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
8a81334081bede6e45ac00dc5c460379

SHA1
6af758e9d69cc1ac13e62ee17109838caa4a4b70

SHA256
4ba11b016cd563edbb66ec8b347f62a01c71fbdc2860bd3d5adceeb3376ec52c

SHA512
9b57da4bd20f4be594929e2e5ba553057634c30de60f604bfd1ea2225dad573cf6fc8e466cfef66ade65f81d0f4ccdf79aa2a56cc91056ce6e1417a05fbb1b70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
55369d4f91e8011c5dedff79211ed584

SHA1
b6fbdfd0793fc37fecb04568c8c14ae7fcfa8410

SHA256
abf4f086e8e0da62dd03615e7d3cdfdfce079764cebc30c0cca45316862b52e5

SHA512
7b0d300bb991c9968f27bd6049962bb6d778fa510c827c34eb28d0dcfe7e8ccd94f05904d57bec758ee917732d55de116ab0d445a0d2c9937a64ce82ff38176e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
46e74e8dfd8da01b4092b639a22d9b87

SHA1
79fbc2fbc5bd3d751dc2ff98f11cb0aa55f57df1

SHA256
8ced2dff3aa5a7648fc4115d377f77102771e799b73ef8668d377b6a60d2bc56

SHA512
472db1dc493d14287e4fb015cb1fb9c3b826fce9318a7dea60ee56c9f458b024b7d21889af829747cf6456e427d1755d893af178922640b1f878c90b34391d96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
45KB

MD5
3686b4bc39472f6d4d0155d10cb35cdb

SHA1
90490771326ade076fa2c591c5963e5f7fe3e0d7

SHA256
98c96e29e10dd3a244b971d8ba62d771f29bdfc4217292988158d88fa87805e0

SHA512
acb2bba665ae51582135b4ce1186d98e2fa751322edfc9dd9ffe5563868fe31e7546abc528015ee363421ca15a6f72100015be9b53357fb70b9303142d447bcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
f0105cbaba817c452e96b9e097c475f3

SHA1
0eb556efda92b9114c764c00d3aa6c644bae3d0d

SHA256
1733f4fdc985213e476753715f33849662f278dfd868cf459c6f03f0d096ebcc

SHA512
288359d29f4eb0f06f6361248de0095d9d570cc59320dfe5ea3974db47a8a2f417f71c4770825bcb14d0bb2e8a0c08c2ec653011116b9f918c9d5a1f6b401d07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5888d2.TMP

Filesize
392B

MD5
26b64ba8df8a2f101d1dcfa22a28a1c6

SHA1
8d70077b8d263c37b2d5372174854c39d39f20bc

SHA256
cede78af4d8d8b99e1c47f5e4a4a2a667d0bd327ccbaa759a061cd7a797ef03f

SHA512
035a18742e436340066dc353c55361bab230320bc27fe74a9b99ddebea52e116c07d971316eae7b25c95b1e78d630d67dba7b8b1d12a9f8f8ff8835161f162b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb

Filesize
163KB

MD5
bd6846ffa7f4cf897b5323e4a5dcd551

SHA1
a6596cdc8de199492791faa39ce6096cf39295cd

SHA256
854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666

SHA512
aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb

Filesize
3KB

MD5
17c10dbe88d84b9309e6d151923ce116

SHA1
9ad2553c061ddcc07e6f66ce4f9e30290c056bdf

SHA256
3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e

SHA512
ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
1f81dbfd8d99bb94cf18000413f5264c

SHA1
503cb559630d075e1aad6c90c9fb1c3de9ff51f7

SHA256
4afba6fc91e1897858fb7875782fd24619b58cc1a531dc02d8bd7c98228e2e75

SHA512
b0b387f5f42f8b813a10564008ded06729982f0b3553b3c62c76e17663e46e864ecb012588ac5d070a89a0d2cf900e8c59b2d40b1fc4232a62cc9dc5f77b62e9

Download Submit