hxxps://account[.]activedirectory[.]windowsazure[.]com/?tenantid=3abf5f87-53c5-4dac-990b-8e56289e1e75&login_hint=e_katchenko@wargaming[.]net

Analysis

max time kernel
146s
max time network
149s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
14/04/2025, 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://account.activedirectory.windowsazure.com/?tenantid=3abf5f87-53c5-4dac-990b-8e56289e1e75&[email protected]

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
49	3884	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_1622010735\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_2094616510\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_1622010735\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_21616933\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_21616933\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_21616933\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_2094616510\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_1622010735\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_2094616510\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_21616933\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3180_633585510\_locales\lv\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133891135969271560"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2123103809-19148277-2527443841-1000\{DF6F86CB-3EDD-4C89-9D79-4BF408858D33}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3180	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 1256	3180	msedge.exe	83
PID 3180 wrote to memory of 1256	3180	msedge.exe	83
PID 3180 wrote to memory of 3884	3180	msedge.exe	84
PID 3180 wrote to memory of 3884	3180	msedge.exe	84
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 2032	3180	msedge.exe	85
PID 3180 wrote to memory of 5208	3180	msedge.exe	86
PID 3180 wrote to memory of 5208	3180	msedge.exe	86
PID 3180 wrote to memory of 5208	3180	msedge.exe	86
PID 3180 wrote to memory of 5208	3180	msedge.exe	86
PID 3180 wrote to memory of 5208	3180	msedge.exe	86
PID 3180 wrote to memory of 5208	3180	msedge.exe	86
PID 3180 wrote to memory of 5208	3180	msedge.exe	86
PID 3180 wrote to memory of 5208	3180	msedge.exe	86
PID 3180 wrote to memory of 5208	3180	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://account.activedirectory.windowsazure.com/?tenantid=3abf5f87-53c5-4dac-990b-8e56289e1e75&[email protected]
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff95c47f208,0x7ff95c47f214,0x7ff95c47f220
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1828,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2252,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2372,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:8
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3444,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3448,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=3420,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3592,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=3564,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5008,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5184,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5804,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6136,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6136,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6400,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6548,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6188,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=5892,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6680,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5140,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6688,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=6692,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=5272,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6516,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5916,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1252,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5380,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6568,i,3929117778545277703,12266180781370264896,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:1708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
7da492a02c29529dc0ca538b502e3379

SHA1
cee6a1b81936f6a20f1c9c4f35c29394338ff54b

SHA256
553164a83cb91c4905a86373c61bd899bc1007e7719791878bb95290f1f27f36

SHA512
3a1aaff3da507ce35c4e06ff9fd2516c65780849b24fab33417da2e799e20bda3594e5f2f32b1326dd1d3da560c76dbff1f626c147e99c7a990fe09ab0a2e89c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082

Filesize
16KB

MD5
12e3dac858061d088023b2bd48e2fa96

SHA1
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5

SHA256
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

SHA512
c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
de98f0910e298eba74f0b20044fe737e

SHA1
cb83e75f24cdb9e58a2f00d2bcf896dd086fc240

SHA256
f3428879a49e91900cce0954cf4693600c0c5353a445c0c0cc5ecc57e6323607

SHA512
b3b12626640b3cf7c67fd6e3e3dfad2cde2f1b561044b10ac82a534c20536d40aa9ece9a36edf34f4ac94390214056eab2033b9ea00cfa63539934e1b6d87e2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
3099acd9190fad7360ed999678f21e40

SHA1
b152fc7c9d49d97cf1aca5e3e1740c6a61db7e2f

SHA256
f04ef221e6b868c57d1b1f3369d3964294ed3338b71edd67240b4c959b864bbc

SHA512
91e1b8af20c29e7bdb2d4568ef2a59b89a3e06df79bb341d834eaed77d601e6e99d493da0fd2e7a576c3ae8de1f435df06780c30645c620ffb7e6d055ccc405e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5801a1.TMP

Filesize
3KB

MD5
ff791821fd8c5ebf404ae869a22c7cc4

SHA1
373412403ecc59427cd9dabcab05af2e62fbb3da

SHA256
e3e5ce4c35ab76b0dd2ebcb77a63e4b936952543574d4ca8dc44cfb137b95614

SHA512
f6aa5bbb2e8489ed1d23bdbd7e1477ac80b56c05031addac5126640b356e58976c352bdc2b1e25509e68c6f63504e4611b4721cf29ddb2f938e257bba429de90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
c8712a19dbe0eb05efb3c003d5f83550

SHA1
ef76e63b41fdf7a616594700ea475a2deb0a86ce

SHA256
b631952ed0cad905bacceae4e820f404229d67d902d2312d482caa93792c3373

SHA512
d106fa08eeaf08966a61d7cbccce5e072e204e0a10db25c6d4e7d39e452602723c18524bb566eac1e5442f55ad41347d7ab1f10ee49674575534313e44e49348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
0443165941a0e7d9ec1b278d1422df1a

SHA1
1d0fd08476debb8309c5b4941a8d956e394ab563

SHA256
d19d2e29893f5da3c037f1a9ee155baae9fc926707dd53a7755c8b48d52df8d4

SHA512
b08a0f15795bdd97e51e93d5a0bc71a9c504bb6fe20521021fbcbc1dca8da5c35c342459b7fb193ad98e04f1f3731752f3d537d78024432fc4e2a5c0a916adc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
d506c96278aaea16a237f672886a7ba2

SHA1
e68c8bec7398f420c1eb9c1ef4ff223bde37dc43

SHA256
9ccd20e693361a0f5a1037ad559a3c2e0de72da32968de44e1cd7e5a70be3f8e

SHA512
eb8508b261c208db94c7ce6155746608638f4f62776b4fe27c32f17fe765735af048925823e2e84eb29a9b8bf94fb09e75cc56b46533987c5c2c30c6c2fb3db8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
57b2c7b3f14a9e06345ca463d4cdebc7

SHA1
94230f95984c0c4ed5d5b74e46fc46fee12ce6fe

SHA256
dd8f2c1698529439f686198024c592ab9cfea89d95c1ce3f4d708a0e3b3311ab

SHA512
a1c3776922de7acb4e230d532299dbb553579a62547a027378770949da1ba96d9d629b111dd95a5b5caf9930ea98c71b4a38f4b81343e86f287931d2f562a4d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
451ab794242cf22222f80ee96d565907

SHA1
2c07f69437428abca1a933bddd3bd414ae922e5f

SHA256
e16dc6626c3ab61145891055ca4bc51879a3d6858079f4e45c1c15f528afc2b3

SHA512
71b6450358b206728f4f23a1b0e51e674a97336bc39623ba92a964adfcae01b2aeb935023a8a1940a038baf50d035bb40cf23e1381d7df7d111fd980914524e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
3bd6900f5f403b80296e43c59eb2c145

SHA1
7602f70b3a0b5f54499708874ed891c2260f6b52

SHA256
67f106ef908be6a4fde0a35069fde3eb5cdabd20ad0198fc8e82b21295dab81c

SHA512
40213968fb9b85db717616ec4bba50edbd91334ea00f92831c5e957bb3273a14c373ca311811b1b09081c7d3490654ce520555c60c88536107e26a110af61c63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
6e65f5a752fcd0c20210bdc547f485b3

SHA1
75ade277a9f5248aed2dde94e3188d0c17a47562

SHA256
330c148cf68b0f842448e2d6779d6bd311bcef5fb20a51b9e4c734c8cb3a3f41

SHA512
234eef7d8ef391ebfa4113b0c6cd844247a85a88a5049a3a576e5a5adb79eb803567b0749437043bcdc2449308817f87a2ba77f9dd255771d90849d8667a90c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
feae28c358cba7095264ad9bc9059571

SHA1
7e38980b40222a1ba82ee92236dea851c6ede045

SHA256
09bf0a86ba4c81d70033148cd5f0edb2a2d10d1e3543d2edebe7d38c959bbeba

SHA512
33501b1a0df69b85a3842cbca250c4b0dd5859458f472afc414b607a294b01989cd9277e67f61422ebaf64891891f5c460c6598e856b0176376630c6bf6fc11d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
4027117f243099d1520fea87a8dc7ed9

SHA1
c718ae5f113ac368df0c34bc2210308eb84d252d

SHA256
36ad1790fafa5367ffabb2704d509be442fd996ac1c14d0f5f3352b887f0f2d9

SHA512
91f23fe14faa04252db5955947f9558c3d4abce74a86dc1a2b8931f08089203d106340e49ef1cbba7b144983ba087d1cb49ea42db7ed01b9b2f70cec0db7091d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
f5859d7eef5916754135860425780fba

SHA1
aaefb2ad03916907957331ba38543d6531c38faa

SHA256
12ca3fddb3868e128949a46809b89128a930cf6952076afff64c6371507f70a6

SHA512
af28ab0a26fe7f54e9269dd7eefebc020e8626f22d3579d17820c3605b7ee9a646839e33753d12adfc409778db417b763a8c3154863653a39271ce0fdeb4e2ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
5a94ff6857e4836df2d209d637f64844

SHA1
ff3882666b126c4eb1a459a605e4502bcb4d2b82

SHA256
3af7c014021502025ab3e16e27e14ea387f254e139b45b141b34bbf0c50fae74

SHA512
297219f2596baabb6eba34500dd5d4115ce9361bc9f7fba6941bb8cad14f292ffb2d716e579df888746e2b4a5574582c7d5cea26f66832b38a9a8f9e82f485d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
b78787aedaa91d81306cc411050e968e

SHA1
60df77528a4496ede86feb65d92fe61943bc0947

SHA256
e8f6a19b9c6e60b7c9cd0d277d14bd2580dae7929630aaa2ef45cdc63ee5992d

SHA512
35758feab19f8d1e7b6997714dbd03eaeba526b3dc80a6335b08ad544b89a4429d7ac5d051e6b0d6067580d641a93049891e7f343a1b2c13f8c9c2c7c2fbe3d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
fdb703abc3754eff8931b2d4a910f67c

SHA1
f0906ba8325c1208e4aba570130e1391ed4949f9

SHA256
1dfaedd18da7fbf617703d11fbd0db2cf14e01156c9e71d1e3067f436fd21f85

SHA512
498686a92044d10cbb6df1ea72bf51ee6d95e2c3c452a384b7d7b16f48ff378afb6948a011a3b517d9cce45fdd7d3b1bddea4500a6bd4459231f250dcfa19864

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
ec15853baa213f322ddc2aa729cd50ff

SHA1
d2934e15f0e08afee6b5c8a1a962381b5d1d4e3b

SHA256
68365d7c6f712b9836ea2d223982efa4b0d24080f4891c4b104becbbf1508a54

SHA512
e0ef5b1d14e62c7176071d973aca6fcaf6328730b4820a2b5abde5df55fb0601ae084ab7895dad6ad103819538ea4164a6a20d90b8c95e84f03b22e7b47a82a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
5db43e46ebe8a805910d429d61bb6047

SHA1
35fc00153df3c65abaa72f37baefa28465c07184

SHA256
f151ba5f97032d61381decc38f027bab1ddc1ebd9e7ef103ec3f16f40a6d668d

SHA512
8ecbed4514f6f946a898e7913c31c1d63bb1d32e07782fcf052c222351fb046a97094fd2c69c8fad80dc50e7d29055eda1b85e08011acc584f00679609e9f69d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
a16df3ce85eefb5073c5dd0978b67a81

SHA1
0572ef78ef06691ab00d073931838be7800cf778

SHA256
a3e3862fd35be9547fb9f940da50dfe7456c08e53ef7283b6734cc3b557e2423

SHA512
a1c5661f6aa30bc1662973860cbbb52da343d60705413b6157ee83e49345c53af0a6c7debacb6b1c94b54d0d2700254e5e9bfbf94bed578cb5f049b76d51feed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
7e69af622f0f52e3a712f5385fc1411e

SHA1
c136b9880fec10ad094e4bb1c4860fe3345afb7b

SHA256
e29a984760fe74f464fd067dd7aa35f8198492e8df456bd4e3b90fe1ca9658d2

SHA512
b17bac708dd09af4964faecf49898bb30238ce73ff0978b390128f7aab939974e47157279f8b56542477e3351f2e30674bb1b25c147d4fa4ff46bf86b673d01d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe586414.TMP

Filesize
392B

MD5
8c981fee2ce99f78143058a2ef4c4b69

SHA1
42000e0b7c848d4982bddd9e211ef8005ed94570

SHA256
fa7e2ac561bba465e01fae78bcd99ed402966c982aec9f7c667b0a331f692b0c

SHA512
ecab5608f727e2c22002e347fbcfd41f860c94c571f49076b194ce5cbf0635dc26b88ac5179288e08a1bf5233f3e927560ea1aeb513234ed58be02f92794c49f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
3d59c1fff0ab278f1d709bf0252245e0

SHA1
77fd442ee3aad3bf7cfd5952bf221a1bbbdc4b45

SHA256
d53456d88b0a58bc7d3eab45375cd591d2070d3e891da4eb7a2eeaef4f284281

SHA512
3cfa7fa19a8199f1af36660c03af128d6e80c43ca2563634f8fbb9cd2bd5253a18abb4eaa16fff0b78053fd8d21f691158842947e981e61904b06375332cecf0

Download Submit