hxxp://h | Triage

Resubmissions

15/04/2025, 08:02

250415-jxctcstzfw 8

15/04/2025, 07:58

250415-jvbhhstzcy 10

Analysis

max time kernel
899s
max time network
898s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2025, 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://h

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
269	224	msedge.exe
269	224	msedge.exe

Executes dropped EXE 3 IoCs

pid	Process
4572	Brontok.exe
3856	Brontok (1).exe
1280	Blaster.E.exe

Loads dropped DLL 1 IoCs

pid	Process
4536	msedge.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Automation = "mslaugh.exe"	Blaster.E.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
267	raw.githubusercontent.com
268	raw.githubusercontent.com
269	raw.githubusercontent.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\Wallet-Checkout\load-ec-deps.bundle.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1673717790\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1673717790\hyph-la.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-tokenized-card\ar\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-tokenized-card\en-GB\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1673717790\hyph-gu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-mobile-hub\es\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-notification\ar\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-notification-shared\nl\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_70471297\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1673717790\hyph-fr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\Notification\notification.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\vendor.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\wallet-webui-227.bb2c3c84778e2589775f.chunk.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_2129199634\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1673717790\hyph-et.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_252153777\adblock_snippet.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-notification\es\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-notification-shared\es\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-notification-shared\fr-CA\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-shared-components\en-GB\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1673717790\hyph-sq.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-hub\it\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-mobile-hub\pt-BR\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-notification\sv\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-shared-components\ko\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\wallet\README.md	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-ec\pt-PT\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-shared-components\zh-Hans\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-notification\zh-Hant\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-shared-components\sv\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-tokenized-card\de\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-tokenized-card\zh-Hant\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_391328997\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1673717790\hyph-mr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1200897985\shoppingfre.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-ec\da\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-shared-components\de\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\Tokenized-Card\tokenized-card.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1310676120\well_known_domains.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1673717790\hyph-ru.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\Mini-Wallet\mini-wallet.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1965341899\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_252153777\Part-ZH	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-hub\ja\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-shared-components\el\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\wallet-webui-792.b1180305c186d50631a2.chunk.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-ec\cs\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-notification-shared\fi\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1452702814\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_904631641\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1673717790\hyph-cy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1200897985\auto_open_controller.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-notification\nl\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-notification-shared\el\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-notification-shared\ko\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-shared-components\pt-BR\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1673717790\hyph-uk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-ec\ar\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-hub\fr-CA\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-notification\ru\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\Wallet-BuyNow\wallet-buynow.html	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blaster.E.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133891777687251857"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2645532622-3298555945-705856666-1000\{0EBC0563-82A4-409A-8594-EAA3C873FE19}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 1300	4536	msedge.exe	86
PID 4536 wrote to memory of 1300	4536	msedge.exe	86
PID 4536 wrote to memory of 224	4536	msedge.exe	88
PID 4536 wrote to memory of 224	4536	msedge.exe	88
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 208	4536	msedge.exe	89
PID 4536 wrote to memory of 812	4536	msedge.exe	90
PID 4536 wrote to memory of 812	4536	msedge.exe	90
PID 4536 wrote to memory of 812	4536	msedge.exe	90
PID 4536 wrote to memory of 812	4536	msedge.exe	90
PID 4536 wrote to memory of 812	4536	msedge.exe	90
PID 4536 wrote to memory of 812	4536	msedge.exe	90
PID 4536 wrote to memory of 812	4536	msedge.exe	90
PID 4536 wrote to memory of 812	4536	msedge.exe	90
PID 4536 wrote to memory of 812	4536	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://h
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2f4,0x7ff8ab2bf208,0x7ff8ab2bf214,0x7ff8ab2bf220
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1824,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1956,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2608,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3432,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3440,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=3544,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4628,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4940,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4856,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5472,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5472,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5836,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5984,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3504,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=120,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6496,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6604,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:8
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6580,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=5500,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=6660,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4260,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6888,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=6028,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=6972,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7272,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:8
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7256,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7312,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=7280,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7812,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=7788 /prefetch:8
  2⤵
  PID:4504
- C:\Users\Admin\Downloads\Brontok.exe
  "C:\Users\Admin\Downloads\Brontok.exe"
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=7428,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7132,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6016,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=8108 /prefetch:8
  2⤵
  PID:2076
- C:\Users\Admin\Downloads\Brontok (1).exe
  "C:\Users\Admin\Downloads\Brontok (1).exe"
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6928,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=8164,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=8184 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7216,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8084,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:8
  2⤵
  PID:1576
- C:\Users\Admin\Downloads\Blaster.E.exe
  "C:\Users\Admin\Downloads\Blaster.E.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6008,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7144,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=7584 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5416,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7940,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4928,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=8012 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3352,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8028,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=8024 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2592,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5364,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5024,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5388,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7224,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=8188 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5436,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7336,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7528,i,12168308196404629171,8295503249088801532,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:3692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c mslaugh.exe
1⤵
PID:2432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1200897985\manifest.json

Filesize
145B

MD5
6d9ce9f996b9f9fe10bf9546dd82f952

SHA1
0bcf62c147fab9f8eeaf575902c2b6e77053b88d

SHA256
c94951578b17215081e5ca755033993f5d50fc812b8d5e8cd4bf6a6c68b36a55

SHA512
ae6ba65587b6b8b087c57a2f0fcbb529764891eb9e4d3b419194501020256872878af14484a1909cf2293a3fa80c0e74db13dbb3a6b5289c62df3f69a4c7e3b3

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1310676120\manifest.json

Filesize
141B

MD5
811f0436837c701dc1cea3d6292b3922

SHA1
4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87

SHA256
dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d

SHA512
21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1452702814\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1452702814\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1624061248\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1673717790\hyph-as.hyb

Filesize
703B

MD5
8961fdd3db036dd43002659a4e4a7365

SHA1
7b2fa321d50d5417e6c8d48145e86d15b7ff8321

SHA256
c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

SHA512
531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1673717790\hyph-hi.hyb

Filesize
687B

MD5
0807cf29fc4c5d7d87c1689eb2e0baaa

SHA1
d0914fb069469d47a36d339ca70164253fccf022

SHA256
f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

SHA512
5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1673717790\hyph-nb.hyb

Filesize
141KB

MD5
677edd1a17d50f0bd11783f58725d0e7

SHA1
98fedc5862c78f3b03daed1ff9efbe5e31c205ee

SHA256
c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

SHA512
c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1673717790\manifest.json

Filesize
82B

MD5
2617c38bed67a4190fc499142b6f2867

SHA1
a37f0251cd6be0a6983d9a04193b773f86d31da1

SHA256
d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665

SHA512
b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1690528368\manifest.json

Filesize
76B

MD5
ba25fcf816a017558d3434583e9746b8

SHA1
be05c87f7adf6b21273a4e94b3592618b6a4a624

SHA256
0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11

SHA512
3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4536_174787558\manifest.json

Filesize
102B

MD5
a64e2a4236e705215a3fd5cb2697a71f

SHA1
1c73e6aad8f44ade36df31a23eaaf8cd0cae826d

SHA256
014e9fc1219beefc428ec749633125c9bff7febc3be73a14a8f18a6691cd2846

SHA512
75b30c0c8cef490aaf923afbdb5385d4770de82e698f71f8f126a6af5ef16f3a90d0c27687f405274177b1a5250436efddd228a6d2949651f43bd926e8a1cc99

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1965341899\manifest.json

Filesize
1003B

MD5
578c9dbc62724b9d481ec9484a347b37

SHA1
a6f5a3884fd37b7f04f93147f9498c11ed5c2c2d

SHA256
005a2386e5da2e6a5975f1180fe9b325da57c61c0b4f1b853b8bcf66ec98f0a0

SHA512
2060eb35fb0015926915f603c8e1742b448a21c5a794f9ec2bebd04e170184c60a31cee0682f4fd48b65cff6ade70befd77ba0446cc42d6fe1de68d93b8ea640

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4536_2129199634\manifest.json

Filesize
119B

MD5
cb10c4ca2266e0cce5fefdcb2f0c1998

SHA1
8f5528079c05f4173978db7b596cc16f6b7592af

SHA256
82dff3cc4e595de91dc73802ac803c5d5e7ab33024bdc118f00a4431dd529713

SHA512
7c690c8d36227bb27183bacaf80a161b4084e5ad61759b559b19c2cdfb9c0814ad0030d42736285ee8e6132164d69f5becdcf83ac142a42879aa54a60c6d201b

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4536_252153777\manifest.json

Filesize
116B

MD5
d20acf8558cf23f01769cf4aa61237e0

SHA1
c4b21384309b0ff177d9cd3aa4198ab327eb2993

SHA256
3493b321a7fc5e183ed6f223ae55ce962541717d0b332d16bdc7cbcadf7e6f78

SHA512
73d082cbd71f6d0f06c7afc1bf63ee41c9a8e501df3e56f21a551b2d369a0afc8306894c8e0a38d0324e2ac403ec506ac1ecd8e9b61a9cb27134a229ccb13725

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4536_391328997\manifest.json

Filesize
118B

MD5
e17033475c5d0632b8142e61eb70b2db

SHA1
fcb918489b441cb2b3239bd1fd582dc0fb55d939

SHA256
0f4cbee2aac3714f6be3ada73202950f897f18c1cec7e23cf29931502d1c1e98

SHA512
7a458be534f73d273f8c2be6258f4829e9c6924e9c58a51ef60a27989223085bda87d52e36e2a5fa9bfe58e54dbec3c245ad456ae232548ad1e6dc23a8f2570d

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4536_624372076\manifest.json

Filesize
238B

MD5
15b69964f6f79654cbf54953aad0513f

SHA1
013fb9737790b034195cdeddaa620049484c53a7

SHA256
1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd

SHA512
7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4536_70471297\manifest.json

Filesize
72B

MD5
a30b19bb414d78fff00fc7855d6ed5fd

SHA1
2a6408f2829e964c578751bf29ec4f702412c11e

SHA256
9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f

SHA512
66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\Notification\notification_fast.bundle.js.LICENSE.txt

Filesize
551B

MD5
7bf61e84e614585030a26b0b148f4d79

SHA1
c4ffbc5c6aa599e578d3f5524a59a99228eea400

SHA256
38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179

SHA512
ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt

Filesize
1KB

MD5
8595bdd96ab7d24cc60eb749ce1b8b82

SHA1
3b612cc3d05e372c5ac91124f3756bbf099b378d

SHA256
363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831

SHA512
555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\json\i18n-tokenized-card\fr-CA\strings.json

Filesize
2KB

MD5
cd247582beb274ca64f720aa588ffbc0

SHA1
4aaeef0905e67b490d4a9508ed5d4a406263ed9c

SHA256
c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5

SHA512
bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4536_749256302\manifest.json

Filesize
122B

MD5
0d77c27baa669b0714c49b73e68447ea

SHA1
65103c9707e083c5503ad9979560ba1bb7634ae4

SHA256
c853d6a286d9d31a382c6d3fb109d5336d275651950f22b8243289eb6125b516

SHA512
1f011c405ec558229a1f5e2923b38b7054144c66d4c69d658c9c2c371f6cc365317485c274cafcab80bcb88f989b0be4c43c763933de3f86362a79ec1e962ff3

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4536_904631641\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7edef1b4-654b-4452-ae85-3ec2c4443ff5.tmp

Filesize
392B

MD5
1870298639375076767c63b3c9e5142d

SHA1
1be8d22af72407194074ba6ece525b63b4247b75

SHA256
8997410d2c22243f9ff220023d1f0b74a67ca02423231d2437b5eb7c69278dd7

SHA512
3b8aad575958f8bd5735681de667acd969ebcb06c5ec48da1f304319ea762acb008b4297e3ee67b9818b908cec54bc4e9e1bb723b55e1119e08c60b607425b38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.15\autofill_bypass_cache_forms.json

Filesize
175B

MD5
8060c129d08468ed3f3f3d09f13540ce

SHA1
f979419a76d5abfc89007d91f35412420aeae611

SHA256
b32bfdb89e35959aaf3e61ae58d0be1da94a12b6667e281c9567295efdd92f92

SHA512
99d0d9c816a680d7c0a28845aab7e8f33084688b1f3be4845f9cca596384b7a0811b9586c86ba9152de54cafcdea5871a6febbee1d5b3df6c778cdcb66f42cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.15\edge_autofill_global_block_list.json

Filesize
4KB

MD5
afb6f8315b244d03b262d28e1c5f6fae

SHA1
a92aaff896f4c07bdea5c5d0ab6fdb035e9ec71e

SHA256
a3bcb682dd63c048cd9ca88c49100333651b4f50de43b60ec681de5f8208d742

SHA512
d80e232da16f94a93cfe95339f0db4ff4f385e0aa2ba9cbd454e43666a915f8e730b615085b45cc7c029aa45803e5aca61b86e63dac0cf5f1128beed431f9df0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.15\v1FieldTypes.json

Filesize
509KB

MD5
c1a0d30e5eebef19db1b7e68fc79d2be

SHA1
de4ccb9e7ea5850363d0e7124c01da766425039c

SHA256
f3232a4e83ffc6ee2447aba5a49b8fd7ba13bcfd82fa09ae744c44996f7fcdd1

SHA512
f0eafae0260783ea3e85fe34cc0f145db7f402949a2ae809d37578e49baf767ad408bf2e79e2275d04891cd1977e8a018d6eeb5b95e839083f3722a960ccb57a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
cf3da7267cb6a35a74a4dceb3097a615

SHA1
a1b06c52d03147a6adbad9d32436b3b497115584

SHA256
18a6d652dd17544c9feb2e01621ed64b958b1a26bcee81e29ab29d5a409dc222

SHA512
6238eb406a42dfdf3faf7b62c92c6c0993974617f2ff403f6cd0a23dd2d53893bd96e92e78bbe6ba35ff191cdbcb8ecd69318c76547df76341ce9f2d43aae71f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
331B

MD5
a0627e443b2dec694cd9bd37de881da9

SHA1
4f3bc01eea5662b199ee030fc0ed148812231c1b

SHA256
70fc206f5d24f747fd07199fa628ba4d3dc8e04cd5a15b6628f968b5ce111ea9

SHA512
bf9eff034cc55ff08310edd008828b4a4615f197504af224da5a04cb16bacb3a58d65f50b31b6f8ff1a2135d44d5d9fcc154a7036b88b2f4e258edcb59fc9118

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
7KB

MD5
6302e20a16fa7bb4008effcdbca5481a

SHA1
1bbcb2706396cf80f053f145f7851b4342735586

SHA256
4c2f32740ce34d9776926005e1016527c58c9eea8f89e67e1f41286f5e31e4b3

SHA512
b36b31242b584cfb00de429e1dbb60c50fbc38e3155755e8cd2fab1d52719279e0d50dc1a06b5f10cc0febf05bad4e4e9f128f3d6a789db331222c266cc26191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Filesize
151B

MD5
2bd6f0c573044d75afd133cb6e64ef4f

SHA1
17935617df5fc31150adc9452ec66a9d8b9e2eda

SHA256
a1c2fa2efa59f9b2053a0814bc301e1868a3bbf28162cc68d7f4370e47918a56

SHA512
dfd67ed7ee9123256c04c4f387d302274f1b9efb1c024bc81b633d8c499eee5450c31050904f90983ab6144f9ecfd4cf07c66756dbe7b6522e4f9b68e52e1907

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c8

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c9

Filesize
67KB

MD5
cc63ec5f8962041727f3a20d6a278329

SHA1
6cbeee84f8f648f6c2484e8934b189ba76eaeb81

SHA256
89a4d1b2e007ac49fc9677d797266268cd031f99aa0766ca2450bff84ac227d1

SHA512
107cf3499a6cf9cdcbfa3ef4c6b4f2cda2472be116f8efa51ff403c624e8001d254be52de7834b2a6ab9f4bcc1a3b19adc0bba8c496e505abbca371ef6c8f877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ca

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cb

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
10KB

MD5
8b3f8401c7f1035c73b5a473e3766006

SHA1
ba2bebeb186d1cd7ec3c7f37accdc623fec37118

SHA256
1048d1ef65a3e1a76ee6911230fe54d652ed94b7d2c1040d14c8296c302e60da

SHA512
87b2317053f8550f2b5a0783f1ffa0c97c292b93e7691241c9cdd6fcbfa38ebb2cfe36ceb5c3617677ebf3cd017225ef3a2b89aba6103d92b72cb43459fbc733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59135f.TMP

Filesize
3KB

MD5
346f7ab8042d1edbdfba97335266352f

SHA1
1311af322c70edc93b49013f36d0db169088b476

SHA256
d5ecb22f17521a308419d393aad4283e4d4c876ea7e38e4e12e639d030ed2542

SHA512
124fa6c98514ae9e1013d984587627eb0c201f340a2f73edc4e4cd8fa21d55a491a9398902ac5a341d29c3ce3c2e571ea23911e9dc199a217c4e5782a7552436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
e3f705065bde786f3bb42df823d7dbf9

SHA1
db89d8d8625d743a2ec2a70c7bfe33596dc4fa40

SHA256
a8e3d110a48b596b8ba4ab1584daab98428316d14ba68d1f2240435af1e0e910

SHA512
20ad9b9ee370fdd4c45d07b7eaf965f627f03575317e6fd720f70ab51dff04379da027c355e55bec047bd65915c41a0c198616d7e9aa837ffe8b57d11138c124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
da846f9ab4a1404512e782bf9530f45c

SHA1
ec447607d17392d7049d90b6aebf0c2a0ee86035

SHA256
0df6fcc327b2e5cc2e56e025fe458ffa88897c89fa869a6219c85d1bb7c4f3df

SHA512
99557743e4759a7594da82cbd023e8bf9d3cc30eeffdc79472af63ba7459b96888af7663ddb859f872df166288e6f54bb6dcb30759b78df3e4b052bb1138421c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
209B

MD5
f1086cae26ffa7ce475b25d836b43f95

SHA1
f3e26e45135357839a2a427d6cf4f99413e28cce

SHA256
384eed2238090b310fdc4df980ffa40fa562f846c099044cdfd7f6c3c9ca2a12

SHA512
8778bea3505016f8be920b24068421b488e471f87096aba2e2486009700990f9e6360fb1d76d6d95c48fcf6b69c3f131c2ef0f3780d35b641462886b5811f5e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
210B

MD5
99bc6e361d83d0e1424129e6e4be5f58

SHA1
27272feaf0be8aa1aa6eb6d9e6721622d9d885c9

SHA256
c850cc5ddf34906ffd4c6d62c8701bf468c022488e8108c2b53e19d4281604c0

SHA512
1cb0da1c5d60a117aff08027ca681417c9526ed2246212f7cecc1d2230b4b976228e7bcb008174dfa19ca2036d3c083c938077fb45e1b9a768ad84a4c20b4403

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
96c560bc06a6b63a73642791d2b46e77

SHA1
b49dc5fabfddac2b30492e1d86c62ddf487113d1

SHA256
c7cda576785ed18a94c7a9024bd4894f867af4c83fadc9fe251d09a876df3279

SHA512
737c3deef15ff671a61169a0cbc28aa85528a85874e87d2505eaa32d6f62fea8476b3797c770096d0038e90edba9b2ad5d759a4f6f5a0c312f4fa73c83cf23b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
92deddca430a3e580e1f4efaa592c27d

SHA1
cc181c684e77d3735f44783a6ddb4877d68dc94b

SHA256
2eccfbd333bc78c69fc50917690848d6c1434d5c315e02e06e7ad68fd3bcec80

SHA512
19889a581b3b20ab1059420c18895ba549f9236c5a9e1aa613bd6af57002252f21a03df21741b6fbb2cb5470037eb25d7e23ad995629e77efb7f06f768c7b834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
34bff9fb7fb1aa6f2099c030bef9fc37

SHA1
e7ae9ae2dd19ee082c00cb9d449eadb589332c41

SHA256
f113b8d4228f316e6bd0bed8450984786ea6bb0f3dbd92dc6f67d86ca552d133

SHA512
8a55ec837cc8e70ae888d1d7c1a7eec89c67cdbbcedbe584f1aaf5ede451494158f9eb68450d3c51b827aefa08ce42a5c7df84818eec4b753b41723abadbbfc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
ae40300c677a6819a0fd6ed23b961222

SHA1
56a23135389b97464919a3f596824d225d817664

SHA256
695c40812d3248d05bfbf702e4f3faa4b428a1345e63bef785d6ad580bb888e6

SHA512
d74b0f5a47f40a3a9a993e98f87856dab8d5022aada19026d166466426b1a9a20ccd4d11cbbf0dfc443a53452a4ca07e03461bf4a7eea482dcee22dcd5e76284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
8ca4b046397cfe1138e075521b094ee1

SHA1
d47022295c5e0f25911369aceb8eadfd9339a577

SHA256
dc95932654e00d7f6748cb73f0b2bfa02b860f9c58c730a7f2368823ea42fe26

SHA512
61e0a7c17a3e6706a8eab8a2dc5ae5ca2f7415e79ee2bf48397c9ec7491d10d189ded4db50481fb846734c380bdd44e42cdb8c3d84537ca3943d74c4374bc2eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
f65fa2e1f497da5b84604ba04927c62b

SHA1
46164c715230ebd1e041cd35a17686565b71e331

SHA256
410b94da7df906b49e4cb53a0f41b168cf0d2dfa09a844e36686fe831924ae7e

SHA512
74380f6a111db0384d4a3d84bd5fe249625544bb28eaceb9a35be0fc6bd4946369b9fcf4adb97276167cc83f2a7b77426d5f2eafc4e233c5a237587db2fe0f88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
266617750e85b4976f159280b7979bfd

SHA1
9241ac54312c4144159f494f71a43e7dd97fde20

SHA256
81f608341dcaca913b5183567deacd35025d1087a7c794c2683ed5fb122e918f

SHA512
3186b3a10b29f039af6ff0f01cc38e785ed5c32a8618e7dfc85717cbdb4756831b78aa13ae7e68991b666cc065e9bfb089b63ffd2b269eb51e7f6518b24ac826

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\662ad1ce-cb68-47d3-88d8-8c1fa4e08530\index-dir\the-real-index

Filesize
72B

MD5
4259a650a244a2905bc5c1584d963ca1

SHA1
ee06352dc7de2897fdf34a2c4a4b27c357e0e442

SHA256
8addff97accd51297146f4bb57ce6168083972d19be0fb1fc9a0873df27084dc

SHA512
22515177fa49748cb8dda03aa977c30e18f5da7976c69fe5c593af7ea5d90a29f0905848d08520650416ca8852d334fa8094039f60010760b570fd399e32043d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\662ad1ce-cb68-47d3-88d8-8c1fa4e08530\index-dir\the-real-index

Filesize
72B

MD5
6837133c57d3f059defe96807cb27600

SHA1
95263a129782ade504ef833aacc9f3bb004ca925

SHA256
f07bf5f378d8da883c544d28749088c5d4d32ae938f4e525931437e753ef77f8

SHA512
dd55f5f3c0b51bc83d87c3c8751fbccb5b08f0a59ff634921b9f6bf6bae85479114f38491c52c1f200cbf1c914200b9879563e3426e3b3233df59f8e82bddf64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8eb518b8-0d69-4be0-8146-80caaac45029\index-dir\the-real-index

Filesize
1KB

MD5
d988d4090ebd5c4d52b13d77b693dc4e

SHA1
5b7ed873f949b70aada0cf6829c8e9fd14d2530d

SHA256
77fcf883fd34bc80c59d2dc63a6274fe9146fd453ea29ac82474f68d06d83568

SHA512
e0695e08bf4d1107e53062310308a7d6b2aca164bc5b84fba2042d65d7da0697912bf33561d6c5cc38db734cb6ce46936eb07ca8e5cf848b4af4595b8482ce4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8eb518b8-0d69-4be0-8146-80caaac45029\index-dir\the-real-index

Filesize
2KB

MD5
45b3febd6041ad4943b85995b72b0584

SHA1
ea33b96edde657fd87692a927c083fc25da77488

SHA256
3c073d749625c84907586e7ae26092bbd91b2d21d3d460fe0e1693a14225d116

SHA512
d356c16ede9827228c3868e78460ebb59fc0e0f2c0f3994efc8d38e40a7569c510564ecb49b0a3656bda7a2c71612b3b698856d7c2bb73955e87cb9a113b158f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8eb518b8-0d69-4be0-8146-80caaac45029\index-dir\the-real-index~RFe57c563.TMP

Filesize
1KB

MD5
cc663cc02e6bb8b336b8399be6947e17

SHA1
ad0bea08337bb32ad57db8db89f1fdd15d72f84a

SHA256
0c149b24eba52090bcbd6b5d09e3c6b10c7ab1c790acfcbda75dd10b9baa1252

SHA512
9a74a8bfc4f6999ac289980803d74d50a8cae68908d8aa9f7e5dc056d6443e785958b058e899631918175c3d2fe3ece24055a1dbf4bebe2c7324085df1f3aa3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
5a148f4a66e8e67279e6e8bbf1df72e7

SHA1
5736abf809117566688712aaa967dbc65efca692

SHA256
8465eff4165b5cffbee62a3a1e519c0a12b6756e96703bdbf281e4fb41fd24d4

SHA512
8cd4bf215f7aef7b0bf954b8878af83877fb5dcf9b5548cf60d2bcb59e8ddfe020e40b39e30c7e74492574ce3a5d564127b24701de07202fbf87364171037eea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
d30916666769445b40a93b6b3e37a6b1

SHA1
b02ca63da57d7333fdfcdb069ba11c4b497e0858

SHA256
8a10cebdaeaa5aaded0a8effb71623fa1e24fe48c4cf9ae4473d3d931142babc

SHA512
96ff3178da406e19138491f94add8011653fb8c8d641189629a23609d6d5a4fdc9d73606464c971635b8258464df178a23fad7403cd0107f79023b2e7441abb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5822c5.TMP

Filesize
48B

MD5
3dd5845facde158e28cb598344ff71ae

SHA1
53882968c7ba1f86f40b72d4de1fb841fad5f9ee

SHA256
5af671146486ebf645cf5f90724db606185cf271b162600153585d5a1c328677

SHA512
bd12107994b0f1b65cb461b43112e39281eb39abc2d5b66614f51c483f19a3e319adf54ec95c39b23f9e49fa24613b690d5574f645e7dbfd7db1930eb5f67608

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
8deabf6b5c9537c977343b411b20cff9

SHA1
76b9adea78c5ce5b15d75e4a69fc40d6bd0f1e79

SHA256
4cb3da6d8a8a03b3f0f592af0e4cf35d46c54af258a20383e2bacbbe1ce276c2

SHA512
f33d0504eeb529cc9e81250e3094225a5f8bb59d215a2ed4758976ec9494ccb1a9da75bb30da2e2f16704dc1d679c8efb1bca5fb46ff6052244890012810288e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
465B

MD5
f02e942f5f31e4cd792ed8851b059c73

SHA1
420fa0c7520e75a51007402ff22610a3e39456fe

SHA256
7cb8f6615ede4bcc8bc8c835dd922b63e1e768d2c454f2bd1a9768baa2f79d1d

SHA512
e56641ede039091ff86dfb30a333baca68f7065a2e2b533ccc306a98e91e92579c4bf98e0b5c80335ed1fdcc5439879dc2b08bc322c1e3ccc772e565a80f73c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
688180e2d683cb407bbc3993f3e7ad58

SHA1
b6a0f25965e1f85303fb86ebc192b0c6af3b5669

SHA256
83c8f1da6b663c235594da76ed029992013e4810e01566175788cdcae890a07f

SHA512
cf9d7ef7b4354d2d542f7f204ba4ae3616605c996396c4d9a89680fc3a2a51009448a1c6e1db07c873127ed4f6721b7c06bbbc29573aa194fde0fd7c0eac01bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
896B

MD5
00e199897f9d0776d4dd860e1af74bbd

SHA1
de0c0c4851efec90b8c6fbb26a1506755696726e

SHA256
33c397354c49145ccfa1220e7d8e7d10d71264b88fd059a359e02898d790ec4e

SHA512
6e437c311b176e8e5981f0c2a9fd21d720d1174e5d47c40f9af67c9db6f8744175fba66cc9e2fa1b51764230c60af6a4a144246e94bcd3df96f1b18c292e20f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.38.0\edge_checkout_page_validator.js

Filesize
1.1MB

MD5
7e5fa4ed6aa17f661f32f60b1528b8cb

SHA1
fb8fde8a15183eabc587e9e141499564c36e73bc

SHA256
5699c475bac8a24c856db71228628d0cfe1a6ba6b1c6be6a14e73d6aa835cd28

SHA512
18968db3a1cd8704ec7e9e619dd025c457085e81c27ffd3ab4af707a2daf8e870790175d93a0e6992181187a62bfa19b818c262bb0a1514ac15b3598a7e91551

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18347.18346.65\json\wallet\wallet-checkout-eligible-sites.json

Filesize
23KB

MD5
16d41ebc643fd34addf3704a3be1acdd

SHA1
b7fadc8afa56fbf4026b8c176112632c63be58a0

SHA256
b962497993e2cd24039474bc84be430f8f6e6ab0f52010e90351dc3ff259336c

SHA512
8d58aa30613a2376ccc729278d166a9b3ec87eca95544b9dec1ee9300e7dd987326ea42d05dca3f1cc08186685f2fdaf53c24fd2b756c1ed9f2b46436689dc74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18347.18346.65\json\wallet\wallet-notification-config.json

Filesize
804B

MD5
4cdefd9eb040c2755db20aa8ea5ee8f7

SHA1
f649fcd1c12c26fb90906c4c2ec0a9127af275f4

SHA256
bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd

SHA512
7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18347.18346.65\json\wallet\wallet-stable.json

Filesize
81KB

MD5
05f65948a88bd669597fc3b4e225ecae

SHA1
5397b14065e49ff908c66c51fc09f53fff7caed7

SHA256
0e329e63d8457bef61d0986a521f81d747a09dadf3b1136f2011942ba14d9fc0

SHA512
ed7b767a741d18c0dd35e0311db752120e0f090d39ef976d541cbc5ae78fa32655cb3f9c27cddef6ca8091ca8bf31513254a748bc8b95353897f6198a667cf58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18347.18346.65\json\wallet\wallet-tokenization-config.json

Filesize
34KB

MD5
ae3bd0f89f8a8cdeb1ea6eea1636cbdd

SHA1
1801bc211e260ba8f8099727ea820ecf636c684a

SHA256
0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d

SHA512
69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
1bdec85f699c9b025d2beb5a04448367

SHA1
890026f2a69dbce2810f4a6061947c5276212d8b

SHA256
9ea5c2551b37dccc2d2e4c7b4c08d5f03a378db69af382cd166e2e86c2848c0e

SHA512
7ea24b6ce8605137a6881cad50515ef7d224622a64f9d2621585f2dd2dce9665d311bc970819977857cb072da3797db9a193496587f3800deb281ff0fc3315d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
c0e98ea6ad72f61b17dd9e66d4cfc011

SHA1
ac9f1fbed16217c64a8a54989ed0d02c3f54fb4d

SHA256
c84f431352a9170389ea4b265418052c47a3688b3ab881988a96672bf68e7c59

SHA512
5777be6918123727a9f1f8ba6b38b3c3dbfa2cfe0a6f0ef28f9872923dbfcb6eafe79841c2b9db8fd29b85c10846e49cf2124cc365065a05187856f70b7266b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
c4008a37e9d2e0b9eb0fc9a2fbf5db61

SHA1
8df29c82635c0d5c18c1e3ae335f0133c4b94ba9

SHA256
ec4ba58630725f97aa1ab54a8b58dea00e327f4f606a6de43f306f60491b0b7e

SHA512
e4ddb02eff3f01aa37a6cefee478f8043e825b2f3a09db15f944454d500d24801ba5494a3f1d64eb47737623fedd21214f053e10d3cb4f82c040b6a521cbaf2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
81d6ea89a5bcea15e4d4fef1d8e02d2f

SHA1
7d570fc4c78e0e7343e12cbd37872aca3280b01c

SHA256
bb5ab13a574567360e25f7d4ac8833e390391dc9ca045c244d16c6becbacf1cc

SHA512
99afab781c8cc014a3840842970fd5baffae74d4c6cd22d7b280edbdce45071fc199ee7c96b41da6fdae937292ab8e67c109e18b0a163b3c8787d0557b7b4cc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
4487dc561b17b8d9f458e2ec1d855462

SHA1
720220a4fa5c264b7419bc4604701495613af3fb

SHA256
42fe4d1cfdeabba464760a49618b4eb4073bc4f9a4c8e8096fe39bbae3125665

SHA512
036b47612a0fa315ed42f016668be00f72b023d5400bd03247417d4e6360ce3195bfe3afaee6ea58a09c94590a496641318cc9d3b28204eef73b7a83766dc7e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\crs.pb

Filesize
289KB

MD5
2b59269e7efdd95ba14eeb780dfb98c2

SHA1
b3f84cbc37a79eeecb8f1f39b615577d78600096

SHA256
ff2ced650772249abb57f6f19c5d0322d6df22c85c7cf2be193b6134e1b95172

SHA512
e4b454db2248021e0d198805ea54f1c0cfd84b9716a9348b1d0e0acb7c6fb5dd0839e532a5eb6d4410ab759d6688dd6cce8375ad55a150d738d280993142e9d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\ct_config.pb

Filesize
8KB

MD5
811b65320a82ebd6686fabf4bb1cb81a

SHA1
c660d448114043babec5d1c9c2584df6fab7f69b

SHA256
52687dd0c06f86a2298a4442ab8afa9b608271ec01a67217d7b58dab7e507bdf

SHA512
33350cce447508269b7714d9e551560553e020d6acf37a6a6021dc497d4008ce9e532dd615ad68872d75da22ac2039ef0b4fa70c23ec4b58043c468d5d75fd81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\kp_pinslist.pb

Filesize
11KB

MD5
0779206f78d8b0d540445a10cb51670c

SHA1
67f0f916be73bf5cffd3f4c4aa8d122c7d73ad54

SHA256
bf0945921058b9e67db61e6a559531af2f9b78d5fbedb0b411384225bdd366ec

SHA512
4140b2debe9c0b04e1e59be1387dca0e8e2f3cbc1f67830cbc723864acc2276cde9529295dcb4138fa0e2e116416658753fe46901dfa572bdfe6c7fb67bd8478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
6e2cfddebe1a6a2821f92dd9b0b8c564

SHA1
070b1469610e94ba5d40a6eb406d2afffefa1711

SHA256
463cd4dd1cfb233067bafaa331adbcf1dcfddea39245d9457bf04a39b7de7ecb

SHA512
9be52f6de13481f60b6a69a6ef47c44dd1f4a007f455bfe923a805d6bada70eb4dcddcf0674a51b9e26f48ce4885a4fc3748a513bc62242b8b5cdcba3207a729

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
35bf3b6f50dcc07e7b4315b4990ae177

SHA1
38c24d3209c4f6af0d5edc9aa18a4b45cbfbdeec

SHA256
4a3daa975d31866c72889a8b1698190651dea585d345a347b06c770ecbc6f765

SHA512
3575af11567800bc09edeb958ea3ef743b9caaff34f79d4ed141bd0cddb1695e8dee39239a90010be80a140f195a68bfba954ec7fbe93689bb1d1db1a76db88d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
d24a2df9678a2e266ecdaee78fec298e

SHA1
057f0a8329eb165a1207ebce38eedd49e4a08752

SHA256
f93f1b8c61bcffe88edee4c75387fb645f1706a5e5dd0b1d5369edb2a26fe6c4

SHA512
daeea8df313f30f5772349d7520478f9f5ed8a3f30d46b4eb44a9fbdc37cef7f54415e4a03f0e08dbf43444dfd5d00bab7cb7920f98574ce86cf16e98a5b7e97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
516455037b1c8e6c02a82f60f6c2220a

SHA1
7c949058b31b79f7b39e6e4354ee65aea2f9b083

SHA256
f4c7fb1cf62e69d96a3ef478d1f59d067e58ba4786e2da75bf04993f29897653

SHA512
ef31fe02abc74a02d863debed07cc94a854b5ed6d0658801276ca67438ca495a5b158c904f7ab905a41b14122a4efa0027807daee068e4974573264c0cc7cce4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe588a2a.TMP

Filesize
392B

MD5
98a672687f203b4ee23b54d488662c0d

SHA1
31f6d96fe8e6d0923e7df5a7df597a14f36105d5

SHA256
69187afb10eb8f18baf3a0c17fb6c62adc0d6f921318ced48056b274970584de

SHA512
b2d27d6a626d1b3a0eb121f729cb4fb770db2c92280d4e0f8661260c2987533b566a97da028122ae885f6d6c067e2c5bef2a8b9f0d0a58f2791f50355cb0e428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb

Filesize
163KB

MD5
bd6846ffa7f4cf897b5323e4a5dcd551

SHA1
a6596cdc8de199492791faa39ce6096cf39295cd

SHA256
854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666

SHA512
aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb

Filesize
3KB

MD5
17c10dbe88d84b9309e6d151923ce116

SHA1
9ad2553c061ddcc07e6f66ce4f9e30290c056bdf

SHA256
3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e

SHA512
ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.76\Filtering Rules

Filesize
1.8MB

MD5
d7c9c6d2e1d9ae242d68a8316f41198c

SHA1
8d2ddccc88a10468e5bffad1bd377be82d053357

SHA256
f215127185b2ee6b01e12b6ca75d3e5c4e454598dd4aed36124ae13d59afd547

SHA512
7fd14824e9200dd99e1fd2cee402656dc0cfc3d0a60058c5eb05c68e9e65b7f0b47e550fb4d6c2b59eba204dbf3ef9e69dc9723b43a9b3ccd5412d6b77715fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.76\LICENSE

Filesize
24KB

MD5
aad9405766b20014ab3beb08b99536de

SHA1
486a379bdfeecdc99ed3f4617f35ae65babe9d47

SHA256
ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d

SHA512
bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.4.14.1\typosquatting_list.pb

Filesize
626KB

MD5
cd8f0547b4d0459fc40caa32edd2ae48

SHA1
f2a2267b07c94eee76441654294d4bee793913fa

SHA256
b7ced53d106f852e82076b850fe7794ddeaeaf137818339b95a35ffc170277a7

SHA512
0f1790dd996e27dbbf75a6520279941dcdd002429595e02646ceddae317f87fe34ca01049735ed753904ceccc1ecc24080e22c34ba6343ebb155c8e7a89085d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

Filesize
572KB

MD5
f5f5b37fd514776f455864502c852773

SHA1
8d5ed434173fd77feb33cb6cb0fad5e2388d97c6

SHA256
2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e

SHA512
b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
0eed6479e06a002038ad74dc94b2fe6b

SHA1
934ac08cbdc35cdfa53373bb7bf4ca890e79b86f

SHA256
6ae08d7f2ac6a2d8225093f6dc1b9039c9ca959ff4afdb12bcd4fd4212cfae00

SHA512
dd8120ffc83a16ff5fb3a7a1a3cff79ef79ee0445d8ab5d5b45fdc29f68a46ec08a6d734418c00309f30ba677fcdf73451fe0993556c415985dd6ac862408c51

Download Submit
C:\Users\Admin\Downloads\Blaster.E.exe

Filesize
6KB

MD5
8676210e6246948201aa014db471de90

SHA1
86b30d1a8b7515dcab6c8d2781b85c6983709dbf

SHA256
2e481059b9bc9686c676d69a80202eed5022c9a53ecd8cac215e70c601dd7fdc

SHA512
5130e6ea6c5e1924af7d630a7b1c6e614b1482edcad3117a8dc56371269260b97793a7ccdbf3249054815b7c3b9c364b30e73e0f8e4cc230502b01d0d2f70bda

Download Submit
C:\Users\Admin\Downloads\Brontok.exe

Filesize
106KB

MD5
d7506150617460e34645025f1ca2c74b

SHA1
5e7d5daf73a72473795d591f831e8a2054947668

SHA256
941ebf1dc12321bbe430994a55f6e22a1b83cea2fa7d281484ea2dab06353112

SHA512
69e0bd07a8bdbfe066593cdd81acd530b3d12b21e637c1af511b8fee447831b8d822065c5a74a477fe6590962ceff8d64d83ae9c41efd930636921d4d6567f6f

Download Submit
memory/1280-2019-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1280-2183-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1280-2709-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1280-2721-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1280-2064-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1280-2172-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1280-1959-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1280-1926-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1280-2630-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1280-3865-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1280-2105-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1280-2528-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1280-3765-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1280-3767-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1280-2237-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1280-3802-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1280-3813-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1280-2531-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1280-3832-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1280-3846-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1280-3855-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1280-3862-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4572-1789-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download