9afadba0006723439d704c1bf3af6cb9e3b3e0d4796dd2fe89d8fbcc7d25c7af

Analysis

max time kernel
144s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2025, 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

qs.html
Size

1KB
MD5

da9de559f7a4f35fe72c9b6d115e017c
SHA1

34a2fd2290a6bdaaf08495f9c89ca66489828510
SHA256

c40c04a36754e564213ba5f0fc09379806de17d45dca95038876ecc144695a5e
SHA512

91259ac8fca0c115b5193892d097098ca74684dc29943ee38cbe4ac79e3a917a524b8fe54723080ef21938f3730b812b33645b6da385a5b1ad9a74a0117a5ba0

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3200_1941207469\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3200_308355897\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3200_522070747\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3200_522070747\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3200_1941207469\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3200_308355897\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3200_308355897\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3200_308355897\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3200_182934625\arbitration_metadata.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3200_182934625\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3200_522070747\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3200_1941207469\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3200_1941207469\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3200_308355897\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3200_182934625\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3200_522070747\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3200_522070747\regex_patterns.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3200_522070747\v1FieldTypes.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3200_1941207469\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133894249920709377"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3027557611-1484967174-339164627-1000\{2DDB39F8-4B0F-44BE-BAB3-49BFED38CCE4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5852	msedge.exe
5852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 224	3200	msedge.exe	86
PID 3200 wrote to memory of 224	3200	msedge.exe	86
PID 3200 wrote to memory of 1148	3200	msedge.exe	87
PID 3200 wrote to memory of 1148	3200	msedge.exe	87
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 2748	3200	msedge.exe	88
PID 3200 wrote to memory of 4572	3200	msedge.exe	89
PID 3200 wrote to memory of 4572	3200	msedge.exe	89
PID 3200 wrote to memory of 4572	3200	msedge.exe	89
PID 3200 wrote to memory of 4572	3200	msedge.exe	89
PID 3200 wrote to memory of 4572	3200	msedge.exe	89
PID 3200 wrote to memory of 4572	3200	msedge.exe	89
PID 3200 wrote to memory of 4572	3200	msedge.exe	89
PID 3200 wrote to memory of 4572	3200	msedge.exe	89
PID 3200 wrote to memory of 4572	3200	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\qs.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x338,0x7ff8e9d9f208,0x7ff8e9d9f214,0x7ff8e9d9f220
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1836,i,13300656505159836638,15806856265555715995,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2204,i,13300656505159836638,15806856265555715995,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2452,i,13300656505159836638,15806856265555715995,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3540,i,13300656505159836638,15806856265555715995,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3560,i,13300656505159836638,15806856265555715995,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4836,i,13300656505159836638,15806856265555715995,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4856,i,13300656505159836638,15806856265555715995,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5588,i,13300656505159836638,15806856265555715995,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5828,i,13300656505159836638,15806856265555715995,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5828,i,13300656505159836638,15806856265555715995,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=704,i,13300656505159836638,15806856265555715995,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5768,i,13300656505159836638,15806856265555715995,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5960,i,13300656505159836638,15806856265555715995,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5568,i,13300656505159836638,15806856265555715995,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5780,i,13300656505159836638,15806856265555715995,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5212,i,13300656505159836638,15806856265555715995,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5904,i,13300656505159836638,15806856265555715995,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=872,i,13300656505159836638,15806856265555715995,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5404,i,13300656505159836638,15806856265555715995,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:5336

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:5176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping3200_182934625\manifest.json

Filesize
238B

MD5
15b69964f6f79654cbf54953aad0513f

SHA1
013fb9737790b034195cdeddaa620049484c53a7

SHA256
1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd

SHA512
7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3200_1941207469\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3200_1941207469\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3200_308355897\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3200_522070747\manifest.json

Filesize
119B

MD5
cb10c4ca2266e0cce5fefdcb2f0c1998

SHA1
8f5528079c05f4173978db7b596cc16f6b7592af

SHA256
82dff3cc4e595de91dc73802ac803c5d5e7ab33024bdc118f00a4431dd529713

SHA512
7c690c8d36227bb27183bacaf80a161b4084e5ad61759b559b19c2cdfb9c0814ad0030d42736285ee8e6132164d69f5becdcf83ac142a42879aa54a60c6d201b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.15\autofill_bypass_cache_forms.json

Filesize
175B

MD5
8060c129d08468ed3f3f3d09f13540ce

SHA1
f979419a76d5abfc89007d91f35412420aeae611

SHA256
b32bfdb89e35959aaf3e61ae58d0be1da94a12b6667e281c9567295efdd92f92

SHA512
99d0d9c816a680d7c0a28845aab7e8f33084688b1f3be4845f9cca596384b7a0811b9586c86ba9152de54cafcdea5871a6febbee1d5b3df6c778cdcb66f42cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.15\edge_autofill_global_block_list.json

Filesize
4KB

MD5
afb6f8315b244d03b262d28e1c5f6fae

SHA1
a92aaff896f4c07bdea5c5d0ab6fdb035e9ec71e

SHA256
a3bcb682dd63c048cd9ca88c49100333651b4f50de43b60ec681de5f8208d742

SHA512
d80e232da16f94a93cfe95339f0db4ff4f385e0aa2ba9cbd454e43666a915f8e730b615085b45cc7c029aa45803e5aca61b86e63dac0cf5f1128beed431f9df0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.15\v1FieldTypes.json

Filesize
509KB

MD5
c1a0d30e5eebef19db1b7e68fc79d2be

SHA1
de4ccb9e7ea5850363d0e7124c01da766425039c

SHA256
f3232a4e83ffc6ee2447aba5a49b8fd7ba13bcfd82fa09ae744c44996f7fcdd1

SHA512
f0eafae0260783ea3e85fe34cc0f145db7f402949a2ae809d37578e49baf767ad408bf2e79e2275d04891cd1977e8a018d6eeb5b95e839083f3722a960ccb57a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
991dd8fbe9a0cd6dc3637646bc73b6fe

SHA1
cd33a4c3c2cea06b41e5388826af365691769de4

SHA256
7e873150a039c5eda07ab3768e2b49127c3f824319d28909fe07f31d6f3119a4

SHA512
b8c1dbb54394674bb88fd7cf368214885e0c328e51651ee8f412aa1ab85151582c70189a292e24d551a8144de29f82e8e9b51ca5a695d33dc0e3326a78d05263

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
51b121f8047d5afb30358db650f5d50a

SHA1
09b3f74f65d89c5421fbbfe6a9fb48fde00eadc9

SHA256
6c33e96e0cce85cb06aa7c391f748e5de4e195385f7f94026bfb49aa158ce034

SHA512
c6352aafbf1b1d7bcb7996ba20ece09e6a464a001fb6ccbe5b4d6c930d4cc031c4697372ec30d11fee417d32fde0c95f9479d6dbd5b4d9c55cb21d7c97c10624

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
8b4abbfef98ed6d424edaa328fb29cb4

SHA1
7461958c05c902b6dad4dc4beb9722ceacbb80e5

SHA256
6c3341277320b5626d95d93f51f98b53139c54b7bc8161acffce08be8c964c1e

SHA512
1832a9de538ac31992f9aa42a7b325603fddf8752cbf6d45082d29dbcbcd65aa089dbacaddafa16f2139f248a544f97561c07f21d75ecc99f48df3789ff58fa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
417e21f2e6d75b2cf49a2ad7f80ad8be

SHA1
233f636b82198b45f283788d495c7f62b3da3759

SHA256
5b4f22f436fe45b0c524597714d6edf267cc7058bca2dc71e1b6daab2c2e362e

SHA512
8e825de63f0d2bf724b0e3ffdccc3b4213f62dd21ef0b964f3be207049050c0b7c5ca748c348b52d284804fbe276f129d83be13f45a80392c045e06a63b5a29b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
b0573743e1ec3f5c40bce01ceafd0990

SHA1
28e096bbac6692e371a841040f602e248d80c798

SHA256
8c6c16880dedcf9d4500abd6747a6057169c32087c8f7ae0b9be3c7b3e13f1a9

SHA512
b924c544c21690b9a4f6c9fab2b7b57cdf2627b9f0a892b90cc8ac144de63d54d65e2912428d0673fa1aa8feb6e2f273125625142c96d43374c8b69769f81033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
1e1c1d052e73820afeaa908ca8c61dc4

SHA1
eba9a858c08dfab05f17850f827fa418b963a288

SHA256
13b10d10c222e66b0d1beff95bf5eade3c74aa14b0b4026acf4ed39640332eef

SHA512
6d5db29fe678d5beb6edaef841d2efa66161e4f560b323b7bf56dec3babff39132c074f7056114c26a88c9b945ff571b2c8a25dd2ce2ac4b3eec316926c6379e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6892e098-c47e-4f69-a9b7-6ec03ad87c69.tmp

Filesize
896B

MD5
1b34442cec6502bb54d3c61505b6a8ad

SHA1
5203f38605693d32f5135867f308722f9be065c3

SHA256
668750177faa11ae1fe8300c2cd19747c3ee6058f8bc35c72c34b6941ae03735

SHA512
49ca80351eaa177c9caa94790509025541052cbb7450d7bf8bcd711c0d1789c1e33c20d6599d246cd0bc4903ada755ed8a9d5e23c84727d8bd5d73e6746cc9a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
e97fa33e54b8f321f96781f5517f3d24

SHA1
7973b61642201c15f3421cde5d9a85b2b811ef75

SHA256
3f62ea7ec621a72578fa49dd1909b31c223d0ef37df0dc73d3dcce787fe68998

SHA512
030ccae7eaf9fcad733ba0d972f56dc631c3ea89377c5a9dc73120369beb8d842c0f41b04a660053f55837ab7873fdeea7f7a46b2bf5e2aa18267d70c0dc3821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
465B

MD5
2eb92ce3bf0ae4e9e548d94521d779d4

SHA1
959cd31541cbf7ec4822e880453f588ab03b379c

SHA256
52f266e183334e24607167ec23eac54b8211d6ec91e853118ad553e0299f6343

SHA512
af4db47f0ff9a0986f30448c882d68a09cff1ee364f4038ea3b828e0fe1150c084810a6e3dc331ea6a9a38e023e066ea067a1eddc2ba7c07b44b1ae3a99c0f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
a043112dec8306d800ee9af03662121a

SHA1
05b18e748d06a00ac326228a2a51f7db00e90714

SHA256
0b57d830ec56691546e4512a0eb400d4a22f790bf20de971fbdfc7916509c269

SHA512
6aa873dba2e9b4de62b9c51d6148af207ddf51594b7b560b32e946b4aeb3786eb13fc6042c18b3d8cbd6c14c93fc551f35398f4f0a15ca9425afd7c72c4aacbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
45bc8c08a01ea63246667e84f8d3e1a8

SHA1
6cf97b746f21737e3b2ce2653f5108fdbb3b96d8

SHA256
b819d0fd88b7e4d85b4732b6aa8389b30a2b253ac8c6b389a2d67b5f66405b64

SHA512
5f8e5ada3c9549d389a8555dcac1c495a0a4c61cd64480755759003627f525046ade7d7fe8c7d55f0c965521a2eb3bdbc8fddaee04428dad94d046786c0b1c8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
48KB

MD5
f1cfa18c8faa133e10d2c33485d653c4

SHA1
2993e7594c1db2934fe0c0d710b7dcf69f5f0104

SHA256
95f009eb44de4c92b1a797c476c23c4e8f904ae346ac146fbb6f396fb9557903

SHA512
74a45529628bbbb6f72d736de945b43c8163a33bd6e4cb9a6d36ba835bd30b101bdde07fd4f0d8a427052a638c0071e2673d5968a7ee428c162c782bc792cb13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
b4c04cbb563ae7a49dc557e585ec019a

SHA1
d363ce0f9d770ce5c1ba9533d31837570de322d6

SHA256
b0ba9372a8d367999e860af8b1f261475a0dccc7d652837ad47303d8b8bc0cd8

SHA512
8ad8cfd8c29a3dbece84b7f568844ce16a5871e61827662ba686ff2e1309362cbc11b93184366883ae2c09f8c23eb6913eb8dca42c8a12f7e3414c242cdd5f08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
fdc1f1c693246592725d0175e488cf41

SHA1
7a08c22cbcc025f96cfe092a1a176d6aa39f2322

SHA256
b076c313f4b094630645918f5e20c92117cfff87ca40837fb1a0bc6cbc2be212

SHA512
edeb2c86139210b2995bf7f1f14e82ca2f0d94252e14132e73743bff401c0d17e7127aaa440576c44c4d5d1c93d14fdf597e04c176e03cd47fc847e5f73f50b5

Download Submit