8fedd0ca0e90c113950ca9fe3685c46bc51515ff68791ef26eb87dd4da965890

Resubmissions

19/04/2025, 22:20

250419-19hzksyjy2 10

19/04/2025, 22:16

250419-16282sv1fv 10

19/04/2025, 22:11

250419-1395gsv1ew 10

Analysis

max time kernel
299s
max time network
292s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2025, 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ColdRAT/ColdRAT.exe
Size

9.5MB
MD5

d1dd11a93098bdea72c1d6743d26ce8d
SHA1

38535678875626a2ee2f32a786e7e671fe19c579
SHA256

22cb65ecad3abf018473b6760958414740a009ead7b968cdc3ac889a38e0427a
SHA512

b1008af59d3df4a9645bd446afdeb77dfc53634b29f56b9fc37d82e90141d243e15468f7e2532859f9702701199fcd140126ef7541e5f65505f645a32a561bfd
SSDEEP

196608:VW6NA/0Lqz6Dc5i2cklYXrE1xTqL1WrJd4KT:YWW0q6A2QTqBgv

Score

7^/10

discovery execution

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2424	msedge.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1764	ColdRAT.exe
1764	ColdRAT.exe

Drops file in Program Files directory 33 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1579729415\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1915886737\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1231907266\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1579729415\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1578845086\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1578845086\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1470380445\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1915886737\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1298965943\regex_patterns.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1298965943\v1FieldTypes.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1298965943\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_22359914\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1675482844\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1578845086\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1470380445\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1470380445\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1470380445\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_22359914\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1675482844\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1578845086\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1470380445\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1298965943\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1231907266\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1579729415\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1675482844\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1579729415\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1579729415\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1578845086\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1298965943\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1298965943\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1915886737\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1231907266\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2424_22359914\well_known_domains.dll	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6128	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133895749594131716"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3342763580-2723508992-2885672917-1000\{7EC482B6-4734-4843-B3E1-DF267440815D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6128	powershell.exe
6128	powershell.exe
512	msedge.exe
512	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	ColdRAT.exe
Token: SeDebugPrivilege	6128	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 6128	1764	ColdRAT.exe	91
PID 1764 wrote to memory of 6128	1764	ColdRAT.exe	91
PID 1764 wrote to memory of 2424	1764	ColdRAT.exe	97
PID 1764 wrote to memory of 2424	1764	ColdRAT.exe	97
PID 2424 wrote to memory of 5844	2424	msedge.exe	98
PID 2424 wrote to memory of 5844	2424	msedge.exe	98
PID 2424 wrote to memory of 3404	2424	msedge.exe	99
PID 2424 wrote to memory of 3404	2424	msedge.exe	99
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 5920	2424	msedge.exe	100
PID 2424 wrote to memory of 2408	2424	msedge.exe	101
PID 2424 wrote to memory of 2408	2424	msedge.exe	101
PID 2424 wrote to memory of 2408	2424	msedge.exe	101
PID 2424 wrote to memory of 2408	2424	msedge.exe	101
PID 2424 wrote to memory of 2408	2424	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\ColdRAT\ColdRAT.exe
"C:\Users\Admin\AppData\Local\Temp\ColdRAT\ColdRAT.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $motherboard = (Get-WmiObject -Class Win32_BaseBoard).SerialNumber $cpu = (Get-WmiObject -Class Win32_Processor).ProcessorId Write-Output $motherboard Write-Output $cpu "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/ColdRATPurchaseBot
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2d8,0x7ffccc89f208,0x7ffccc89f214,0x7ffccc89f220
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1944,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2272,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
    3⤵
    PID:5920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2608,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3520,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3528,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=5048,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4344,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
    3⤵
    PID:116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4964,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3532,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
    3⤵
    PID:3948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5640,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:8
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6020,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
    3⤵
    PID:1028
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6020,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
    3⤵
    PID:5264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6060,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6168,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5060,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
    3⤵
    PID:396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5364,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5724,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
    3⤵
    PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6296,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=5576,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=5152,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=6016,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6012,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=5472,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
    3⤵
    PID:5304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=6008,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
    3⤵
    PID:948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6056,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=868,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=5188,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
    3⤵
    PID:3640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=5168,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=6196,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:6032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=3624,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
    3⤵
    PID:728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=5300,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
    3⤵
    PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=3764,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
    3⤵
    PID:5744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=6396,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
    3⤵
    PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5500,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3460,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
    3⤵
    PID:1892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4908,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6120,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:8
    3⤵
    PID:1004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3388,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4856,i,10385811200660098256,18320790820696667974,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:8
    3⤵
    PID:5836

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1231907266\manifest.json

Filesize
118B

MD5
a4f6a8fe38bc86d5ecc06e0e30011160

SHA1
43aeb686f1762284aecb49e5fcf16f93dd64aa91

SHA256
c4d13a25e286281d81676b8cb8a7572d88b38710c9a69e21adecbc16fd185654

SHA512
9badac8cc91a55b579fda71441aee06958d2a6a3cbdf840ff60c2493a97c3298d8eac194b13208fc11f1f0a5fba24982af8d08def3478226ff1d14e953dfa834

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1298965943\manifest.json

Filesize
119B

MD5
cb10c4ca2266e0cce5fefdcb2f0c1998

SHA1
8f5528079c05f4173978db7b596cc16f6b7592af

SHA256
82dff3cc4e595de91dc73802ac803c5d5e7ab33024bdc118f00a4431dd529713

SHA512
7c690c8d36227bb27183bacaf80a161b4084e5ad61759b559b19c2cdfb9c0814ad0030d42736285ee8e6132164d69f5becdcf83ac142a42879aa54a60c6d201b

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1578845086\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1578845086\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1675482844\manifest.fingerprint

Filesize
66B

MD5
496b05677135db1c74d82f948538c21c

SHA1
e736e675ca5195b5fc16e59fb7de582437fb9f9a

SHA256
df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

SHA512
8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2424_1675482844\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2424_22359914\manifest.json

Filesize
141B

MD5
811f0436837c701dc1cea3d6292b3922

SHA1
4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87

SHA256
dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d

SHA512
21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.15\autofill_bypass_cache_forms.json

Filesize
175B

MD5
8060c129d08468ed3f3f3d09f13540ce

SHA1
f979419a76d5abfc89007d91f35412420aeae611

SHA256
b32bfdb89e35959aaf3e61ae58d0be1da94a12b6667e281c9567295efdd92f92

SHA512
99d0d9c816a680d7c0a28845aab7e8f33084688b1f3be4845f9cca596384b7a0811b9586c86ba9152de54cafcdea5871a6febbee1d5b3df6c778cdcb66f42cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.15\edge_autofill_global_block_list.json

Filesize
4KB

MD5
afb6f8315b244d03b262d28e1c5f6fae

SHA1
a92aaff896f4c07bdea5c5d0ab6fdb035e9ec71e

SHA256
a3bcb682dd63c048cd9ca88c49100333651b4f50de43b60ec681de5f8208d742

SHA512
d80e232da16f94a93cfe95339f0db4ff4f385e0aa2ba9cbd454e43666a915f8e730b615085b45cc7c029aa45803e5aca61b86e63dac0cf5f1128beed431f9df0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.15\v1FieldTypes.json

Filesize
509KB

MD5
c1a0d30e5eebef19db1b7e68fc79d2be

SHA1
de4ccb9e7ea5850363d0e7124c01da766425039c

SHA256
f3232a4e83ffc6ee2447aba5a49b8fd7ba13bcfd82fa09ae744c44996f7fcdd1

SHA512
f0eafae0260783ea3e85fe34cc0f145db7f402949a2ae809d37578e49baf767ad408bf2e79e2275d04891cd1977e8a018d6eeb5b95e839083f3722a960ccb57a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
df2d1721cd4e4eff7049314710dc7c11

SHA1
f5aed0158b2c0a00302f743841188881d811637a

SHA256
ba336ffd1b01965d7ab0e5fac5415e43cb594139c76b19e4c0d9b5b3b67c1e93

SHA512
11fd520176193f284563c7d050e6a7ab4e9895bac49fdc05759bab2c8a69f224858ccc784b351fc1d3ee5d39345430f9234623c9390978d7daf6a08ff5576ef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072

Filesize
29KB

MD5
21c8de3de813f933f27959cd480452ba

SHA1
2f8f04bdf0cd52f3f10c73ec4c0673a1aaaeb832

SHA256
22d13d7262496b0b2507ff8ca8a38538b5fed04f19c288074e63a5fcfaae10e7

SHA512
dc0bf35fd279848c5e374ac562e727b1a0e2c5ec5404811afe9c7a8c06c1535ee7e58602ad134a9995cfe22402a7cdc4241803d263c0e4b2c7a67f0d50c4b4e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
be0b351c9316b74d0d0de9f6192ef3aa

SHA1
09ee761d5088c92905e474ed39bad2cd0968188f

SHA256
1c84a6f108f73e7c5b74d40626a38b94b70bb6ca4e7da16743d3d2322c0029d5

SHA512
bc0f6102fba69ec7c7d7ec4517d8b6e925a2d5752d007dd9e175d5cbd3e08dddbfca9eb8ffb12977926d742a7e34762a2f1b71bde88a3726a0564e1addf47f16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
6468e3801239c2da575a2095472605f8

SHA1
a79011560d09f2c014ea2ce43fb2139ea122e434

SHA256
7b2c1bfd9e88bb405c9cb82308ba4919ab4b461407acdb77ea9fe9cddc360fe3

SHA512
b204afb16dc75f40eacde3d53604e0789f4566cc1e7a0faa658d55c293d0fd1ba5ca2d93612beae42f24a0f9f9e573a359b363303e36657b798999ac61b911b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe580c6f.TMP

Filesize
3KB

MD5
5ccd4a086e02a36afa30c08e2a8f5b17

SHA1
b5d4b9c15b17fb732b21765febf07ba3de646c63

SHA256
bc9308d39d116a91dae87cf38b0c4b7d66d04c0a57cfafc61def9d0e4fad4d04

SHA512
96b34f547a63512c3ce49c454db19dae5a8295283e6a2677bf0d3d1bac62ba19217bf1f07d6a813ab28ece2fdd588f8a2913d152c28674802c15a56c106a021e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
7c8c83f0202a753ad6563fb25bf2cdde

SHA1
936ae9df1bb4e14693b41085225abdcccbabdef1

SHA256
2c6053f004c5620b82bdcfac516521f3613f70411bdf5aaae14a8d95443b3bd9

SHA512
affa13505ae63ae6fda2322232d557703a53be6faed28f5327ba3f7501e12a66fc6e87e25b90f56c388632e46f4dfc98a2aaf93dcd9396c06cef0d3ec61bc815

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
79b0cc7f82d60eb098665dd3830e2932

SHA1
d3c7b14edc8631722f91e1e9f423ce5e1bd6bc70

SHA256
6d49d87de900058333ed58e1a490236d6f4140e56c8380b2f2e6a4ffd5c1d540

SHA512
4674509402d0fb58136c49b7109bed8f3537555bf1299a7c2a0bee8c7d3b11ea3740409673d8ed40edd7cc28801c354288204026d3e8caf2105860133f8a6d3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
4ceec1b2cfab947429c7c9d77ce45ff1

SHA1
b297128dffbc50fcdcab81c45719835f9fc34a4c

SHA256
ad91c114ea3f300bce7ecf352e05ce65a4bdf113a64f722295cc759d0bb2a28b

SHA512
2718545bb980e8fad6371be260e9dded7591ff4fc5d17e7ae5ae37a4e90e6172e0a3c049bc0fc7a580ec9e58b483884622d6a24d258f2beae79c21d543df21d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
5591f3746f9d1b91d7be4bfa24789b14

SHA1
d30a6411cc3c30b0c50f25fc14689ee32765e8ac

SHA256
7950de72dcd11228484ba5a9f12eec5487a5f83d3f6b07cfe423e6fe5affb3e2

SHA512
b20bd23916a0c7b7ed0b2fedb1eb7558383f5862751669823f0f729b2611e6747da9baf23fd757887bd0f604a409bec2746c335e6bdc3e838e532a2d0dfd49f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
a9c6221888d779b1c2585f6850b6a3e6

SHA1
6d5aaeda34cbaa86e9ab02374759caa7e2fab1fd

SHA256
17862c6b53d0f0063802ec714ad2d930cbb5e53996f2970cd520d0e6d7a298bc

SHA512
9d36acfd0c6b50176b29eb457c34631082585b425ee06af34c4d03703982749e7bdccd429d54f70eb3cf5d558fed20cdd0acfb3e9ab3f93750d5e6333d582ed9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
533d5ba1d822549a6e9e4079da1f1f52

SHA1
5e38cb962dfa974be044823138a1f5ae4c2e07f5

SHA256
e887bf112066b9e99f47f40ed614b9b524697e505ac85b6eadfb94e50e22963b

SHA512
42b9d1ff3dd8d5ddb1a9efb6923b4e5a8675e4c33ff781f706b7bf6adb7fd62015a491c851828dcc5d929c1263b9a9fe15a000483111812a8c3e5c9e96d58092

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
a64f5130bb834c96dd41def9f6cca779

SHA1
ecc56e3ea7c6b782d1e0ff31cb0f9a5d1e88c9a8

SHA256
ae7d9e71449f1f159d07c4770cad4cc3ebba31c3ade9314c8e3c063c3fee0749

SHA512
4d1d515a03a19dff848c57a37b3e9d7389c3e84dd26c22dec321a1eb69ff874e8f02d742500a6ebead5ca663d544ee39276f3ba257ec2a6f64482459f4b96d20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
91753cd7b18a4e6ea439137faa27e69b

SHA1
ea0ef0a4d0031b141977ba8fab58c43516611f71

SHA256
499f3c46f2aff69eba62616cad90f30fca1d1464ea86262ca7bd2c0e6848d6cb

SHA512
bf535939cbfa38127ba5f8dd992f9dde51f34c2180a6bd41ac633694d26bcdba5a47b742d6bfb62c42e50f912968bd6707262070af60ccedb44868f4c9362c94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
727c3d98a1891deae0bfbb3d48f0cb82

SHA1
76c1b058812403386927a2131691d3276636e549

SHA256
17f3d296222cc7c78dc8ad1eac7fe2d11bc1f51b33aa50315b859b1a11e6f134

SHA512
76ecacbeb1ac8998d6032908e8e1baa8e7cf4235d93e0c391ddc60381c3d5d346e5944a86e93488bfbe73f7d9f207e24dc9d640e88d8a206f8fe1a5590369a2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
f416f17ae50e2c4738002f0305ace700

SHA1
c9102b411c1cbb134f1434548d88ebecdb5c20e6

SHA256
c5a3bca740d8743a73cf55995324006551886d356fa9b3cb85b7442a1606c519

SHA512
e49fdc842def17f740d51f0dbbb4b76255b89df7541e69ca9c2258f39afd7272119341295aff2896ce922cf2a9a16ac474dd85a837af149593da64c32f0c8901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
efb9ccaeb0a2bdb297fe2a00258d197e

SHA1
0df0b60ea3a704c0796d2d904b30f4cd3d2b2abe

SHA256
d832c6ad2ba22bb4c5275dc8ad2da310fe64126c28ce7e224ec60085f29b3f1f

SHA512
5a619d9d3e75b61092ac401bfe8676ddb702a122570d96cb991ce33eb3195afac2e1b687ab753771f878314f68b190305647adcd8119f42de86d918973e3b1e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
b2bd5d944af28508be544dea0cb1c9ef

SHA1
291791ca8f0f08579800d476c00376e8b42920ba

SHA256
c9c511a832705d90911b7a9be2888d01d0382a9afb4fb390478ad0825d362aaa

SHA512
cdc73a5df48336f60d451512950848baa17eabc8275d17742451c7cfa70beb997c7c358f2251d0f8cbbd2e4a41cb81471a1fd4c1e01e4eac603942f83b3635d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
d29cc8ae5ec48be4e4cf9bf75d5da0d5

SHA1
b921612203982e61c970ac01614cd65574fdc335

SHA256
cc5a32f00f3a5f47b5e9d42a8c9e18e31a25c8201ab20450ea7e01a80c4a2898

SHA512
daf1251f5ac772e647ac976cfbe107dcd8a9af0e38a05a37a35815f06bb048a08d074a9776127640a9a988aa7ee62d0f6e488fc1a0f23213439600fc0671b894

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
76c57dd4573197ecf0a8f6636cb6363a

SHA1
e50a6468b669ff66d7b787928c14670305d48778

SHA256
e26412a1716390dc0a7f045f40671d2757d4fba65698997c709c9648466e8f86

SHA512
b0cc7fcc12abe7ec498561828062101e41266acdfdd92b4c31d0b5bed6aedfa01ec1b6bedb16c7789d6e8968327108055124e30d13b012aa3d11146eb1ecac50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
14b9643b6d08cfaaefa2137d6e7a4e5c

SHA1
8a9572a75a70f16ab09bbec58f5613f520e9cfd1

SHA256
7256cf1e780530da829bbf8dff1ad31a0ee9c3fa72d2e0083db5995292cebcc2

SHA512
549abca0456599cab0602b1e09af38c07a2b9ee8b55f1b87b148f9795d6f6b0b11ce1dd54e7f1a934abdc3b50b2fcdefb88c0d6d6a9b3783535c71393f7a8ceb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
5bf68f2fb96fb52013bb9ee548fd7f05

SHA1
7c65833f5be5e94c2937d5c04227c6d1af1dad31

SHA256
2e0a0d251d9e54fd5e237eb286f276b0bc5d9e55623fba80ac49b39333263454

SHA512
bf7c36e7946b14f635fdee8b99d79a8beea6a274591cefb230ec2498592edf6a8c8d9cde112bd3b15401a12fb0451a85aa52583fc62d9428bb3239dc5d1ac9f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
f43b3472f66f1106eaccf9a78487daac

SHA1
272cab2c188dfbb7a1934442f2c20ab0d20b1756

SHA256
fc67a5491910d61c929a4c0d7494c281b2f6625fe17cf648aa44661afcbfa717

SHA512
12b24c5775ab030be43c95e916fe2ca77e752bbc51a72b1b3b300fa6eb1c68e3c2924673bbb643b993e9bbe5cc311ea669ce9f3dd30f2a1ad7066d9fba9bf5e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.4.19.1\typosquatting_list.pb

Filesize
623KB

MD5
53c198434a158fa8db3323e0c764d99f

SHA1
df15e6e77f5385cb64e03eec8a21717749116e17

SHA256
cd566951c0822c5adc4948c22aa78b0e942094649b1d89d5bf0add6dd8311596

SHA512
8c49f6b663062decb6d64d3217a7317d8134314ecf48612b4e625a54108f532246056d8c20842a0d0c85f0ffb4c78aa3b9b5e7f79e31d7d1639b82b3469c4164

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

Filesize
572KB

MD5
f5f5b37fd514776f455864502c852773

SHA1
8d5ed434173fd77feb33cb6cb0fad5e2388d97c6

SHA256
2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e

SHA512
b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
1ec0e5bd87b6971671865a40ff1d5882

SHA1
f1c15d6ef343ed7896d9b303c69552c9ab927c23

SHA256
e2b6daa1b1d59e695307cf1e9cb601696f624ef04704521671734e32fdf94a6c

SHA512
6a290b235e344e0d7ec9e4ea088add07574460619cb199ae2bdca2cc379967672f8b2175a253bb991c281f83452ade03c7501edf5b35a20f7d948d3948000ddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pvtyxtze.yle.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1764-10-0x00000114BE400000-0x00000114BE408000-memory.dmp

Filesize
32KB

Download
memory/1764-11-0x00000114D80A0000-0x00000114D8152000-memory.dmp

Filesize
712KB

Download
memory/1764-1-0x00000114BA900000-0x00000114BC882000-memory.dmp

Filesize
31.5MB

Download
memory/1764-34-0x00007FFCD2AF0000-0x00007FFCD35B1000-memory.dmp

Filesize
10.8MB

Download
memory/1764-2-0x00000114BE3D0000-0x00000114BE3D1000-memory.dmp

Filesize
4KB

Download
memory/1764-15-0x00007FFCD2AF0000-0x00007FFCD35B1000-memory.dmp

Filesize
10.8MB

Download
memory/1764-14-0x00000114D97C0000-0x00000114DA204000-memory.dmp

Filesize
10.3MB

Download
memory/1764-13-0x00007FFCD2AF0000-0x00007FFCD35B1000-memory.dmp

Filesize
10.8MB

Download
memory/1764-33-0x00007FFCD2AF0000-0x00007FFCD35B1000-memory.dmp

Filesize
10.8MB

Download
memory/1764-0-0x00007FFCD2AF3000-0x00007FFCD2AF5000-memory.dmp

Filesize
8KB

Download
memory/1764-12-0x00007FFCD2AF0000-0x00007FFCD35B1000-memory.dmp

Filesize
10.8MB

Download
memory/1764-3-0x00007FFCD2AF0000-0x00007FFCD35B1000-memory.dmp

Filesize
10.8MB

Download
memory/1764-32-0x00007FFCD2AF3000-0x00007FFCD2AF5000-memory.dmp

Filesize
8KB

Download
memory/1764-9-0x00000114D86D0000-0x00000114D8838000-memory.dmp

Filesize
1.4MB

Download
memory/1764-8-0x00000114D7F80000-0x00000114D7FD8000-memory.dmp

Filesize
352KB

Download
memory/1764-7-0x00000114D7EF0000-0x00000114D7F72000-memory.dmp

Filesize
520KB

Download
memory/1764-6-0x00000114BE450000-0x00000114BE47C000-memory.dmp

Filesize
176KB

Download
memory/1764-5-0x00000114D84D0000-0x00000114D86C4000-memory.dmp

Filesize
2.0MB

Download
memory/1764-4-0x00000114D81E0000-0x00000114D84C2000-memory.dmp

Filesize
2.9MB

Download
memory/6128-27-0x00007FFCD2AF0000-0x00007FFCD35B1000-memory.dmp

Filesize
10.8MB

Download
memory/6128-31-0x00007FFCD2AF0000-0x00007FFCD35B1000-memory.dmp

Filesize
10.8MB

Download
memory/6128-16-0x000001B7F0FB0000-0x000001B7F0FD2000-memory.dmp

Filesize
136KB

Download
memory/6128-26-0x00007FFCD2AF0000-0x00007FFCD35B1000-memory.dmp

Filesize
10.8MB

Download
memory/6128-28-0x00007FFCD2AF0000-0x00007FFCD35B1000-memory.dmp

Filesize
10.8MB

Download