b0683af449cde984832eafccdff511b401c8307273d8be414a87249ef8c4dacf

Analysis

max time kernel
145s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
03/07/2025, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aaasd.gif
Size 2.3MB
Sample250703-drccras1gt
SHA256 b0683af449cde984832eafccdff511b401c8307273d8be414a87249ef8c4dacf
MD5 6a33a10746366a660161a78ddd8ce2e3
SHA1 23326d92261fb0ba55fa36d867138fd30138a782
SHA512 4d3397293c82d39a43ef6fd4f600749380727837ebfe28229cd2b71f32daa7e4034c682fd9b7a7469facb2e56adf85d9bdec0e767010a219edeabdf8c39d0b64
SSDEEP 49152:AUAaE2WQXj4BejE3TlvfgMIMEtLG9e+6l99eS8w37r13eMJu84t:uQUYjCuLWLi9F8w3N3Jg
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_942879888\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_1462373440\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_40245003\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_1676609035\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_942879888\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_1462373440\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_1462373440\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_40245003\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_40245003\regex_patterns.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_1462373440\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_1462373440\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_40245003\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_40245003\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_40245003\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_1676609035\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_1676609035\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_942879888\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_942879888\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_942879888\sets.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "635658492"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31189981"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133959860577700954"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4024151881-1944119507-1574723210-1000\{043CB6DB-C43F-4592-9368-F470883F8A74}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe
5992	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 5992	1808	iexplore.exe	78
PID 1808 wrote to memory of 5992	1808	iexplore.exe	78
PID 5992 wrote to memory of 540	5992	msedge.exe	79
PID 5992 wrote to memory of 540	5992	msedge.exe	79
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4860	5992	msedge.exe	81
PID 5992 wrote to memory of 4860	5992	msedge.exe	81
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4840	5992	msedge.exe	80
PID 5992 wrote to memory of 4712	5992	msedge.exe	82
PID 5992 wrote to memory of 4712	5992	msedge.exe	82
PID 5992 wrote to memory of 4712	5992	msedge.exe	82
PID 5992 wrote to memory of 4712	5992	msedge.exe	82
PID 5992 wrote to memory of 4712	5992	msedge.exe	82
PID 5992 wrote to memory of 4712	5992	msedge.exe	82
PID 5992 wrote to memory of 4712	5992	msedge.exe	82

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aaasd.gif
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/aaasd.gif"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x300,0x7ff8bdc4f208,0x7ff8bdc4f214,0x7ff8bdc4f220
    3⤵
    PID:540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2744,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:2
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1888,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:11
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2208,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:13
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3312,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:1
    3⤵
    PID:2152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3320,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
    3⤵
    PID:2464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4676,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4664,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5644,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
    3⤵
    PID:2148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:5552
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5708,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5708,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5828,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
    3⤵
    PID:580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2228,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
    3⤵
    PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6296,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
    3⤵
    PID:5560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6904,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6732,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6876,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5124,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5116,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
    3⤵
    PID:1808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5544,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
    3⤵
    PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5868,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=880 /prefetch:14
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6628,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3932,i,18056752309104227454,3932520278200135246,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
    3⤵
    PID:1080

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:2732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.21\autofill_bypass_cache_forms.json
Size 175B
SHA256 b32bfdb89e35959aaf3e61ae58d0be1da94a12b6667e281c9567295efdd92f92
MD5 8060c129d08468ed3f3f3d09f13540ce
SHA1 f979419a76d5abfc89007d91f35412420aeae611
SHA512 99d0d9c816a680d7c0a28845aab7e8f33084688b1f3be4845f9cca596384b7a0811b9586c86ba9152de54cafcdea5871a6febbee1d5b3df6c778cdcb66f42cfa
MD5 SHA1 SHA512

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.21\edge_autofill_global_block_list.json
Size 5KB
SHA256 b3ed570caaa1e88ca7fdeaa6569b5ed172adcb64221766cc73fd7e6b07e0c65d
MD5 1c865471f98902a3818e8bbf46360342
SHA1 932497309e942f67080b84dd37dbd634117135d4
SHA512 d77791b1a55cbb09a6dd88911be0219c712d573238666e09b0c18f7b92573db2a54dc0525d3232851f1bb9c008c2ab542bb4fcefa09b7a4be50fcd8bad4e231e
SSDEEP 96:MYL77CC6fQinLk252b/lF4NXtKK5b+QiG2ZwOSZqWqxtxpttx6lydMsSRac:MYL7O9FnLk25+tF4B8K5b+QiGoztWuDi
MD5 SHA1 SHA512 SSDEEP

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.21\v1FieldTypes.json
Size 509KB
SHA256 f3232a4e83ffc6ee2447aba5a49b8fd7ba13bcfd82fa09ae744c44996f7fcdd1
MD5 c1a0d30e5eebef19db1b7e68fc79d2be
SHA1 de4ccb9e7ea5850363d0e7124c01da766425039c
SHA512 f0eafae0260783ea3e85fe34cc0f145db7f402949a2ae809d37578e49baf767ad408bf2e79e2275d04891cd1977e8a018d6eeb5b95e839083f3722a960ccb57a
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVI:Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9f64241015f38224418e393d7238bb902fdd41237b18ce98e8a178ab436c93e9
MD5 6017e3f3fcca2244a025a1359b9706d8
SHA1 93a1336b70343a2ce6acb73deba1a1872060be6e
SHA512 2fe4daf85a84038ac8160fc2756b3c6fe1870272a80ca4ed3e3109f77c4e70e49f3165be0eece206bec74995f41a083932c4bceeefb2459f4109bf1730e42cc8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 508f96e4778342af21e615859edc989bef257b0865df01995ae9d61797664769
MD5 33c4ddbb1d687b68a0310784ddb0da57
SHA1 0e138cf797b9aafa63f9df7c51f08fb6316615e9
SHA512 05df273e6c403b88c402833f23695ea1c9cb3e187181bee8bc9739fd626781b759604b62203eb26052232b1bc6b9b398bd0603b3b55bf14d4aa0b3f4865cc330
SSDEEP 96:XmFxekKuZMNJlbeLLIETtYOo5l7lLDOC3cXsQ9SUTugAj:2nFzuoICtYJf79OC3mLHTuBj
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index~RFe58436d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58436d.TMP
Size 3KB
SHA256 5164dae3e22d9371c0a035e4dad4f86bc341b35f855cf6e217c2e51498758469
MD5 c6a6f9b629f9af3f636ac0343bee66cd
SHA1 5743eda83d2357b14e3f25c07a40b97636295abe
SHA512 3566c77597e8b21f594643802a37f8e1aabd624ae0c41f162a76a813dde3db860a4deaa18b9f554007ac5d8cfdaedda6c7ffc81ceeacee9eac94b8849d18cbf5
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 088bb586f79dd99c5311d14e1560bbe0bb56225a1b4432727d2183341c762bcd
MD5 06d55006c2dec078a94558b85ae01aef
SHA1 6a9b33e794b38153f67d433b30ac2a7cf66761e6
SHA512 ec190652af9c213ccbb823e69c21d769c64e3b9bae27bea97503c352163bf70f93c67cebbf327bfc73bfd632c9a3ae57283b6e4019af04750fe18a2410a68e60
SSDEEP 1536:I6LPH74eshBGZqW3iPPDuVvpBI/S8tZsA62UYPq:RPHjdRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1043056f7799de7f4f7508eb70ec4b997773e913d36a099b8bd7e69cbc96681f
MD5 20b426b22090fba5bafec8f86daaef5b
SHA1 50dba6be679e56fda52de27f2b0e5eb19ed3bdce
SHA512 0c5cef2318230ed7ac0ee27a031949902f965b219ded435442ef801d99c94938731c5a9b6edef491c1adaf8f8a77d8be531b681755f82452c9f4e142b85d30db
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 28fa3e299565db00659bafd2fa096925954b6599ae541a8d7d1dc9706efcf8d2
MD5 f5363ba52c4649c84af811403dbe5b3f
SHA1 3d19491ea0b48b9eaa7b8cfe41020d40e525f469
SHA512 d7b4aab0d1dc68fddc56e3c22dec2c29d5f2ba2228809f3d71ac0aee78999828531fabf23ce33fa92324a80779a13843535d96d180464ce8b34652215e704ab6
SSDEEP 192:sVZQUnLRtyMqv/Ky0hl8M3IBGsjcwlwIyqmhmggzqzgoZ8pK/Y+WNFSgY6wPIWMG:sVRnLEEPIBGsIAZynwh3K/SogTfWEGQO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 bf06f0e8f5461cdfef35d3d34fd0130e3900e1dc33392c1c3da970fc72699bfe
MD5 d06b8872a566ce11185e060fda18cd83
SHA1 9e4ab6e84a256f0db2f09a4ed6e11be73372fffa
SHA512 49eb7e320ff5d48352389122cfc6e78fdd37a2a5a7a9f761ee8b02edf97c99dd75b90fcad922bef7b0f26b364d95b4988c71f47df9dd1c65b052e7b155e6bf0e
SSDEEP 192:sVZQUnFRtyMqv/Ky0hl8M3pBGsjcwlwIyqmhmggz1lzgoZ8ph/Y+WN+7VY0wP3W0:sVRnFEEPpBGsIAZynwhch/SYV5MWEGQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 4998cdd3d4c4bb7ed31e0853700d3fbf5cabe76e243014b144c5eb20df0973dd
MD5 9969251dd89cddae4c853ceed70a9cdd
SHA1 b110d437a91df14f81df8590b2b2f930877235c3
SHA512 4d5bd7f283fadd6a01b161d6781dbfa5e384d0aa03e6cb616cfd5e1b487051cddc50f9a73ff290bffb57f14a2f214a226d86c507401af4d8a62262b821f59dd1
SSDEEP 768:l3rCN8oR21F7pLuLzuoWRWIAQs88F1+UoAYDCx9Tuqh0VfUC9xbog/OV3v0OXLlX:l3rCN8oR21TEzuoWRWIAQs8u1jaKv0Oh
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0b53b82a-b1de-46ec-83e7-37b94ec14a14\index-dir\the-real-index
Size 120B
SHA256 dbee0be2b9637b464d7e56b2083c58f2d6235f648f7def0c24145339ed1c2eb5
MD5 e95bf9a42d5737db0c63bd21d7dc423f
SHA1 fa664fd2f3f6dd344acdb744060fdef6cbc396e4
SHA512 a63419ba2bc6eec748bca98146be065162297e30834ec97520b723f8fcc3eda901900636c4d3d7d4fa9b61efd173c8637de1cd5be26612cc7da7e0941a37ef03
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe582fe5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0b53b82a-b1de-46ec-83e7-37b94ec14a14\index-dir\the-real-index~RFe582fe5.TMP
Size 96B
SHA256 956d631580f7d0c7df84cf0f00486411bbf51f361c92ceefe0d692b935129717
MD5 fed5079cad41f6dfc5689a4d435572e6
SHA1 24835a84a9cc3885de371fb17f47cf55874cb304
SHA512 3c32a0c85b3abd5b263c8dccb83c3079069414d54d73b735e08aa47470149cbebb2428af335f306f3e156b8d3c65986f7018218bcb99d5864571fba031d430bf
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\22c05098-7d31-42a3-9daa-119467696526\index-dir\the-real-index
Size 72B
SHA256 a67edad384cfa21a054727ff8b1520e08fff2ca412d932f9ce37ab856aba92dd
MD5 eab8d35c70383b9bf1838a3b35be4e35
SHA1 b6c70c1888cdf7763c037d067539407248aa830d
SHA512 a0677fe637af8b5228471e2073f610392d7fd8be7ccc659baefb68c200745037d357c8e75a5b24510fc1ab9b99986be8f8bc3c8e1a4706be08d14ca4e927cd15
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5810f3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\22c05098-7d31-42a3-9daa-119467696526\index-dir\the-real-index~RFe5810f3.TMP
Size 72B
SHA256 64bca6868fea4d8bc34b587a3731f565ecbf132c17aec68246aebf1efd3eb85e
MD5 c6b69a4afbbe63177ef6f91238f7cdf8
SHA1 a8b75461f1e2a68adcf68e2fcb1f9beb3a5ceda0
SHA512 91251243c31d9cac668927eec89d7a0385c3bfdcad2f7943736cffe58236b616a466d206401d60f060cc0854fc2e2082440988671fda97bbdea1b8b6aed941f9
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ac01df32-88b9-434f-b6ce-94d706338646\index-dir\the-real-index
Size 2KB
SHA256 776435762df15cbbda26d025f56f7da6d90f4a35ea36477b7f49645662be9dd8
MD5 03f06c228a59e524a6099df3318d2f2a
SHA1 d7c3ea4863499aed3f9f246e512c14feab2e53d1
SHA512 156cc4d6eac0198875b076dbabc31e7ad91b0e56cb254ae96b52b0f83f5c6482acb1ada78c581e0199d9c42465d90e3c9ee0dde252d4251bb2f2063927b2d084
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe58271b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ac01df32-88b9-434f-b6ce-94d706338646\index-dir\the-real-index~RFe58271b.TMP
Size 1KB
SHA256 07a50bd7f3607695c833a65bddf1672ee05767314503fed8b034402983e5e43d
MD5 4fddde338f52265456f2c23c52fa701c
SHA1 128cb3dd579fac59b9b9847d7bcfdc8c6e8ba855
SHA512 8ba667be28788667937639fcf154bd535a85111a239d0fae1bb5110a8ef7e2e254617f1ffe371ce3f4579395e48a7bea0a854e0d94bdd6840f430216ac4697c3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ae62bcb0-b3e3-4cef-affd-205eaa4eb3c4\index-dir\the-real-index
Size 72B
SHA256 f5a77a37c174f703cf4135ec68452d143b9c344d913cf5345615ba83c05a7dea
MD5 f0930d4395e380cfb8c798c6ef29a6b5
SHA1 ac9ab3505870010fd86a45739837fb28d53b16dc
SHA512 55a97ff2f2719fddd24f33496a1c0bb34407397904fd4329ae12c338c8da16c2f647eeea71727e8b65c55a724facf0d24a09ea251983f7a8a48f9ed7067840e2
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 322B
SHA256 56ce5582dc51c45427d6223c55bf9723c3e812157a54ac283a6c3d43ef6db510
MD5 133188a7d86459319313da668737e562
SHA1 94188b188f1e8a043dbd384092ab9dcb4340c0a8
SHA512 f8d0a0993967ff9899ef0be92439c31ad6952469a42565d5b3b3f7b2806b58dc258db30b5c6bb38b6165246dead9957a5efa8e24ef09efbaefa1ca71c027b895
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b6fe74339647bf4e5b35193ba5c00167340379979b3c406c5aa9db4052c71390
MD5 c73c80a9799f06f45e07000d3b554bed
SHA1 0bea1121d674d1b166111ccc55aaf5ce784f146a
SHA512 a114343f85c681eef26a9106d473e32b3b14c03137b9b440dc88c6ff41b28c844e1166e60f22ff2b47110093cf89f98d28183954d396cc6e5882ad6a9eafe5e9
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe580fe9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe580fe9.TMP
Size 48B
SHA256 61afbc88b852d331c46472946bbbcbaff97da14f0d22e73d55b28a8b3891b836
MD5 c9d078bcabaa5d97b10eadc21de66fa5
SHA1 9d3d967889629af26c8d4bf679fd5cd8383c3d54
SHA512 5afa257eeba0c05aadbe1bde7b65e18e0977e74e5e3ed8dd71ede148dd66bb6c0b2d63b2987c79ad615cbb121632f2da8fe7233806d6904947f4cfb215bf062c
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 48ded6b447285f2f680d027a86ab271e7af7f5214d4dc83a7fc455c041d8057e
MD5 03e265f6f6ea0eb9635d0103658a0e9a
SHA1 01eba3a311efa5a46d06ae6269107cdf7708b0e3
SHA512 fb2cd52594dccec0767795decd4576a8507a2132685c8d2dd094fe235fac91825a71981e2c3b21ed03d0fc269f4cb400e467297200c35b28074c05bb76172084
SSDEEP 192:A5tKX26YcQxcF+Secw6lYh22d8hAcayyLi/M88O+8HO3li+UdhKrPpjzGXET3VPt:UKX26YcQxcF+Secw6lYhp
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.11\data.txt
Size 137KB
SHA256 5e4014e267eec120e673cfbc407e4340c234a7898319b35a304ed6ea343a7999
MD5 1bee2c36cebf096d8a559d5c4eeacff7
SHA1 c695eda67f31d729dfc336b8a471ad6346a39031
SHA512 ba520d383be95d8b15140b7e38e4e7ac03077bbbb8ee5326ac4162be9403bc9f0576e53840fc22cd9c4038f19f60bdeb7b4e8e0125da6ed80670238de812b4b5
SSDEEP 3072:iOmkTNO7NHrMziBxfPURO+/bAipYbzVS72Ag7KnM+HfACMR0T4H:i7kMRIziBxfPe/sipYbRfAPfCaTU
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 458B
SHA256 e67dbfd3445efbbba942925b123bc515b9c12793aa0500386a48d8f886ad9100
MD5 2efa32048c8517bf5496196833cd3cba
SHA1 6188c6a621e59cddf260278360792636bc4e92f5
SHA512 bac8c92212c9d64a0af58a056990884cd1b9dbba227f465b8bfe567318a8674c848d90ffeee46975916120234537af3bf49d81960b5dc27ff36879410eb2cd30
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 50KB
SHA256 5043721efc215f58605a8c823e9d361066c3e7216d209fe1fd1ef4c9c070d4b1
MD5 663a004406a5a1be544bb1530c67ef70
SHA1 ca1c904c8ea8477ae4d4ab3b2be67fbbbec50374
SHA512 ad98893e2cf63c9cc5bc16df95dbd8cf0bb92d9c96a6bdfdb525426bd76456904845a828d654c5c20861fa1d864a20f0b5e0032d2d623973ea0e5e9f245c0365
SSDEEP 768:sFPE6esE8lDldUGD3/Cgdq0Xx22Kve0NRkIVAJxoEfeDt4SlE1lsEgOZ3fa+p:meB85dL35qS5gA3oEfeD+SlE1lpvJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cc296f4d5082efb4b36c77ec188d3173eb98a910af9be56f3316ef518d2ba96f
MD5 f455cfb8a0defd33a52f9ff818b1bbab
SHA1 4d1a358110dd9e08f9fa776ba6f8f5e633fe92c3
SHA512 7abdccecb62dc3b60c22a2f4eb39cb0ce2a7e69af505cd673a09829cc2fd03169ecb02f478c86db2dce83e72a2c79e7a7b26596c0b46a6f63be0edb89b3ad195
SSDEEP 768:5FiE6esE8lDldUGz3UCg0TjpR22Kve0N6bOcbVEgOZ3fajE164K:YeB85d73nTjD5LCcbcvmE10
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 260993fefa3f7c4fb756fa5aca1b29ddf1edaed8bb5157690f4352121af245b1
MD5 1a469c9e6fbc868caa971b4108722c30
SHA1 f7120f943c159a1afe9e0d8b542b624c5f0c33a2
SHA512 58b8e7b06693205c8765c15aee632e4eb8a3282d2e74666792d885978191688bf0f4e36ef2784d9c87bdb985a10b1744957a5b5ff6c0cb4daa5e1bb6e268b5c5
SSDEEP 768:yFPE6esE8lDldUGt3/CgAS0Xx22Kve0NRkI+0AJxoEfeDt4SlE1lsEgOZ3fa+p:MeB85dl3USS5gcp3oEfeD+SlE1lpvJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 391dc1e04d3005bc6c0ad1a9533e5d980241cd9d760b4977c70ea6cef6e4e53d
MD5 0ae12cdb91d6548b6147c8306137054e
SHA1 7dd8d259c89ca8196e769bf8709ba3d3a4ec01d5
SHA512 49f9ec74a4b15aeade090a8e6f3a049b65c1067c924b351a616f75f6e4b488ceb1de4d58cd89fa87cc9e7bc5d717b24eeb23261dde81769e8e9a027586d16fed
SSDEEP 768:yFiE6esE8lDldUGa3/CgJA0R22Kve0NRkI++AWEgOZ3fajE1JW4K:TeB85dy39Ay5gcPfvmE1O
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_1462373440\manifest.json
Size 176B
SHA256 8a4800ed5f63b9371a024c501ee2b031af94539e32e6753214e6d99c625c018c
MD5 8177721150435a9b333475e2b8a6e691
SHA1 8aa8981617e8f3d8967a0a4a2d20315317eba293
SHA512 540c4c52030c6a4e1efcfab5eb59760c696bb3e3f1b8f93c97a6368639a911ba3d395190fc0798d99f3c63e25b6dcf2ded482bbda34d36ddd874dd20c2cfdf74
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_1676609035\manifest.json
Size 53B
SHA256 0f8ee89c4a420bda691d058cdd96c874c2edeec84145c81c957e98d05e351d3c
MD5 b4d869dd7052d78d29b3e439565f1600
SHA1 caa2cfa31729f4348a02514eba0235e72b88ce5a
SHA512 1fda3488df8c43ad413b2e69a5e2292322fe837f7b27b88302b4e591e7e13fdceacb0af9b8bb92ca7c0d2b39abffc776c6cc35d18abb86ce91f55c719b43480e
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_40245003\manifest.json
Size 119B
SHA256 b13947842a1d3e66e62bd32398a3780c18127a520e7212a4adbf006a9abfd74a
MD5 01cb8b111843d1f1dac11d249c24c8b7
SHA1 c4f1f6f219f325caee6363df7f459323109f2f6e
SHA512 075d54cdbd80078d4bf66f3c5814a055058f2535629cc7f5d88fa5c69d5c931dfd2c456a0bc634768d796af604ce4d585c7904c1924d35df7855dfd7e275d403
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_942879888\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5992_942879888\manifest.json
Size 84B
SHA256 2e9e6138305d702f3c9b89d6e9dc4931b548c69bb86db64e585fa2e37b8ef654
MD5 e0909520982fc48e47a6451443b11741
SHA1 0e46425274933c153ebf5a03f25e693267a8cea2
SHA512 3fdf504cb0bf39a807fa15a8ec31a6efd8083888692935ec31d70b4ef6eef89b8527c6a75a46bf7ae3efeeaa507ac3c7cccda5246a2f073ac603a7ffa10d20a8
MD5 SHA1 SHA512

Submit Download