Analysis

  • max time kernel
    145s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250619-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2025, 05:56

General

  • Target

    https://chandrudemo-my.sharepoint.com/:v:/g/personal/mohan_chandrudemo_onmicrosoft_com/EaTRv_9Sp4tMlu4dj45bBG8B8EbTwfH977DbgngKKhA6pg?e=bf7nJW

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 12 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://chandrudemo-my.sharepoint.com/:v:/g/personal/mohan_chandrudemo_onmicrosoft_com/EaTRv_9Sp4tMlu4dj45bBG8B8EbTwfH977DbgngKKhA6pg?e=bf7nJW
    1⤵
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4460
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x31c,0x7ffd5b93f208,0x7ffd5b93f214,0x7ffd5b93f220
      2⤵
        PID:3500
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1908,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
        2⤵
          PID:2784
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2256,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
          2⤵
            PID:1888
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2476,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
            2⤵
              PID:3896
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3440,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
              2⤵
                PID:2432
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3468,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
                2⤵
                  PID:1300
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4160,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
                  2⤵
                    PID:2696
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4236,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:2
                    2⤵
                      PID:1712
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5124,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:8
                      2⤵
                        PID:2968
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5284,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
                        2⤵
                          PID:5304
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5292,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
                          2⤵
                            PID:5260
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5164,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
                            2⤵
                              PID:1840
                            • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5688,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
                              2⤵
                                PID:5288
                              • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5688,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
                                2⤵
                                  PID:916
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6084,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
                                  2⤵
                                    PID:1260
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6256,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
                                    2⤵
                                      PID:2032
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6356,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
                                      2⤵
                                        PID:4556
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6424,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:8
                                        2⤵
                                          PID:4360
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6556,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
                                          2⤵
                                            PID:5528
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6564,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
                                            2⤵
                                              PID:5924
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6156,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
                                              2⤵
                                                PID:6064
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6468,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
                                                2⤵
                                                  PID:456
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5904,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
                                                  2⤵
                                                    PID:4120
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6672,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
                                                    2⤵
                                                      PID:5352
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3596,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
                                                      2⤵
                                                        PID:2944
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4300,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
                                                        2⤵
                                                          PID:2224
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2788,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
                                                          2⤵
                                                            PID:4024
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5180,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
                                                            2⤵
                                                              PID:6132
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=860,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
                                                              2⤵
                                                                PID:5820
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6472,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
                                                                2⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:3948
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5092,i,2436959686808417078,285030446817725586,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:8
                                                                2⤵
                                                                  PID:5348
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                1⤵
                                                                  PID:4736

                                                                Network

                                                                      MITRE ATT&CK Enterprise v16

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Program Files\chrome_Unpacker_BeginUnzipping4460_1406784332\manifest.json

                                                                        Filesize

                                                                        43B

                                                                        MD5

                                                                        af3a9104ca46f35bb5f6123d89c25966

                                                                        SHA1

                                                                        1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

                                                                        SHA256

                                                                        81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

                                                                        SHA512

                                                                        6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

                                                                      • C:\Program Files\chrome_Unpacker_BeginUnzipping4460_1490693727\manifest.json

                                                                        Filesize

                                                                        160B

                                                                        MD5

                                                                        a24a1941bbb8d90784f5ef76712002f5

                                                                        SHA1

                                                                        5c2b6323c7ed8913b5d0d65a4d21062c96df24eb

                                                                        SHA256

                                                                        2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747

                                                                        SHA512

                                                                        fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2

                                                                      • C:\Program Files\chrome_Unpacker_BeginUnzipping4460_1501975298\manifest.json

                                                                        Filesize

                                                                        134B

                                                                        MD5

                                                                        049c307f30407da557545d34db8ced16

                                                                        SHA1

                                                                        f10b86ebfe8d30d0dc36210939ca7fa7a819d494

                                                                        SHA256

                                                                        c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

                                                                        SHA512

                                                                        14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

                                                                      • C:\Program Files\chrome_Unpacker_BeginUnzipping4460_850683249\manifest.json

                                                                        Filesize

                                                                        160B

                                                                        MD5

                                                                        c3911ceb35539db42e5654bdd60ac956

                                                                        SHA1

                                                                        71be0751e5fc583b119730dbceb2c723f2389f6c

                                                                        SHA256

                                                                        31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d

                                                                        SHA512

                                                                        d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

                                                                        Filesize

                                                                        3KB

                                                                        MD5

                                                                        f9fd82b572ef4ce41a3d1075acc52d22

                                                                        SHA1

                                                                        fdded5eef95391be440cc15f84ded0480c0141e3

                                                                        SHA256

                                                                        5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

                                                                        SHA512

                                                                        17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                        Filesize

                                                                        280B

                                                                        MD5

                                                                        0fd4a0e92c8a1897aab600ab92275489

                                                                        SHA1

                                                                        857ac84f0fbcf53dd9eb0f49d34258ed0d559476

                                                                        SHA256

                                                                        d1235f9f2c9d3af7e9b1db3aa48a2ef252e0b763879024da51f12da3829a9251

                                                                        SHA512

                                                                        45954b0954e5b382af0dd8bf420511347e661efc6497eca474f54683066209d88cedd20031539cb7de15bc306e18e6aa6ef9892023a82a567b6d2633a039a831

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                        Filesize

                                                                        280B

                                                                        MD5

                                                                        6481d4385cab00f18e19f815bea6fe7c

                                                                        SHA1

                                                                        b8df1e58539491f552cca0a2735bf1834ef6c3e8

                                                                        SHA256

                                                                        6c5841beb22d999d61f7b58e0197b1edc24649a0f7eb202e7b46173df29f009b

                                                                        SHA512

                                                                        71d09192d4400afaab1545854d61bbcbf994a9f3d764fa6e8c697b6eb974837e511cbd45fd69d43d713ee8960dd9b8d22759a1eecb664ba087e91807046a4fe6

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                        Filesize

                                                                        3KB

                                                                        MD5

                                                                        dc2f9714cf83ab601e0fb4eed4c55f52

                                                                        SHA1

                                                                        a03cec3a6449c001ffb414f2010b760bab88cb10

                                                                        SHA256

                                                                        2b7be1f6988016f43b06168a306a62a259aae4ac4344efe799640d5fff40a56a

                                                                        SHA512

                                                                        b3751b7478c652d542eab5838d2473dd11833c9ca1e225833972a21d2d26154fec5f37b11f6c92c2f19e9b8ea78d5cdd1b8b67fb12606904512263abc5c59141

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57d08e.TMP

                                                                        Filesize

                                                                        2KB

                                                                        MD5

                                                                        cc6b2b09437b557e912ddb1607c0416b

                                                                        SHA1

                                                                        b6d6d3564effb867176914177a9c39305ee930fd

                                                                        SHA256

                                                                        7ce149b3c513d81bf4e36bae21f5b41515daf8a4fd12c7f5221da66d8831c97d

                                                                        SHA512

                                                                        4da7bc5255d42485e2e54ef0be32f3e2a26870be69452cd9085b7e2b9cb1e7f60e0fcccef2b9e9bd6134a795f160877246f2e9864aed546e80739df2352ac6ab

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

                                                                        Filesize

                                                                        69KB

                                                                        MD5

                                                                        164a788f50529fc93a6077e50675c617

                                                                        SHA1

                                                                        c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

                                                                        SHA256

                                                                        b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

                                                                        SHA512

                                                                        ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

                                                                        Filesize

                                                                        9KB

                                                                        MD5

                                                                        3d20584f7f6c8eac79e17cca4207fb79

                                                                        SHA1

                                                                        3c16dcc27ae52431c8cdd92fbaab0341524d3092

                                                                        SHA256

                                                                        0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

                                                                        SHA512

                                                                        315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

                                                                        Filesize

                                                                        108KB

                                                                        MD5

                                                                        06d55006c2dec078a94558b85ae01aef

                                                                        SHA1

                                                                        6a9b33e794b38153f67d433b30ac2a7cf66761e6

                                                                        SHA256

                                                                        088bb586f79dd99c5311d14e1560bbe0bb56225a1b4432727d2183341c762bcd

                                                                        SHA512

                                                                        ec190652af9c213ccbb823e69c21d769c64e3b9bae27bea97503c352163bf70f93c67cebbf327bfc73bfd632c9a3ae57283b6e4019af04750fe18a2410a68e60

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                                        Filesize

                                                                        2KB

                                                                        MD5

                                                                        7e31d0b3c396e400eb92f3e8a6ec7a1c

                                                                        SHA1

                                                                        99d2d114b8ccd364e4a8a77195c3df3d8dc4acc8

                                                                        SHA256

                                                                        c63538b20b724313e06e736cd89d6ee30210c058513e7dcde8ddc81203671667

                                                                        SHA512

                                                                        981ff7a43d50ab4d0e6ee8b782c19e84378a013b8f5b30dc247d690c470adc06b6738b92fbc0fa46608101f45ae1b3f4889436ae373cdd144f3718bdbd7729cc

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                                        Filesize

                                                                        111B

                                                                        MD5

                                                                        285252a2f6327d41eab203dc2f402c67

                                                                        SHA1

                                                                        acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                        SHA256

                                                                        5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                        SHA512

                                                                        11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

                                                                        Filesize

                                                                        2B

                                                                        MD5

                                                                        d751713988987e9331980363e24189ce

                                                                        SHA1

                                                                        97d170e1550eee4afc0af065b78cda302a97674c

                                                                        SHA256

                                                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                        SHA512

                                                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        13KB

                                                                        MD5

                                                                        033a48477bc9fd8705d9ffaa20e0025f

                                                                        SHA1

                                                                        f7202e3209f7d1f67e5583dc788b6a561fcc32b1

                                                                        SHA256

                                                                        2849309d148e8e80a7d625fda7e2d4a1a2f9dd995f6d4f9f98960776ad006a00

                                                                        SHA512

                                                                        4bad1dc558d0bd716019783d47cae530e9d9e3fe1b535793beea7549e92711583095344350fd8db3723c47e898f00fb89646061cebc883942fcf6fa3f1a05aa6

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        14KB

                                                                        MD5

                                                                        9b5ac539ad9a28a98c24072d7221e270

                                                                        SHA1

                                                                        242f1c2dbf97976d8d7c056f9bcab204c8cbe25c

                                                                        SHA256

                                                                        27b5c0945cd4df94d96877fe60b9e153a1b387d2659e519d3edfd03a28afb487

                                                                        SHA512

                                                                        f9aff2e65b33a3e5fade37554052d4393a63cb635ef803cfbac4230492f4515c4a675b4642e7e96d09c42f90876473df8959e2d92420e0459ef53183c28cfc8b

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                        Filesize

                                                                        36KB

                                                                        MD5

                                                                        d68660af180c59c417749397d2666a46

                                                                        SHA1

                                                                        3ff836742d4a86a0069617d8ba98bad93f6d61ce

                                                                        SHA256

                                                                        01e1df713de897ce3531d8d9af7c992201916b30f8fe3b7a4e9267a4bb42ac17

                                                                        SHA512

                                                                        19dbc372e3873386c74d6e1b189a2597b6b1b59aae03084b348b15a0f38f6a4998237e559464d2c93523174fbe0e0f2f574f3fd21379fd7848c7ddf09fc6ea6a

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

                                                                        Filesize

                                                                        4KB

                                                                        MD5

                                                                        a59b04a466ca677b9293e4d9535c972b

                                                                        SHA1

                                                                        9b0d126688f6d72d5732cd39ff49a8fffe721dfa

                                                                        SHA256

                                                                        0458ed779eea715a5deb20e53b83cefb845f4690499c1fd7e1964504790152f3

                                                                        SHA512

                                                                        6b42e4c449475eacfc525ed4a8747ac4d63c4a6a2399fcd0c0ab09fcdc63d92a4bfd134ed408462faf347fa6a25c3fe328ec6bbf3fc1531aafb0671c90b9ec73

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

                                                                        Filesize

                                                                        872B

                                                                        MD5

                                                                        6876b057c31deb7d9aa6f9b862468776

                                                                        SHA1

                                                                        39737be3276f770c18886c4ab92381e776b12d0e

                                                                        SHA256

                                                                        95be12d689fa87c6ce0533526a1b2701d24169940eb8ab7c62e1ee9159bee834

                                                                        SHA512

                                                                        e4a8117786b69af88fc808620a0b896ca24f1b4963f9d48c6ae71d6f17df91c52d716ceb79af57f84b52119bf46aca2b77db0ab430e4066422407cd55f7503d9

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

                                                                        Filesize

                                                                        24KB

                                                                        MD5

                                                                        1eb56313e875ad89dffae3a15b9f3ba3

                                                                        SHA1

                                                                        f2a213f4e6e2f4c182dcc12f2907ce426f7d09b8

                                                                        SHA256

                                                                        2bc1ea215878bb92254916a252a69a0c82dd343e1b2eb8f4c36d434e7cc977ae

                                                                        SHA512

                                                                        2df86e139168c55d1e05967919072cf18018ff405e7c4472dc17fd63e28c17d587d811e1dfe4110980f73fe9859b603dcd92f6ad93d18731a0709133c96d8dab

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe58537a.TMP

                                                                        Filesize

                                                                        465B

                                                                        MD5

                                                                        429c6e9dcab1dd15d46c5b3dc99abe69

                                                                        SHA1

                                                                        cc4583e7d4d3046b37adcabdeb452018566480aa

                                                                        SHA256

                                                                        777c791f52ac1bdce995f7cf8ec20ba3ed1088cab5e5bfd855ca692e9a92d175

                                                                        SHA512

                                                                        cc1a22774262063ea34fbfd8e6edc7467c4035bd113ffa0f1d7c21421dc783e9bf1ce12d71706e1dddcd1ff219dbcf32effa66f44bf97c04507ea61090258b0d

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

                                                                        Filesize

                                                                        22KB

                                                                        MD5

                                                                        f768bcb451a187c18099961c484eef8b

                                                                        SHA1

                                                                        99472c2d1918ea56c632734bc5c8a89ae6d2551c

                                                                        SHA256

                                                                        d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4

                                                                        SHA512

                                                                        a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5857ef.TMP

                                                                        Filesize

                                                                        3KB

                                                                        MD5

                                                                        904e6e94a1d46374c8630cfd86cc729f

                                                                        SHA1

                                                                        e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d

                                                                        SHA256

                                                                        8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9

                                                                        SHA512

                                                                        081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json

                                                                        Filesize

                                                                        3KB

                                                                        MD5

                                                                        94406cdd51b55c0f006cfea05745effb

                                                                        SHA1

                                                                        a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9

                                                                        SHA256

                                                                        8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e

                                                                        SHA512

                                                                        d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        18KB

                                                                        MD5

                                                                        0554d1dbf528989f5bac057cfb0bc8df

                                                                        SHA1

                                                                        602e06af5d2766c005588e7da5d2226b99b6cd9c

                                                                        SHA256

                                                                        aa9c19dac5551763da8e92c315b37247f0565ba5ba8a6b4131d8854319f7a6a0

                                                                        SHA512

                                                                        bdd28fe96c30134656f29e022074ffcbab7a1a0a247dd16801168e0833fb6fdb70c8265b7d825cb83b66524bd7950f85bd4b04f9c114e6194b759522a24f29f1

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        7KB

                                                                        MD5

                                                                        f7e0fe5b3c2b7bb47c789bd91ba1a21e

                                                                        SHA1

                                                                        c6eb9d6f457270c33965f69bdcab56c77c510b5f

                                                                        SHA256

                                                                        5af73f6c8e403f34296008f24df7b26340edabafd4624e8dd8df434695fb220f

                                                                        SHA512

                                                                        984489db82a0c3678982f5302e308e840cc0a0b181fcce4e8bce9e856e4fa15b6cfd8e22d6cf0fc0171d26dd2475b3cdb1592d895133d532c1fb6493ab8e4afb

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        37KB

                                                                        MD5

                                                                        94c91a5b83148a32e0c2b38e2502e1b2

                                                                        SHA1

                                                                        c6bb635102defd34d8b7a1d5a92ed67f52fb4e3b

                                                                        SHA256

                                                                        26ab51be27694cba2e4701864927a8a23eec9d9c84d06745e8f1db6f14e276f2

                                                                        SHA512

                                                                        43eaa52c978ad9fbdd36f021b6aa2c58225e99c8a48034ca51fa11538dc82029bfe6c4ec806fc0655b0344a866ebc987ca16eb74a5bcb120d7cfdc8e456de04f

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        28KB

                                                                        MD5

                                                                        b15081162370c4d1a562f1a83cbffee8

                                                                        SHA1

                                                                        f8e5c7b193ceacce0ba5429966cc5e1f16ee59ba

                                                                        SHA256

                                                                        f89cf2704b62a6909f38815a72cc38a829244aaabd18a18b44e21fc35df61f78

                                                                        SHA512

                                                                        e0827246d532b5237be8dfa33f5864c28fef1b2c7218e5e5254d35ffc5a1288d9e22cfac7bc403efcfdd713aa80a475624dbd014687cc614f95769132bfef88d

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        7KB

                                                                        MD5

                                                                        7d51a3c8d1f5bd169c07fcba3dfa49b0

                                                                        SHA1

                                                                        81bb38db26262f82fb7c53217346dd50f36f058c

                                                                        SHA256

                                                                        feb87eadddf4cccc8f3afcb8e54d0dcf2f51dc19fffea7aa373d4dc2a7cd0960

                                                                        SHA512

                                                                        695fd517706b8211b3712a94253186e1e1dcad657f13da69f9ab61933b95dcbc773ed7ef3ce2df74e1872f82b3def6ac95b04ac4620245fb373b1a5ca28523b4

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json

                                                                        Filesize

                                                                        2KB

                                                                        MD5

                                                                        499d9e568b96e759959dc69635470211

                                                                        SHA1

                                                                        2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6

                                                                        SHA256

                                                                        98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d

                                                                        SHA512

                                                                        3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

                                                                        Filesize

                                                                        2KB

                                                                        MD5

                                                                        f4f751a4bb0d2cebeaad4f3c297b46c9

                                                                        SHA1

                                                                        5e587571acc49a589c20e2108a86d0e2c10b0c3d

                                                                        SHA256

                                                                        ac413a7eb73bb33613396b205801508c9c10ae2c265b52f731571b30de74255e

                                                                        SHA512

                                                                        8a118ea55a3b5bfa454821e1b650e2324a7337bb712a4e7ec85c51d87d4d0335d48f5c4836c0a3f22f08d65058ab891681740a5fbb9e722444970de99db70fec

                                                                      • C:\Users\Admin\AppData\Local\Temp\3496c480-6ff0-4659-a7b3-2eef506ca5bc.tmp

                                                                        Filesize

                                                                        1B

                                                                        MD5

                                                                        5058f1af8388633f609cadb75a75dc9d

                                                                        SHA1

                                                                        3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                        SHA256

                                                                        cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                        SHA512

                                                                        0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                      • C:\Users\Admin\AppData\Local\Temp\896e3e4f-107e-4faf-a749-f6b8611d862d.tmp

                                                                        Filesize

                                                                        10KB

                                                                        MD5

                                                                        78e47dda17341bed7be45dccfd89ac87

                                                                        SHA1

                                                                        1afde30e46997452d11e4a2adbbf35cce7a1404f

                                                                        SHA256

                                                                        67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

                                                                        SHA512

                                                                        9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

                                                                      • C:\Users\Admin\AppData\Local\Temp\scoped_dir4460_1569078651\1424e1fa-d0e2-4669-8be2-38d2dec0ddd5.tmp

                                                                        Filesize

                                                                        156KB

                                                                        MD5

                                                                        b384b2c8acf11d0ca778ea05a710bc01

                                                                        SHA1

                                                                        4d3e01b65ed401b19e9d05e2218eeb01a0a65972

                                                                        SHA256

                                                                        0a6b11a5b642bf6c1938189707e109a1f48eb02018cfb146f09e74a753567d1b

                                                                        SHA512

                                                                        272dd92a3efbf6cefe4b13127e09a9bd6455f5fc4913e7477c6712e4c3fd67efe87bd0d5bf1ec6b1e65f8d3aa0ac99d5bcf88d8a44d3f3116527253a01dde3be