hxxp://creativecommons[.]org

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2025, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://creativecommons.org
Sample250708-hd4bjafl21

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_343975391\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1289110336\crl-set	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_343975391\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_343975391\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_207108189\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_207108189\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_4148_1801210601\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_93_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_207108189\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1936541601\_locales\ja\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133964302989874463"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1153236273-2212388449-1493869963-1000\{F343C5AB-B332-4535-9C71-19385F83BE0A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5804	msedge.exe
5804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 3932	4148	msedge.exe	84
PID 4148 wrote to memory of 3932	4148	msedge.exe	84
PID 4148 wrote to memory of 2616	4148	msedge.exe	85
PID 4148 wrote to memory of 2616	4148	msedge.exe	85
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 1448	4148	msedge.exe	86
PID 4148 wrote to memory of 5252	4148	msedge.exe	87
PID 4148 wrote to memory of 5252	4148	msedge.exe	87
PID 4148 wrote to memory of 5252	4148	msedge.exe	87
PID 4148 wrote to memory of 5252	4148	msedge.exe	87
PID 4148 wrote to memory of 5252	4148	msedge.exe	87
PID 4148 wrote to memory of 5252	4148	msedge.exe	87
PID 4148 wrote to memory of 5252	4148	msedge.exe	87
PID 4148 wrote to memory of 5252	4148	msedge.exe	87
PID 4148 wrote to memory of 5252	4148	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://creativecommons.org
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x30c,0x7ffc2cadf208,0x7ffc2cadf214,0x7ffc2cadf220
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1832,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1980,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=276 /prefetch:2
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2572,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3496,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3504,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4908,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5160,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4812,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4944,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5896,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5896,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5984,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6384,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6316,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=704,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6344,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6496,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3820,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5800,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3744,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3792,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5796,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5560,i,18414950549545199073,14069477501515503382,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:856

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:6108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4148_1289110336\manifest.json
Size 114B
SHA256 63dfb8d99ce83b3ca282eb697dc76b17b4a48e4065fc7efafb77724739074a9d
MD5 e6cd92ad3b3ab9cb3d325f3c4b7559aa
SHA1 0704d57b52cf55674524a5278ed4f7ba1e19ca0c
SHA512 172d5dc107757bb591b9a8ed7f2b48f22b5184d6537572d375801113e294febfbe39077c408e3a04c44e6072427cbe443c6614d205a5a4aa290101722e18f5e8
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4148_207108189\manifest.json
Size 79B
SHA256 6722a860c855cf94a54fd1ffdd3801c4c949f5b67d8601ad300264931057f2bb
MD5 89217e000f3145a2523e43f947208e79
SHA1 cd7915d003ee87f2babc9ee9add12841022710ac
SHA512 385257ef9c67d80006eb350ac79718f30e08d810a1568454806f2505b482e0093f784d0d4cd24078317f863db500898343ce69391c0ae7fc767697f6da38eeaf
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4148_343975391\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4148_343975391\manifest.json
Size 84B
SHA256 2e9e6138305d702f3c9b89d6e9dc4931b548c69bb86db64e585fa2e37b8ef654
MD5 e0909520982fc48e47a6451443b11741
SHA1 0e46425274933c153ebf5a03f25e693267a8cea2
SHA512 3fdf504cb0bf39a807fa15a8ec31a6efd8083888692935ec31d70b4ef6eef89b8527c6a75a46bf7ae3efeeaa507ac3c7cccda5246a2f073ac603a7ffa10d20a8
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4148_419538710\manifest.json
Size 176B
SHA256 8a4800ed5f63b9371a024c501ee2b031af94539e32e6753214e6d99c625c018c
MD5 8177721150435a9b333475e2b8a6e691
SHA1 8aa8981617e8f3d8967a0a4a2d20315317eba293
SHA512 540c4c52030c6a4e1efcfab5eb59760c696bb3e3f1b8f93c97a6368639a911ba3d395190fc0798d99f3c63e25b6dcf2ded482bbda34d36ddd874dd20c2cfdf74
MD5 SHA1 SHA512

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2024.12.2\crl-set
Size 21KB
SHA256 124b7eeba31f0e3d9b842a62f3441204beb13fade81da38b854aecba0e03a5b4
MD5 846feb52bd6829102a780ec0da74ab04
SHA1 dd98409b49f0cd1f9d0028962d7276860579fb54
SHA512 c8759e675506ccc6aa9807798252c7e7c48a0ab31674609738617dc105cee38bce69d4d41d6b95e16731466880b386d35483cbeea6275773f7041ba6e305fae9
SSDEEP 384:qt71+UBzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1pA:a4GBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac41191dcaf36d91f7bd9a077bc59b1bd7218daa27b263d1da6a548f58264987
MD5 36326fcbb6119326e7c8aa24c4156548
SHA1 ed128a9727e1d58b970e732b8c66fc827b18372b
SHA512 ed5c79f1edc0c65a1cf0ace91ea5538245c1569c3b25ae3cdf033ffcb55d37e7b09baec36570e82fc1525c24224cea08a53abab7e52db6376f48f099ffefd1fe
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d1dafb5156f0e95101e771d7c97203f04a6a3f29e710e3941c0bef42e40744db
MD5 89a86633db437db11b23c9062472e378
SHA1 f70761a9931c80e693609b2546612c74035bcd01
SHA512 e9a322d6045eba388f0dc8cff81107ad1f5e344a990f0ed3c995f10790db2306d8b907ffdf11205faa3652f62e5d9709f62ecfb4c9edacf8c5be75d752b70a3f
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57ceaa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57ceaa.TMP
Size 3KB
SHA256 3212d72e04d24e3e911ff46c1d42c81c0f3476b5eb4978c338ac3ce562d424fe
MD5 f6bc096c98f329a15c24541e69d2ad4b
SHA1 68581d8d47cd3f907744b054534e178309ef06ac
SHA512 2dee14520f2c68dada50bc295f0481b284fb071d77524a38e18eb04aed8d51f72b1252f4445ddd4acf192130f9793b2bed51816d9d559ff448667105e3718fe1
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 ed5586dcd64718acb03b62456fda21c0ae2e116b787aca7ef24bb719cae9f48e
MD5 5d2e65bf482f1e7b272b73cef1cd48c1
SHA1 f9ca9db3a8a8f65449378c1b340ee70855dc06d7
SHA512 893eb18749954a10fdd2d909983aad3887bfe4e53a295cda4fae2f02613d0ff02fc5774884303f35b8d40bed3313d4ca7eba7ad5054648ef37238f69af1ac8d5
SSDEEP 1536:I6LPH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:RPHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 14a21b65f34dfc3c31c2372bbe4de380405fe4b37094f2cedbbfa1d2b86c8d89
MD5 37a8f4a85d411aba718ec5472805fc27
SHA1 5e2f8ab6a7a6d279a5368b0a1f179dba2b3bc81e
SHA512 639f955022db0a450aa75f49f8adbe8fa824d70246d8ba434cd186f9dba5cd7c4ec575149fd2ce193d41d00bfb434c2248154e5840b679e59e771c8f113f31a1
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 9774c89c55867abaae6e75c4c14fa73b05662dacb9a8bfa77c55ed787a561f22
MD5 0d00b00d9ad7bbff7ff1a402720f7047
SHA1 d2d9fe1df41b31ef658a5325c92fe23ba5d2a99a
SHA512 e025e9d68276ed81ac6f64ce47e0f09bc2cefa9768beebddbeb56317dc1d6690fa94f7b8a11056ae79902d214ac83e2655d7c3ce6a800a035ac74c729464919f
SSDEEP 384:sVOjLqnUsWKdBUEPHvxHSYongpOobl803:ssqnOKdB3ZHS5ngpOobr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 9d0c02036e43541dc8a154d27b563903611cf6b139e6f4c703cdb5710c9a0d5c
MD5 f1a715bee52ab0bd85b6d6f816eeea03
SHA1 b5a0917fe09715e5afd2a082c3a26daed1d9f0fe
SHA512 340ff9c5d8940805d242e005d00d835d6bec42443d58b796c5655597da83cdb83c74bfcb92065697e50aac0355656c4a97289dad3db5450ce6ba6e64358069ca
SSDEEP 192:sVOR4yMqv/Ky0Ml8MgUstjcwtwMXZmEXfSGsezoZ8pxHY+WN1CSw4nEzgpOob8GU:sVOjLIUsWKdXUEPHvxHSzwjgpOobl853
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 db6924f9c21635da44c1cd21edb4cce62dded823e34958cde34a54b1cd3ac966
MD5 db0d3e7cfde5d84e6e7310c96eb8b9b2
SHA1 39ad53ccf06e19743543a9ed844d40a5155b09a0
SHA512 2f96cac83452d861b902253b75abd8cb8cd961d3ce60c5a1ccfdc3f2b9b15a7759a8a80ae2dfa62ff50ada06ef046999f87338d8c71eff5b6c175723fc311f0e
SSDEEP 192:sVOR4yMqv/Ky0Ml8M7UstjcwtwMXZmEXfSGsezoZ8pxHY+WN1CSw4nEzgpOob8GJ:sVOjLjUsWKdXUEPHvxHSzwjgpOobl803
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 710ad452b168deb632d83719276564470386e9f380c1aa3e8aa023e586f60687
MD5 03c111cc1445a99a2391cdc394f00404
SHA1 b74f7254714ab1099dfd75ac3a9872123e34fa74
SHA512 36955575629eb5cdf9019aace03914f6ebf200a52d262b30c2cc7ea87cf48aee009538aecd2dca04603665f064fee1711cff2a11f16fa3c28d234d5a65292394
SSDEEP 768:NItt5Ka7pLtLzyIWFIgYc8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAy+3Ll/tAwSroL:NItt5Ky5zyIWFIgYcu1jaXy+3LFOwJu4
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 8fbcbf8d2d9e38d652e245046c55719c131a0c5218414462d8660a100795f113
MD5 47227eab7ad2cccdcc47028843992ded
SHA1 24a8fa7cc88399877eca8116cd95a8b78c1ceb53
SHA512 0b54d58cd9c3f635937fe14e026d990f030403bee2dbcdbae7656aef6666b6cef16cfd9054d793d20b7b55cf2d6771b40c3c48e062967c238cd60ef0c5388f0b
SSDEEP 384:7fWjvtZlIpEL3r5lvEdYfOYPaWgSSzupS+E2AAxOnf:7
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 465B
SHA256 bfa8afb896007a0c57caff8b2b3f2fcc2772e9e4fa892ab14eed065c719d20bd
MD5 ef8d3eb2ca8719f9c96aab908e8128d9
SHA1 f5ad350e65672a874885a1d94bdc765009df3b03
SHA512 bb100008b18d6061e518af64cc0f3500f166f8d2d4a13e960d89a0293b8cc6ac8bd61e35dcd993480c5d5cef27eb43559a5aa616f05163d33259feb75d87652c
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 5KB
SHA256 47dee228118e36e2082b94c981c2d020ca84780d211ae553f5aef86bf882bd69
MD5 ffb025979b1ca736807054c59c69210c
SHA1 954d8fb24083173355f4c6c6aa8d585ff548f984
SHA512 9eb2dd97922ed185081478ac4fecab8436e4afad93347933a70acfe0ea0a72e378b2010848f42b3d3f3a97845a3b719fa447599c11b230de9c952389526d5f68
SSDEEP 96:K5JR+0+IC+H+DQ+B+XST+STk0I0ZeNcUyn/xa7jyS7r/Ro:K5XST+STktWejypanySf/Ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 896B
SHA256 7a0fd2129717fdb6342c2ae93a85e4645206de23bb468635cb29cf05383d3b20
MD5 0452888b95f1afad51d22a91b1fddc7f
SHA1 a0ccc72c7ea9a23c97b6382462ab2da4a735a23c
SHA512 85a3148866f2ccf4cba27f4427f8267c6681a71e8486b30d506bcebcc986ff320193575342a83a12766d1bd7b76c7b72a62edfb7c55334c1ed7ed86cbc954b16
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 4503345ee70aa9ca0f90012b665743d7c13ec7052e7a943222287973b752b9c7
MD5 3bca8411b45106afaa963d562c371631
SHA1 78857d33a65e7061ca18a3540c304f01e7e85325
SHA512 a6a7e9af6613a30730a0b87be76f87144a3483afb756445d462de7b22543027e5e8f5822e0337ba2d7b65e413e526da962783d05d226c0d13d113d57d28b56ff
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uz:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 cf412326902d61281c5c6931c6b490db8c119921037e3969a73d82ff225879eb
MD5 c823554b9832745c3ae2d01dd983997c
SHA1 7353dfc9ae3c2dd924ece3d17195952cf6a741c8
SHA512 4725336672ab6577065b4d8d7999a07ac270d6a0aae97dc5f5ed48c4681b6033ae8eaadeae141d635f1e6ddba7c0859f465d13eb5b13c979256b3e08e85b23c5
SSDEEP 768:wQiE6esE8lDldUGz3rwgHUuCFcghcBNKf6TYX2mXsHoV533pY6ko:EeB85d73luf6T22WJY6ko
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 46KB
SHA256 8e480466fada38e0dc1b4d8e7a9255407942a75ec58431319cd8bef00f3c2dd0
MD5 8da989f3e547bc36da16ceb19658203c
SHA1 667ee1e7207a6ccc63068feb58b431feb185b00e
SHA512 60698627e0824e07b91886e68b8b7377f3360175f71401d8e2aac2e67ee7d229314d03c3afb29213d533d52eeca5768f1aac7787735acd429e834f88d5401ab4
SSDEEP 768:6QPE6esE8lDldUGS3uwghUQdrFcghIgTR6dMK2NRDoewJpY6OF2mXsHoV53r4:FeB85dK3Uhv8q0Y6OF2Wc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 58d6ba4e7916e38c6f1f261544531a105e75b4d407e36ca7a8b3754e99cfd27d
MD5 0f88991f59ad8160dc7f03c076ac4de9
SHA1 d4a1f6323392ea9e00f39317f9508d085764b04b
SHA512 9316d77cc3407b8f33e459c7cc3f7c2bcc69f76a1acfd68e668828d607962344a7c665d16b8aaf7a69537e2bbd4d157cd126dca03ac89d9c09ac30e550ce601e
SSDEEP 768:QQiE6esE8lDldUGz3rwgHUoiFcghIg3R6H2mXsHoV533pY6ko:keB85d73lGYH2WJY6ko
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 391d1ad15f8980463b94c93ccd6830eba1ddca4901bd49a21776b48031b448fa
MD5 b519fad30ca5fce9ed8ba0d0c4761355
SHA1 7aee4793e33261e9a7b1579ce6291e42e533b890
SHA512 f07d1b48d6fdcfc9f49a4abaa1fd5dbe8c224ad21abb420eb8f42e89aa88e20f029aa77348e59b3294763779f4ac223f44fd2afcd1dca6fd651caf539992a545
SSDEEP 768:6QiE6esE8lDldUGH03uwghUHrFcghIg3R6H2mXsHoV533pY6xQo:aeB85d/03UqYH2WJY6Wo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 52KB
SHA256 886c1d58e84f0fa8e2ba467a083d41db8ffc77f71d2d6c9d1714f96d1763fa36
MD5 af37aab80c64fe19aafc17546e936ba2
SHA1 90a6e472656957e9005852472471f9ae3d6c038a
SHA512 efe4f1accdc7017f45ef17da87eae9c64b2a10f375ca50450062c7c76b76b515facc72a6e9b9f60b9ab1a3bee284d07c62325ab3ad0b9597ed33d8012f9af61b
SSDEEP 768:BFPE6esE8lDldUGJ3uCgqUQtrFcghIgwR6dMK2NRDoewJpY6OF2mXsHoV53r4:LeB85dx3FhfVq0Y6OF2Wc
MD5 SHA1 SHA512 SSDEEP

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.5.15.1\keys.json
Size 7KB
SHA256 f967e18d5b1839ba801212f032e7e6dd92f7ba6958bc3ae9b122d9fadf2b1bf4
MD5 03f15dff10ac451682f8a308674ddf77
SHA1 c723e23c49bed8a52b8f947b2cb8879a110fc94b
SHA512 df8fdc89cc1e6f2edce49b41bd9f71dc7f7a8daab40f1355415119f9c0a0d5067337d966472ad49f855ecb9a89bee8d1711d8a869589a03e469530ee8d7e0f3e
SSDEEP 96:UXq6pG2GE+Vy2+yzdswsDm4+m0plhYvPuW+wkpTm+ozdswsDm4+uTaQSfmXAgz+y:uNtGbVKyR9Pm4lOvMwkoR9PuGMXcy
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.0a6b11a5b642bf6c1938189707e109a1f48eb02018cfb146f09e74a753567d1b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.0a6b11a5b642bf6c1938189707e109a1f48eb02018cfb146f09e74a753567d1b
Size 156KB
SHA256 0a6b11a5b642bf6c1938189707e109a1f48eb02018cfb146f09e74a753567d1b
MD5 b384b2c8acf11d0ca778ea05a710bc01
SHA1 4d3e01b65ed401b19e9d05e2218eeb01a0a65972
SHA512 272dd92a3efbf6cefe4b13127e09a9bd6455f5fc4913e7477c6712e4c3fd67efe87bd0d5bf1ec6b1e65f8d3aa0ac99d5bcf88d8a44d3f3116527253a01dde3be
SSDEEP 3072:REqT/cpnWG/Mrp/D8JSZJtO7ytDxzD0Obh9FyqnwKIBcrxavPh:6yknM9/rJtO7ytDxpysFISIvPh
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ee282f5459eeb67ad3170f10991eb85b61051036b5f42d5da50e7ef47e805dc5
MD5 1037c9655e102f9559d424e8f4692cfa
SHA1 cde43e494d9564fcf7622cfd9f2ed0dd2fc3ec51
SHA512 7778120819f544d81afcea95a7833e124aa028349cbbd3cf93de74b5b5a15de2e038360327bcb19db5aa414443c17198e689f21299f93affdafe1cb853602e36
MD5 SHA1 SHA512

Submit Download