bf6f921c8a421df1c38380a43ce932510fd8f3b556ae97267149ceb99d867a29

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 10:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf6f921c8a421df1c38380a43ce932510fd8f3b556ae97267149ceb99d867a29.exe
Size

52KB
MD5

673e6dec2e69129a9d3ef2bf0d4cae60
SHA1

bfb564399b41566f7ef7217211ed134a158c80f8
SHA256

bf6f921c8a421df1c38380a43ce932510fd8f3b556ae97267149ceb99d867a29
SHA512

2107ec9f5f8ff72033b2d8933578a6c235b02d90e8fdcbb0b55686ab3fd3f65821de8d0652e56f4dc1a8a8a7b26759e229d4855f0020ab8224f89c6a4928aead
SSDEEP

768:GvM4yZE9U611S5TJSEkGu+ZK4N2EZYjo2ay8k:GvM419b11iT8UuM1sESv8

Score

6^/10

microsoft persistence phishing

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6fdcbd30-6bc6-4ed5-9c0d-a4adf27874c1.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221014190415.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2116	msedge.exe
2116	msedge.exe
2672	msedge.exe
2672	msedge.exe
1496	msedge.exe
1496	msedge.exe
4896	identity_helper.exe
4896	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1496	msedge.exe
1496	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1496	2196	bf6f921c8a421df1c38380a43ce932510fd8f3b556ae97267149ceb99d867a29.exe	82
PID 2196 wrote to memory of 1496	2196	bf6f921c8a421df1c38380a43ce932510fd8f3b556ae97267149ceb99d867a29.exe	82
PID 1496 wrote to memory of 3224	1496	msedge.exe	85
PID 1496 wrote to memory of 3224	1496	msedge.exe	85
PID 2196 wrote to memory of 3664	2196	bf6f921c8a421df1c38380a43ce932510fd8f3b556ae97267149ceb99d867a29.exe	86
PID 2196 wrote to memory of 3664	2196	bf6f921c8a421df1c38380a43ce932510fd8f3b556ae97267149ceb99d867a29.exe	86
PID 3664 wrote to memory of 536	3664	msedge.exe	87
PID 3664 wrote to memory of 536	3664	msedge.exe	87
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 1496 wrote to memory of 1832	1496	msedge.exe	97
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96
PID 3664 wrote to memory of 1884	3664	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\bf6f921c8a421df1c38380a43ce932510fd8f3b556ae97267149ceb99d867a29.exe
"C:\Users\Admin\AppData\Local\Temp\bf6f921c8a421df1c38380a43ce932510fd8f3b556ae97267149ceb99d867a29.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=bf6f921c8a421df1c38380a43ce932510fd8f3b556ae97267149ceb99d867a29.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9bf4b46f8,0x7ff9bf4b4708,0x7ff9bf4b4718
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2480,888456989382526693,3259266587988465152,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2656 /prefetch:2
    3⤵
    PID:1832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2480,888456989382526693,3259266587988465152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2672 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2480,888456989382526693,3259266587988465152,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3176 /prefetch:8
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2480,888456989382526693,3259266587988465152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
    3⤵
    PID:2180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2480,888456989382526693,3259266587988465152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:1
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2480,888456989382526693,3259266587988465152,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
    3⤵
    PID:3828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2480,888456989382526693,3259266587988465152,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4728 /prefetch:8
    3⤵
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2480,888456989382526693,3259266587988465152,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4496 /prefetch:1
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2480,888456989382526693,3259266587988465152,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2480,888456989382526693,3259266587988465152,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6128 /prefetch:8
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2480,888456989382526693,3259266587988465152,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
    3⤵
    PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2480,888456989382526693,3259266587988465152,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2480,888456989382526693,3259266587988465152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6488 /prefetch:8
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff670245460,0x7ff670245470,0x7ff670245480
      4⤵
      PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2480,888456989382526693,3259266587988465152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6488 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2480,888456989382526693,3259266587988465152,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 /prefetch:8
    3⤵
    PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=bf6f921c8a421df1c38380a43ce932510fd8f3b556ae97267149ceb99d867a29.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0x78,0x104,0x7ff9bf4b46f8,0x7ff9bf4b4708,0x7ff9bf4b4718
    3⤵
    PID:536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2492,10856279048772200987,15396604188759657989,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2668 /prefetch:2
    3⤵
    PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2492,10856279048772200987,15396604188759657989,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2748 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Filesize
471B

MD5
97bdf23775610717cd5dc4c9be1eb370

SHA1
3be88d4fd3ecbf30017b3112e7ad4a984bb68106

SHA256
bdd886d6ad37b8d416de1faf3672a0e2b72a5c1530b14664cb2d40d0c26eeb5c

SHA512
07b4e923ac2400304148a4d9cfe1e0e9a4dd94a829bbc11d451cdc919d03d8d2e73aae89e977aa4167a223b4662983fcba4b7fcd12561522dbf210c26fde5867

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE

Filesize
471B

MD5
6023774869fb68a520fa8a81eac74813

SHA1
9efacffb8430ac402698944cb030a488d4a9bb0d

SHA256
b5f5303a669fed7b98beaf9d785e84b10c8f857395cf26aa6eecbaf192163407

SHA512
744f592160b79a102837ee18f7018f00e80f8b8d71fca4469b15d212803920ef2b2e523b2b38d92df430fd8ff95a853bc3d519a2d8f95d11de4852e6d99f6dc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Filesize
442B

MD5
bf5700041dd195f351586d00935404a2

SHA1
1586487a8fe8c2761530885c75d71351d078e636

SHA256
e70d32de32c0a4af9820655d14093ba0fa8aca93e27f66a0b99e2643e4a173af

SHA512
48ca3ce8f96057e2f1c5fbeea070c5f640b36e78844da0275e57c4964bf7ceb066a9aaf9cef5e8a1ceb8937fd01de78d2f625be9e5390f1e1ad16399c17e86fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE

Filesize
446B

MD5
b98296caea040654a7ef0363ebdccc36

SHA1
893e848bb123c8192fd0026f8d01f91b4950db63

SHA256
da23fe9a3a0df3f302030a2b2ead0d7111c73c1be4fed4a91e3afae1341dcf17

SHA512
b945f6d96b3cbab1d2909d21bc48ae298945c98dbbdc91dc01548fb5884ac93af5bdf19e6712545e24897f640060c84796715794ddc32a3ecc606aefbdde3520

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1661723f09a6aed8290c3f836ef2c2b

SHA1
55e08c810da94c08c5ee54ace181d4347f4e2ae5

SHA256
a6527662d502234a1a9847973eb8e39e817aa145c43514229ba720150f74a2f2

SHA512
dcd1e6320510594dd86568608d905ad5aacd4fa2b3369ac4daa1b938f7f0597da64747875a3567e5c05e5de34f77d87f5effdfda8091d01354699711f4bc12ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1661723f09a6aed8290c3f836ef2c2b

SHA1
55e08c810da94c08c5ee54ace181d4347f4e2ae5

SHA256
a6527662d502234a1a9847973eb8e39e817aa145c43514229ba720150f74a2f2

SHA512
dcd1e6320510594dd86568608d905ad5aacd4fa2b3369ac4daa1b938f7f0597da64747875a3567e5c05e5de34f77d87f5effdfda8091d01354699711f4bc12ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1661723f09a6aed8290c3f836ef2c2b

SHA1
55e08c810da94c08c5ee54ace181d4347f4e2ae5

SHA256
a6527662d502234a1a9847973eb8e39e817aa145c43514229ba720150f74a2f2

SHA512
dcd1e6320510594dd86568608d905ad5aacd4fa2b3369ac4daa1b938f7f0597da64747875a3567e5c05e5de34f77d87f5effdfda8091d01354699711f4bc12ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b3f352bbc8046d1d5d84c5bb693e2e5

SHA1
e9d1ec6341b7959453e7cfb1ec65a55bf415cd4c

SHA256
471da5f4a494fb6adb027e3fd80765a6c27a3967208aad8fb55e38a3f7fca7da

SHA512
c984248535cb94fc265e93b9001d5936697dd2ff3ef8dfedd014df64b5f76e031eea1a594db3085e0149794ad90802a45c6cd985035ba383d1bf80ed928ff809

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b3f352bbc8046d1d5d84c5bb693e2e5

SHA1
e9d1ec6341b7959453e7cfb1ec65a55bf415cd4c

SHA256
471da5f4a494fb6adb027e3fd80765a6c27a3967208aad8fb55e38a3f7fca7da

SHA512
c984248535cb94fc265e93b9001d5936697dd2ff3ef8dfedd014df64b5f76e031eea1a594db3085e0149794ad90802a45c6cd985035ba383d1bf80ed928ff809

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
eb31abddae59b7fb9243f4f88627bedb

SHA1
9b24731c076290cf1990f051a0ed680ae4ac366c

SHA256
8ef8636ba522ee4729a68cdd82d36764d9e01e8eb283c7d82c75cb4d5e8958b1

SHA512
5a766472566dda95e8c9fd4dd64805754f9aabfb87dcab085fdc5dac7d508ba2b27660c60bc2bdd548af5b7375dff2e99de3ef3b4ed90cf864eb571393ed6e63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings

Filesize
81B

MD5
f222079e71469c4d129b335b7c91355e

SHA1
0056c3003874efef229a5875742559c8c59887dc

SHA256
e713c1b13a849d759ebaa6256773f4f1d6dfc0c6a4247edaa726e0206ecacb00

SHA512
e5a49275e056b6628709cf6509a5f33f8d1d1e93125eaa6ec1c7f51be589fd3d8ea7a59b9639db586d76a994ad3dc452c7826e4ac0c8c689dd67ff90e33f0b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

Filesize
126KB

MD5
6698422bea0359f6d385a4d059c47301

SHA1
b1107d1f8cc1ef600531ed87cea1c41b7be474f6

SHA256
2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

SHA512
d0cdb3fa21e03f950dbe732832e0939a4c57edc3b82adb7a556ebd3a81d219431a440357654dfea94d415ba00fd7dcbd76f49287d85978d12c224cbfa8c1ad8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris

Filesize
40B

MD5
f50ffcb8180fbd4a4f281b1ddd72e7a4

SHA1
3d01ce173e1c50a44d25a9cee7b57aa28abf6918

SHA256
09071e7fa9ce65838e40bf709d5e41539d157bd3c5eb6a353087cca131668e55

SHA512
c015ac5147a408e6544ea344690225a532ad7009936622837a1ddd055328b21df9b1e305989cf584cd6cc6f5ef9e9c5ed2f65833d4916e1de36ba5aebf6319bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_638013609515431581

Filesize
4KB

MD5
da55003345f941db2d7f2e81aa83f4f3

SHA1
13bd776cb2580f820ec57c088ec90c7567807d7e

SHA256
5595907ee83a37889c4ee3275651f6f75b5e9937ec2379ad36e2c04d4d8a7ac7

SHA512
a8443d4b48ac5f69ba51d756dac41c3b79dc9a93710e69da33d416b34f2aa0fbd07b72099d22c29958b0926443fd5f29ffbf39b6c8b86f7d075f54c9ca919c93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic

Filesize
29B

MD5
52e2839549e67ce774547c9f07740500

SHA1
b172e16d7756483df0ca0a8d4f7640dd5d557201

SHA256
f81b7b9ce24f5a2b94182e817037b5f1089dc764bc7e55a9b0a6227a7e121f32

SHA512
d80e7351e4d83463255c002d3fdce7e5274177c24c4c728d7b7932d0be3ebcfeb68e1e65697ed5e162e1b423bb8cdfa0864981c4b466d6ad8b5e724d84b4203b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic_638004170464094982

Filesize
450KB

MD5
e9c502db957cdb977e7f5745b34c32e6

SHA1
dbd72b0d3f46fa35a9fe2527c25271aec08e3933

SHA256
5a6b49358772db0b5c682575f02e8630083568542b984d6d00727740506569d4

SHA512
b846e682427cf144a440619258f5aa5c94caee7612127a60e4bd3c712f8ff614da232d9a488e27fc2b0d53fd6acf05409958aea3b21ea2c1127821bd8e87a5ca

Download Submit