8b57ba1b6222d9061bc7548874aa1a7dfc846e79b0c0d2b64dfb62900337ae1b

Analysis

max time kernel
117s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
18-03-2023 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

INSTRUCTIONS.url
Size

130B
MD5

d6243a727322924914fb86362ba8d8f5
SHA1

e4b33f5ed4c3e49567bc0aa558fa44fa04b19af4
SHA256

50058400d54c609fe44cc936c76dd56261a80f1e7bccb57ba7aa149199aa542a
SHA512

583c4e87627d8030a64801056e303bb5186ae2c7945818b517facc00652672be5a268a415e333e1a2b388bc76efa0638c8412eb0e435fecd77a60edd0b5aa892

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

1228 msedge.exe
1228 msedge.exe
1688 msedge.exe
1688 msedge.exe
2652 identity_helper.exe
2652 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1688 msedge.exe
1688 msedge.exe
1688 msedge.exe
1688 msedge.exe
1688 msedge.exe
1688 msedge.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

msedge.exe

pid process

1688 msedge.exe
1688 msedge.exe
1688 msedge.exe
1688 msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

pid	process
1228	msedge.exe
1228	msedge.exe
1688	msedge.exe
1688	msedge.exe
2652	identity_helper.exe
2652	identity_helper.exe

pid	process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe

pid	process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exemsedge.exe

description	pid	process	target process
PID 4780 wrote to memory of 1688	4780	rundll32.exe	msedge.exe
PID 4780 wrote to memory of 1688	4780	rundll32.exe	msedge.exe
PID 1688 wrote to memory of 2864	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 2864	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 5008	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 1228	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 1228	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 1352	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 1352	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 1352	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 1352	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 1352	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 1352	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 1352	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 1352	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 1352	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 1352	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 1352	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 1352	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 1352	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 1352	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 1352	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 1352	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 1352	1688	msedge.exe	msedge.exe
PID 1688 wrote to memory of 1352	1688	msedge.exe	msedge.exe

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\INSTRUCTIONS.url
1⤵
- Suspicious use of WriteProcessMemory
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://telegra.ph/ACTIVATE-ME-HOW-11-26
2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8afde46f8,0x7ff8afde4708,0x7ff8afde4718
3⤵
PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8720477957687709554,7999743414098452231,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
3⤵
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,8720477957687709554,7999743414098452231,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,8720477957687709554,7999743414098452231,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=3008 /prefetch:8
3⤵
PID:1352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8720477957687709554,7999743414098452231,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
3⤵
PID:4864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8720477957687709554,7999743414098452231,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
3⤵
PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8720477957687709554,7999743414098452231,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
3⤵
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8720477957687709554,7999743414098452231,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2824 /prefetch:1
3⤵
PID:432

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8720477957687709554,7999743414098452231,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
3⤵
PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
3⤵
PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff685295460,0x7ff685295470,0x7ff685295480
4⤵
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8720477957687709554,7999743414098452231,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8720477957687709554,7999743414098452231,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
3⤵
PID:2232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8720477957687709554,7999743414098452231,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
3⤵
PID:5064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aaeb1f5e097ab38083674077b84b8ed6

SHA1
7d9191cb2277c30f1147c9d29d75fc8e6aa0a4f2

SHA256
1654b27bfaeee49bfe56e0c4c0303418f4887f3ea1933f03cafce10352321aef

SHA512
130f1b62134626959f69b13e33c42c3182e343d7f0a5b6291f7bb0c2f64b60885f5e6331e1866a4944e9b7b2e49fe798e073316fde23927ede2c348ba0e56eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7f126487-f587-43af-ba2e-c35a30071835.tmp

Filesize
5KB

MD5
3529f40d23c618e9ddddbc9939044e7c

SHA1
2962fffa5a70bbe0f19c9de6c76b92beb06dba66

SHA256
3c4d75ac984a6cb50c96151d3a8760bf60bf7cb9966c060aa8c0a220fc697a30

SHA512
261dd11b690c27d24e039a187a557405ec2ca84176c0cfdb3f989286278fca9892281cfe9b55cb91105e92a380b4a4c1daf7d1a2f58764337b2ec87088ad5d3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\98bf8c09-b1c4-43a8-9842-c8df5ec987be.tmp

Filesize
4KB

MD5
3b6b7cdff1b2dfe9a39cf35cbbe25ae4

SHA1
479663ad61b2850f9e2704d6d29ffd60a4572cde

SHA256
f38d61f14a68ed45de011e4ad8153aced51ac184be08fca09c1bbf97650884eb

SHA512
653e93e7183ce9614ff6df92f38bde312fff4a72e61b83bb13bec9f1be0e92cc0862637d2b90fba199335fec79ff42e6132dc65448c4d376d416c051e0b74e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
e0d5052758ea24bc9a10a4c6211c48ef

SHA1
170c53566d6dba27a0dbc4899a5bc6e582abb8ee

SHA256
26c24333062ed1261f5ab22e0b0aecd2740c3aed627e569385dfec532d239d4e

SHA512
53ed3328a6c8fd0018d826c921c75aeba2c9e59a226018b5bd8036f227e264fb19adb896d731af6ccb832b672640dbf42b6683e15bf26593692f4c7af9e6ff6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe56e6fa.TMP

Filesize
48B

MD5
5d498141088b2146993c25c748f5645c

SHA1
2481b610280e66b50b585c8e9c917da10abfe3c3

SHA256
89816f8b50d7a3ee0ba439823612cb8d1e2dfa070beea4752f9cf64f527d0792

SHA512
893953c8b0eef0b4ff6c2a63e62f578fdf505790542e88166ffe37c8282f04a3fac7d1a0a6e13a1ade4abfaa46a31347b442970ba876e1a5c55ec80840773a77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
2f25ef023da0066d5f20eacd10526937

SHA1
517f51fc21e7145a09e45fd546e07060dad34496

SHA256
d030b06e4a2c4cf695d28f4c09bcaecc3d5caa81073626bd1215ec20a273e008

SHA512
bb06a00e01a09bc6461f3e03330667cfdc4c9a0dbadf06a12e14615b30410cd7130c4ce7d4f4b8f24c33d63ddc937d5cde7d4a9038b05ad65b36e2f22a76de8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
240B

MD5
4aea01b6a81e4d57f6e56b2407bb2550

SHA1
683786a97f1dffda09410c32f1ad5ec096576ab8

SHA256
1af514297aa682665d0a57a29cf7b1e4639e19c043fabc933af643ad71727d0d

SHA512
efbe333f8e6e07c1334e72a67b66a4a9211ba22f35fbde2d70668bf091d805ba9b0875cf07e21e4b74038d3a75f76b6122237d26cb3584643833ac59c26467eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4d5d013b61e92f01978cac07e0fc9387

SHA1
a2e563d3805e154d6a459a44a270c9ac5fbb3f9e

SHA256
e719e6daab5834507085c9ff2305f1a969d3857630814cc32c9a99ac81ea2c7b

SHA512
a4642596f8af82f5131842ad82d3abae71e8e83e08211ff1299fb6a30113bcc84593ecc72b1c03cf3499896620f21ca12c9b7c3854dd4b1faea09eab1adf8ab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
47e94a96372e6f095b8a3fd7edc48ec0

SHA1
377b68f34e5964ca8be1b1b0c1507dd7f0e5f005

SHA256
15c77bafd922bd085317fd544d0fa129e3b8c814e3ba0d48936366004427732e

SHA512
5bd63de2e831805b723d7ddf1343c3b721ef5b757d9ab01bf8554ef8e29ac2cc09fa104fc85d530f27d66b67280774b3ebbef6729ea3ab61ce8028ab4ba5bdad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
98f57d91179d5e1b619195c391e4b656

SHA1
70ace520f64ce0273802daedc7a7df1be596abc0

SHA256
9843baec778f7ab2665a83cd1a11eee93eb78923247cc6bbfe138431e51a2078

SHA512
53a8757503aeb1f4bafcb8cc3c913c3220acebca8fb2606a8b18d2ca3f79d108dc8da675ea25da34a5c81d7e667a6f35f666c4f6e04aac6eec60cc5a549e0829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
44aa348024de5157ee6fe3145b948499

SHA1
f35efe04b8d42e8529e3cb0fe1b193bad176074b

SHA256
196c566c07544e6059b687024299bacad992782b5b2ab239b1dc5f2f6c18b7e2

SHA512
aa514d6376aecbbf656445902f52f4889e2103d956fd06b03e6bb92c33f843095537ac6178cf2dc5b109bec444a3eee29d0c34c1a030ea206bcfd48226c0b106

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
ff35f817e11711f7e306061f8454a2fa

SHA1
3e126213739ad5b878a0c93ff01e4299eade8299

SHA256
153772743e511b1e4c0bc44d5e343f93bc8dcc1dfd0be4f451d0ee8fe0814284

SHA512
3b07b309cb0eca29834e2024380555c3f916d4484e5f9a2b56ca04505c1382d1b4d7692ce857d3ddddd453d6d6ae48b4416edefe189f729438826bb1644cac33

Download Submit
\??\pipe\LOCAL\crashpad_1688_JNBTCDDGLOUCNISO

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit