cad0e84b5c7a0aa2f60edecd9edd8a0db0fcdf439de63db7f1a4a06f3ebcf09e

Resubmissions

31-03-2023 23:15

230331-28yt3sec63 6

31-03-2023 23:09

230331-25cgnsec34 6

Analysis

max time kernel
60s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2023 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IGG-REDCON.v1.3.0/IGG-GAMES.COM.url
Size

198B
MD5

e4aeaaca90fce67661f114822a05821c
SHA1

383566802ada60fa79899fafd8965787165cc9a3
SHA256

6626bfe6c288b998647273217e711fc913371597756601d88b4352a57215d591
SHA512

6c53520d70d03ef00526648fd282b83b4faa21d8784aa848682fc023df0173142403723c2e932590d53cb1ff5439b63cc20cc640333c0e646952855436c7282c

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\a77d19a2-2d20-4811-88ea-9e40c9789921.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230401011140.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

1972 msedge.exe
1972 msedge.exe
2152 msedge.exe
2152 msedge.exe
1892 identity_helper.exe
1892 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

2152 msedge.exe
2152 msedge.exe
2152 msedge.exe
2152 msedge.exe
2152 msedge.exe
2152 msedge.exe
2152 msedge.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msedge.exe

pid process

2152 msedge.exe
2152 msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

pid	process
1972	msedge.exe
1972	msedge.exe
2152	msedge.exe
2152	msedge.exe
1892	identity_helper.exe
1892	identity_helper.exe

pid	process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

pid	process
2152	msedge.exe
2152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exemsedge.exe

description	pid	process	target process
PID 912 wrote to memory of 2152	912	rundll32.exe	msedge.exe
PID 912 wrote to memory of 2152	912	rundll32.exe	msedge.exe
PID 2152 wrote to memory of 408	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 408	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 8	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1972	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 1972	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 4336	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 4336	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 4336	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 4336	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 4336	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 4336	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 4336	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 4336	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 4336	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 4336	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 4336	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 4336	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 4336	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 4336	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 4336	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 4336	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 4336	2152	msedge.exe	msedge.exe
PID 2152 wrote to memory of 4336	2152	msedge.exe	msedge.exe

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\IGG-REDCON.v1.3.0\IGG-GAMES.COM.url
1⤵
- Suspicious use of WriteProcessMemory
PID:912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.igg-games.com/
2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffca2c146f8,0x7ffca2c14708,0x7ffca2c14718
3⤵
PID:408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17318822795418705130,12368583877253356296,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
3⤵
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,17318822795418705130,12368583877253356296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,17318822795418705130,12368583877253356296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
3⤵
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17318822795418705130,12368583877253356296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
3⤵
PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17318822795418705130,12368583877253356296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
3⤵
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17318822795418705130,12368583877253356296,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
3⤵
PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17318822795418705130,12368583877253356296,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
3⤵
PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17318822795418705130,12368583877253356296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5948 /prefetch:8
3⤵
PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
3⤵
- Drops file in Program Files directory
PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff77d925460,0x7ff77d925470,0x7ff77d925480
4⤵
PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17318822795418705130,12368583877253356296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5948 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17318822795418705130,12368583877253356296,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
3⤵
PID:2580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17318822795418705130,12368583877253356296,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
3⤵
PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17318822795418705130,12368583877253356296,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1804 /prefetch:1
3⤵
PID:3880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1956

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
cd4f5fe0fc0ab6b6df866b9bfb9dd762

SHA1
a6aaed363cd5a7b6910e9b3296c0093b0ac94759

SHA256
3b803b53dbd3d592848fc66e5715f39f6bc02cbc95fb2452cd5822d98c6b8f81

SHA512
7072630ec28cf6a8d5b072555234b5150c1e952138e5cdc29435a6242fda4b4217b81fb57acae927d2b908fa06f36414cb3fab35110d63107141263e3bba9676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1d40312629d09d2420e992fdb8a78c1c

SHA1
903950d5ba9d64ec21c9f51264272ca8dfae9540

SHA256
1e7c6aa575c3ec46cd1fdf6df51063113d277012ed28f5f6b37aea95cd3a64ac

SHA512
a7073247ae95e451ed32ceeae91c6638192c15eaad718875c1272eff51c0564016d9f84690543f27df509a7d579de329d101fbf82fed7cbeb27af57393de24ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\135e5a3b-db80-459c-8883-4ee05c14e21a.tmp
Filesize
5KB

MD5
07cf3e610a1b9fe28bd5b8c8a676806e

SHA1
c037b54f2601a030b063d677c557a61477ec449e

SHA256
1f68e360cfc862ee70228949050e44dfc489da76e9019d5107c4c33bdb174ae8

SHA512
36fcd6f2682e0d3c836b2d2b83cfa615e805e1f417909f15ccd343087de6cfd0a93ba1eb7ffb2f23fd5424f0c77b2b6c5bed93abdc93565251877106e11f53c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
Filesize
2KB

MD5
2f4aa84e04c26f0a4f5fb77ea0c838f5

SHA1
1d8e751ff0b37672596196ee9481d62057e9676a

SHA256
abfe7cd26dd0541a5adeb2d3facf20ef721836c19619c4f7a3cf60a87ea42e50

SHA512
2072770713600caca1a2e8415b512dab78d243172c38d192eb78afebfb29b713d39dc10342211d20adc3e680f3ed8a7f38a37e064a9679921d7d0e2b5d86ef91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
4KB

MD5
28667b6914ba81d55927299db76a1c3f

SHA1
7487a6c59aeb07c79a530b8808d89cd6d48865b9

SHA256
0420954282e444f295da0c8c79393abc2016e0d2ec9a434e3e6620a8b40397e1

SHA512
90e4535ac523c389442b1a253634b35a4d06485301dd143dab0a3a8593d4f8062478484092ac77360441164bd3d3b914ef03f53374463fc8d5d1a0456625206f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
d27697fcf25a4debdde59b8e7d31d9df

SHA1
a2126bc3eebc52e0a72edd69e2fedfdd574310db

SHA256
1a42590ef14eef5be608e8c08451560a12d699439ccdcf7bfe844a017a3e3f72

SHA512
440b995ad73e861ffffc0b11b0d7bb036a00d484e7f4458f76ca525c519e42754fbd1735ddf429d21b8250c5658294be8cea7dbf6191d93e1634ca5ef757e03e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
1463bf2a54e759c40d9ad64228bf7bec

SHA1
2286d0ac3cfa9f9ca6c0df60699af7c49008a41f

SHA256
9b4fd2eea856352d8fff054b51ea5d6141a540ca253a2e4dc28839bc92cbf4df

SHA512
33e0c223b45acac2622790dda4b59a98344a89094c41ffdb2531d7f1c0db86a0ea4f1885fea7c696816aa4ceab46de6837cc081cd8e63e3419d9fcb8c5a0eb66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
9KB

MD5
ebd80542e2c9e038ed4badff831a2776

SHA1
f9c2505452dbecb631d13eee0bb9fd95142cb546

SHA256
77a5d398f5add96e280b95aaf3c449ac7215fab5487f59e2eeae21144ae95a55

SHA512
7448ed621431d90efd6d2235fb6d572b195c5c5dcab5e0f579f19388c6ebfc12c84c5a3713ba6b16cbf9738a507e757d45dc423bee0f4af09dcd79a610ea2ccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
dc90461e81926a1074e92af4de021ba1

SHA1
09aaabc80e68b02a0c16b5c8625771f2a3550733

SHA256
b6f343b8e702174f474b81f6127154a7ea8aa55da021fff49a2572bd09c0927a

SHA512
7c92368bb338eb7e8aafab8e8597e5a1be8456efc3dceebd1569166c03aabc6d13ef13041a584b0cd0200b9e52bb29fe24ccd4b06d9074afad1269101d6515e9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
3KB

MD5
a0417802bdf92b005823a33fe8ca93c6

SHA1
7f2391ed4e9f8d10c99de0a369306e9ff53839d4

SHA256
20712e8ef4865638e0d27e52c33a62e3c461dabebe0f6f24100967860acdf716

SHA512
b6d4371e33c847ffc1748f945cab93e8d73bea5a94caa44a94035a576aa2f8a98612718f09b6596e97c860ce8e5aa09e18083c8fce3e53f4265025b1ef64bc74

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
3KB

MD5
423e78fc389513c488e514358709cc65

SHA1
87462853f2bab2cb7aba34d4c865a0a002a00da4

SHA256
367af194961e78566f3f7bfab30bd8204dfc3928ae0ffe0886687385b1b909b9

SHA512
5d290fdccb70d1add6055c859911c520b5bc2aaa21597e3fec2df64dce5713a6b395ced20ece335d77ce58c93da58994fb441e060709b447d6edbaf50cf3ba2f

Download Submit