43f8e9a3e3fae12d66fb055c891e8c4a53979ce5323bea8c16d60ed24c7fa58c

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2023, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

xenia_canary.exe
Size

9.4MB
MD5

e54126867a0bb124f7a56509b04f6c04
SHA1

779b30b9f9d0bfed770b4b8693546b180d5239f5
SHA256

43f8e9a3e3fae12d66fb055c891e8c4a53979ce5323bea8c16d60ed24c7fa58c
SHA512

16d7e8a4607a01f8155bde6ddc199122c6373fbad52bd4c5ea8c7243848238f95c797cf0302c55ada0c30e5c58957dc014d76812d6348348371c411b3fc2dbed
SSDEEP

49152:NOok4BZReYCEqHSW56uXO/tTMNvhaJnlzBldeei7UI9vQ30JsHJCcAU5pSKRaMlw:kGtSHctTMKlFyc0JsAchpSeRd2zFt4M

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\d292032a-a870-4b6f-8d2d-9eaa2fa08f8a.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230402004613.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	xenia_canary.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	xenia_canary.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	xenia_canary.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	xenia_canary.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
4020	identity_helper.exe
4020	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3632	xenia_canary.exe
3632	xenia_canary.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 752	3632	xenia_canary.exe	93
PID 3632 wrote to memory of 752	3632	xenia_canary.exe	93
PID 752 wrote to memory of 3068	752	msedge.exe	94
PID 752 wrote to memory of 3068	752	msedge.exe	94
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 3188	752	msedge.exe	96
PID 752 wrote to memory of 1480	752	msedge.exe	95
PID 752 wrote to memory of 1480	752	msedge.exe	95
PID 752 wrote to memory of 4476	752	msedge.exe	97
PID 752 wrote to memory of 4476	752	msedge.exe	97
PID 752 wrote to memory of 4476	752	msedge.exe	97
PID 752 wrote to memory of 4476	752	msedge.exe	97
PID 752 wrote to memory of 4476	752	msedge.exe	97
PID 752 wrote to memory of 4476	752	msedge.exe	97
PID 752 wrote to memory of 4476	752	msedge.exe	97
PID 752 wrote to memory of 4476	752	msedge.exe	97
PID 752 wrote to memory of 4476	752	msedge.exe	97
PID 752 wrote to memory of 4476	752	msedge.exe	97
PID 752 wrote to memory of 4476	752	msedge.exe	97
PID 752 wrote to memory of 4476	752	msedge.exe	97
PID 752 wrote to memory of 4476	752	msedge.exe	97
PID 752 wrote to memory of 4476	752	msedge.exe	97
PID 752 wrote to memory of 4476	752	msedge.exe	97
PID 752 wrote to memory of 4476	752	msedge.exe	97
PID 752 wrote to memory of 4476	752	msedge.exe	97
PID 752 wrote to memory of 4476	752	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\xenia_canary.exe
"C:\Users\Admin\AppData\Local\Temp\xenia_canary.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/xenia-project/game-compatibility/issues
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff955b146f8,0x7ff955b14708,0x7ff955b14718
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,6869803179570616148,6947405941094948581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6869803179570616148,6947405941094948581,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
    3⤵
    PID:3188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,6869803179570616148,6947405941094948581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6869803179570616148,6947405941094948581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6869803179570616148,6947405941094948581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6869803179570616148,6947405941094948581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:1592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7c0275460,0x7ff7c0275470,0x7ff7c0275480
      4⤵
      PID:452
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6869803179570616148,6947405941094948581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6869803179570616148,6947405941094948581,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6869803179570616148,6947405941094948581,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
    3⤵
    PID:1184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6869803179570616148,6947405941094948581,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6869803179570616148,6947405941094948581,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
    3⤵
    PID:5184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
462f3c1360a4b5e319363930bc4806f6

SHA1
9ba5e43d833c284b89519423f6b6dab5a859a8d0

SHA256
fec64069c72a8d223ed89a816501b3950f5e4f5dd88f289a923c5f961d259f85

SHA512
5584ef75dfb8a1907c071a194fa78f56d10d1555948dffb8afcacaaa2645fd9d842a923437d0e94fad1d1919dcef5b25bf065863405c8d2a28216df27c87a417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d2642245b1e4572ba7d7cd13a0675bb8

SHA1
96456510884685146d3fa2e19202fd2035d64833

SHA256
3763676934b31fe2e3078256adb25b01fdf899db6616b6b41dff3062b68e20a1

SHA512
99e35f5eefc1e654ecfcf0493ccc02475ca679d3527293f35c3adea66879e21575ab037bec77775915ec42ac53e30416c3928bc3c57910ce02f3addd880392e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
893a39c9aacd51ee6245fc5da524c94c

SHA1
34e0297049fd75b2b07895464c3b2f9995b84f99

SHA256
8e2cf97dbedbb3893b091d9e27a995003ba1636e7a15fe483f0ad311e10638d3

SHA512
fdfbf5d523b71d2d5ef21ecb2fc0ad3d625627c2e4890d2b3e937a1bb3d76a71af20b6d37120d09e87a704c0c2aa5165348dc67693fc190b5303b72a10431e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5793b4.TMP

Filesize
48B

MD5
fec34aa0a4f84a01ba00373402347066

SHA1
0af9de272182fe7c3021a6590168c7a7d3a7cf63

SHA256
5e43d636de22e7f03af613d30ca97569199910519afae350de441345ccca05b4

SHA512
c2b0843a23cb92408248777159379040e6504cecf1b11edc3a1652f76d7cfeecc34732de7a42f7a172bc91c80c9c76674559389310e0e4b67cff4a9c4eee05a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
b0da4c1debbe41c71614e975946f1c7b

SHA1
ca19466b3d02f08fe939fa3b2604ddbde0137173

SHA256
92cfb818ffd7c9769c71c9270efee6c31e04e6f81e21a0d95909b07399f46c8f

SHA512
fd6fe2fb4c0c599d2a92adba612ed1ed210e8958267420fb91ed65656c3047c23726648c448645aa548241a6fc3d35857fdca25cad8906cb8cdc9d0cac7d930d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
57272bdebb795d2e7577b2dd71844c89

SHA1
20dac2406079139e1c9060e3c9fb3059247d1b4a

SHA256
7cb5c3c90ec7f06db6be292165891de209304e13ca6e557e5cd5f5440fe792f3

SHA512
a6281bd3119b19b0c136af986c08bf14c95da2c1e96b347860bd9ef4f0ad543732dd77cc3e746bda36c7dfabd4ac769cf7785412ac62bfc4dc36666dc764f0a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dfdb72ce39f50603c5b9172145361051

SHA1
e87488a58a29f6f1795f529f8c58b00a0bf196fe

SHA256
58b76f1883cce4b5a61719f1b668b4613e03642a2ba53155079fe331ce1727fa

SHA512
6c86d653d47fb38edbd2bca9dec71c5e8c08be884634a250b28d2c3c5263c95c95d6e572d7e1259dd12acf1915d639bf2ac3fb39f3d824c79f1628040cb16675

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
d4c3b15f21799113e7ac05a6f4951fc9

SHA1
982cd9d372e0215365142e9be288aa8063cb0d92

SHA256
dc3a33b0e4a0468c698e6f73e8274de42ec880492fac54d2fdf7321331370629

SHA512
12138dd38315e2508be93ef9276213103a8b8401f9b10d422acf44ca101e0b85916623959d1af70ad6ed270f36f14628802a9ad454a451714f96f1a46ee9b5d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9f57bb48e25b89e8890e8665293ef871

SHA1
47ecc76976a7ccbac993b77f3f8385e0680b01de

SHA256
39ce763515cfc9a55682d59786bb14fd748f2a9e6cac68bb87c977b9d63eb8b6

SHA512
d7317e0a73d13f4dfb9eff9612be505ec870923b0afc8265de7f72b5d82be23fd71cfcba7913cb6b476078831cbc4eae2a223349a08f24e9198dd225e897424e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5126dc92da90b66a8134c1ed26b8e3f4

SHA1
ad52224d8c66ee0e155e340bcfad5ebdffb6aa96

SHA256
22fe70fab35c7d7c2b5dcc11fc87745342d13a8b96cb855547b507aa17bac95e

SHA512
a552d4136c0938843121312de4dc0ee16b51a924b1f5136de622ff3c02c424128ca6eb290ba48ae46a5c307928aa7d25a12acf0024e9665695ff09d9d477428f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
130644a5f79b27202a13879460f2c31a

SHA1
29e213847a017531e849139c7449bce6b39cb2fa

SHA256
1306a93179e1eaf354d9daa6043ae8ffb37b76a1d1396e7b8df671485582bcd1

SHA512
fbc8606bf988cf0a6dea28c16d4394c9b1e47f6b68256132b5c85caf1ec7b516c0e3d33034db275adf267d5a84af2854f50bd38a9ed5e86eb392144c63252e01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
2e795c1cd785de4a6a36344fc50ad48d

SHA1
3dbda64087ae43b9ecb7f71394c639aa9ef29533

SHA256
8ee9556e442a0a57dfe9d57a0614af24b4de7b03c5e5e5a85050a8ee8b25f020

SHA512
e7ab6fccfbedf9e004757f54a0f3abdb66926100277aa2582eb6920f14fb4ba729eada2766e7022368c8703b65f427e10e3e4eb0b05e68146f795323d69270fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1a3414a52adaaa9c7a5dd9dc64447b11

SHA1
0edc8c16d660358ec2754ceb01224a8fb12c9fdf

SHA256
14be2a70f50dd63ae5d37bee31cb4f8b7b7fabe0651b094e90f79193d17e2e64

SHA512
d26b8eac5192ab7053cb41afc5da371d968d9a0b428391c957a7c9a73ef7d2e71e5686e15a24d4c4b454057ed7302db814b095017726146d48348db91489e6f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
8495a0ae04a59d575ff47a6b3fb0e2aa

SHA1
d6ecee67982d7b384702230c623bce7716bbe48b

SHA256
5cd81d819509cf8b8e73ee9d46f299a14e479f966a47e6d8707d147cbca5fd2b

SHA512
b4cbce6ac911cb5607b6ca0a87208e08d27afd3914cf748ab473e189933475124f17c1dee0bd9101b896b39ec3b665b598bd01bbbfdea03224cffb203a9533b2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
260637c64ffa0e327c673c0bf92a752f

SHA1
75a252ab77ec55ea2b8c48c312f56569495dfb25

SHA256
8987b24eb5aae11f2f5f15903dc1067b75d060ea3e34d95e3dfa82ee8205eaf8

SHA512
083a53cde5d51c27e15ad51ec89f796feb93175196f159ec791e52632f50073fd0163ccc98796d1de7fce16093bc800532e27d056f860cbb331a7cf1f87d824f

Download Submit
memory/3632-134-0x0000000020000000-0x0000000020001000-memory.dmp

Filesize
4KB

Download
memory/3632-137-0x000001E3775A0000-0x000001E3775A1000-memory.dmp

Filesize
4KB

Download
memory/3632-135-0x000001E3775A0000-0x000001E3775A1000-memory.dmp

Filesize
4KB

Download
memory/3632-136-0x000001E3775A0000-0x000001E3775A1000-memory.dmp

Filesize
4KB

Download