c204b195f1a47ddeb285ed92d9cafe569a96ac476828b375d3e33a228fbce9da

Analysis

max time kernel
283s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
15-04-2023 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AutoDesk 3Ds Max.rar
Size

891.1MB
MD5

8f86a57f85eb4ce56307e3dccb18e15a
SHA1

f7ed5fc50246dfbdbb34e9594c964183c18f9c10
SHA256

c204b195f1a47ddeb285ed92d9cafe569a96ac476828b375d3e33a228fbce9da
SHA512

a153f292ea64b561f2baa5218d8ff34d2948f52a68dea024fb54efc2fffc82aa1c154f2f253e524fba194f0cbd2c71f9b9cfc33212c3d8f5387eff27983997fa
SSDEEP

786432:JH7Ctdd4O5V8CZkL6a9yjvk2bg5jwalnLKKrgXEvY8oZEeUBO1PevDwPl10tZJ/P:+GJONIYBdVsyDY

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

Processes:

cmd.exeOpenWith.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msedge.exemsedge.exe

pid process

4948 msedge.exe
4948 msedge.exe
3716 msedge.exe
3716 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

msedge.exe

pid process

3716 msedge.exe
3716 msedge.exe
3716 msedge.exe
3716 msedge.exe
Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

msedge.exe

pid process

3716 msedge.exe
3716 msedge.exe
3716 msedge.exe
3716 msedge.exe
3716 msedge.exe
3716 msedge.exe
3716 msedge.exe

pid	process
4948	msedge.exe
4948	msedge.exe
3716	msedge.exe
3716	msedge.exe

pid	process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

pid	process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of SetWindowsHookEx 27 IoCs

Processes:

OpenWith.exe

pid	process
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe
1788	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3716 wrote to memory of 2980	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 2980	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4948	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4948	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 2928	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 2928	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 2928	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 2928	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 2928	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 2928	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 2928	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 2928	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 2928	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 2928	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 2928	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 2928	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 2928	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 2928	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 2928	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 2928	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 2928	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 2928	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 2928	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 2928	3716	msedge.exe	msedge.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\AutoDesk 3Ds Max.rar"
1⤵
- Modifies registry class
PID:448

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1788

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe1e5e46f8,0x7ffe1e5e4708,0x7ffe1e5e4718
2⤵
PID:2980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,15913403174016898757,18095146341099829431,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
2⤵
PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,15913403174016898757,18095146341099829431,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,15913403174016898757,18095146341099829431,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
2⤵
PID:2928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,15913403174016898757,18095146341099829431,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
2⤵
PID:3244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,15913403174016898757,18095146341099829431,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
2⤵
PID:1736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,15913403174016898757,18095146341099829431,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
2⤵
PID:2616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,15913403174016898757,18095146341099829431,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
2⤵
PID:3356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1e5e46f8,0x7ffe1e5e4708,0x7ffe1e5e4718
2⤵
PID:4916

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
cd4f5fe0fc0ab6b6df866b9bfb9dd762

SHA1
a6aaed363cd5a7b6910e9b3296c0093b0ac94759

SHA256
3b803b53dbd3d592848fc66e5715f39f6bc02cbc95fb2452cd5822d98c6b8f81

SHA512
7072630ec28cf6a8d5b072555234b5150c1e952138e5cdc29435a6242fda4b4217b81fb57acae927d2b908fa06f36414cb3fab35110d63107141263e3bba9676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1d40312629d09d2420e992fdb8a78c1c

SHA1
903950d5ba9d64ec21c9f51264272ca8dfae9540

SHA256
1e7c6aa575c3ec46cd1fdf6df51063113d277012ed28f5f6b37aea95cd3a64ac

SHA512
a7073247ae95e451ed32ceeae91c6638192c15eaad718875c1272eff51c0564016d9f84690543f27df509a7d579de329d101fbf82fed7cbeb27af57393de24ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1d40312629d09d2420e992fdb8a78c1c

SHA1
903950d5ba9d64ec21c9f51264272ca8dfae9540

SHA256
1e7c6aa575c3ec46cd1fdf6df51063113d277012ed28f5f6b37aea95cd3a64ac

SHA512
a7073247ae95e451ed32ceeae91c6638192c15eaad718875c1272eff51c0564016d9f84690543f27df509a7d579de329d101fbf82fed7cbeb27af57393de24ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1d40312629d09d2420e992fdb8a78c1c

SHA1
903950d5ba9d64ec21c9f51264272ca8dfae9540

SHA256
1e7c6aa575c3ec46cd1fdf6df51063113d277012ed28f5f6b37aea95cd3a64ac

SHA512
a7073247ae95e451ed32ceeae91c6638192c15eaad718875c1272eff51c0564016d9f84690543f27df509a7d579de329d101fbf82fed7cbeb27af57393de24ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
88242649e914113f68fae548e42fc94e

SHA1
4457c148b4e0a7469446bcfb4af08bd73501dac7

SHA256
c34d1691cdb95d04b77f9712a18edefb91c4f0af84521b6715b5c4dd53ccc0e4

SHA512
2ac6dc3e0cf3ed3713f669a172d7d01d6f65999a96f738d2ff304b0705aa58291980f887983625f3dac8181688b88825d202557ce1d4e3e608255d04bfef090d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1
Filesize
264KB

MD5
f4e028cd95083851798792408bf77c7b

SHA1
30388a712b6c36094b4477ddb810502c69d72130

SHA256
63c1a7e5a7815c3bcdfe5b26e78f31ac691ffb780ff51eea4faaef52d4b2e738

SHA512
4110faa82b3c3fa61c145a5b3a59b04b4e12901d5211782649ece1f5a30fe7b5497f39118882fc593814edd0baacb8922118db2e365ccf7a5d9229f0b2d5f338

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2
Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3
Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
Filesize
2KB

MD5
9e2d0be0e4a8d2924aab6c0d657a8559

SHA1
95d7d3a5f16d40e310ba0be61e49eb35b0139875

SHA256
57a08780b4eb7e1ceb3c8e3a5da9c78d49c5876dc8dcccc0528785e2d184ba28

SHA512
3f1bdc300d3c83bfefff6622d97d0dc25cd8f7c9607d27a405c809a8a87e749033e4c4ecae1a23ed8066e1dc37b5d4aa78efd813c454f263140d26660da54f2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
4KB

MD5
acb3e5c7fd6f15b22668da581eac511b

SHA1
6de574341fc79a77672fc143ac3728d8378f122b

SHA256
8468a60db96088c8c86b1832ab145cf8951a150ee4fcc6257a177688dba1d164

SHA512
9ea7d798480f45cc6d0294481286de2cda5f8698249cd250a3abf92423832ebfd1074e29ccb71251b32d9efd9cb89c7dc3a7e3b4105dc3fddd77ef6c58cc1ad8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
32fe9d8686310dd9b4c0411b242c548a

SHA1
dd35046cbaa3350f99b789cd5a89f420c29cfdd9

SHA256
aed9d752392c824c35d56d1693e15c371be5066ac30a9fe8f70ed25d12a7aef5

SHA512
88d771a9739fcfe3c9ed2f3c87254248573f7678523d55a6cba6c32306f4de29b71d27459ef7dda9448112f6c15f5d51326a622bb575f072bf2c758cd2dc2e58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
1463bf2a54e759c40d9ad64228bf7bec

SHA1
2286d0ac3cfa9f9ca6c0df60699af7c49008a41f

SHA256
9b4fd2eea856352d8fff054b51ea5d6141a540ca253a2e4dc28839bc92cbf4df

SHA512
33e0c223b45acac2622790dda4b59a98344a89094c41ffdb2531d7f1c0db86a0ea4f1885fea7c696816aa4ceab46de6837cc081cd8e63e3419d9fcb8c5a0eb66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
9KB

MD5
1c6f98b21aabd2dc7986c212b6c698e7

SHA1
e73df43d50e21f4ebceb0ed1deeb9fd5288691e6

SHA256
15581ed260502784a24cdd69e421fdf412cab8c48272a83851cd7fb26b20f4fa

SHA512
9643307388d8e73b13ddc0a82010b784085acb84cc94e77de5e56546e3b486ea46d603af6bb1f7c4ee2cd8bb495c8a0e127137951b6d47332fd16590d517744c

Download Submit
\??\pipe\LOCAL\crashpad_3716_LDDZQLBKUJIROQNR
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit