e7c7f815a6018adfef0711b49919e998d6ddcaa4a06e97969d9f3b0993f6f17b

Analysis

max time kernel
1766s
max time network
1771s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2023, 17:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

18.rar
Size

2.3MB
MD5

48737bc8f1f1f994e72ccc78b32fe87b
SHA1

790b3d4f86c8a53723e9f5ea991c75f57a7abc6c
SHA256

e7c7f815a6018adfef0711b49919e998d6ddcaa4a06e97969d9f3b0993f6f17b
SHA512

651c310bd7e8751ce52aac4b18674c058629695cc816074236f44be4da02dc46a2dc0c4882cb532d6bd06ea3a0c3665d01e255838389ed1d85f96d8c14f092c7
SSDEEP

49152:oa8oseomyhFhv0IfF0Po/LKTDKGTsUala:oa8o6myhvv0IfkG2TRsUala

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\893dd40a-2364-4a37-b93b-2c3b1f2aa859.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230416195817.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\rar_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\rar_auto_file\shell\edit\command\ = "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\Winword.exe\" /n \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\.rar\ = "rar_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\rar_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\rar_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\.rar	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\rar_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\rar_auto_file\shell\edit\ = "@C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Office16\\oregres.dll,-1"	OpenWith.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2008	Winword.exe
2008	Winword.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4668	msedge.exe
4668	msedge.exe
4168	msedge.exe
4168	msedge.exe
4996	identity_helper.exe
4996	identity_helper.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1280	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of SetWindowsHookEx 53 IoCs

pid	Process
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
1280	OpenWith.exe
2008	Winword.exe
2008	Winword.exe
2008	Winword.exe
2008	Winword.exe
2008	Winword.exe
2008	Winword.exe
2008	Winword.exe
2008	Winword.exe
2008	Winword.exe
2008	Winword.exe
2008	Winword.exe
2008	Winword.exe
2008	Winword.exe
2008	Winword.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2008	1280	OpenWith.exe	90
PID 1280 wrote to memory of 2008	1280	OpenWith.exe	90
PID 4168 wrote to memory of 2604	4168	msedge.exe	101
PID 4168 wrote to memory of 2604	4168	msedge.exe	101
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 2012	4168	msedge.exe	102
PID 4168 wrote to memory of 4668	4168	msedge.exe	103
PID 4168 wrote to memory of 4668	4168	msedge.exe	103
PID 4168 wrote to memory of 1568	4168	msedge.exe	105
PID 4168 wrote to memory of 1568	4168	msedge.exe	105
PID 4168 wrote to memory of 1568	4168	msedge.exe	105
PID 4168 wrote to memory of 1568	4168	msedge.exe	105
PID 4168 wrote to memory of 1568	4168	msedge.exe	105
PID 4168 wrote to memory of 1568	4168	msedge.exe	105
PID 4168 wrote to memory of 1568	4168	msedge.exe	105
PID 4168 wrote to memory of 1568	4168	msedge.exe	105
PID 4168 wrote to memory of 1568	4168	msedge.exe	105
PID 4168 wrote to memory of 1568	4168	msedge.exe	105
PID 4168 wrote to memory of 1568	4168	msedge.exe	105
PID 4168 wrote to memory of 1568	4168	msedge.exe	105
PID 4168 wrote to memory of 1568	4168	msedge.exe	105
PID 4168 wrote to memory of 1568	4168	msedge.exe	105
PID 4168 wrote to memory of 1568	4168	msedge.exe	105
PID 4168 wrote to memory of 1568	4168	msedge.exe	105
PID 4168 wrote to memory of 1568	4168	msedge.exe	105
PID 4168 wrote to memory of 1568	4168	msedge.exe	105

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\18.rar
1⤵
- Modifies registry class
PID:3604

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Local\Temp\18.rar"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\UninstallAdd.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb88eb46f8,0x7ffb88eb4708,0x7ffb88eb4718
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,1323584848976408290,9953337458501717877,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,1323584848976408290,9953337458501717877,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,1323584848976408290,9953337458501717877,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3048 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,1323584848976408290,9953337458501717877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,1323584848976408290,9953337458501717877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,1323584848976408290,9953337458501717877,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff66d4b5460,0x7ff66d4b5470,0x7ff66d4b5480
    3⤵
    PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,1323584848976408290,9953337458501717877,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,1323584848976408290,9953337458501717877,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,1323584848976408290,9953337458501717877,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,1323584848976408290,9953337458501717877,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,1323584848976408290,9953337458501717877,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,1323584848976408290,9953337458501717877,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3356

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0820611471c1bb55fa7be7430c7c6329

SHA1
5ce7a9712722684223aced2522764c1e3a43fbb9

SHA256
f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75

SHA512
77ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
425e83cc5a7b1f8edfbec7d986058b01

SHA1
432a90a25e714c618ff30631d9fdbe3606b0d0df

SHA256
060a2e5f65b8f3b79a8d4a0c54b877cfe032f558beb0888d6f810aaeef8579bd

SHA512
4bf074de60e7849ade26119ef778fe67ea47691efff45f3d5e0b25de2d06fcc6f95a2cfcdbed85759a5c078bb371fe57de725babda2f44290b4dc42d7b6001af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
dbb3f49ff7c710ad2457a8a9bed0201e

SHA1
bf74a5e06220127c596ff3e1e4db62af6ff9c6fa

SHA256
380b556f8cb7085de86096f273bf0dff7c12869199da082f682d8a764b5d897d

SHA512
5a611be5dea96bdfd5551d11772a33fa330df40c670c945b04dd278804b05105ee4d84c633b5eb0a7437eff3adf7fb8352549b52eb5e0028f1b48fa339686610

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
9e5a4e11053e8805bb0afbe8559d8131

SHA1
e1a6335ce452210291f7d5d215ced72a0575232f

SHA256
28e62048fac3444c1475bbc53cc96a1a50c92eb7ca7d2f18156e65df0ecc1a67

SHA512
7a102ee11220ad57af1335738fa0326ff9b70c2b8f06e1f4dc025a5c1b8711ee9c937522d73e9dccda80b2afece74f01e2c43e48f4b40573d73f59e694146d49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
016ff6ca3f1a0e2656a82f294e62b11c

SHA1
0ee7d5f9de8cd90aca16e57322bd9dfe9a5ac8ee

SHA256
8af491329724fe93fbb3e8de3c755bd83cee193b44485dcd628d8d1ec5b968d9

SHA512
19a4a4d2efbf1f482a8fe316cf8378694da96653adc70943f6485d460fa83fa0c3b56eaa6f3f5923f27bb85486ce2e16141ad613ec2e48b34c307c0c114a40c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
51614de8a73aa2ca1d3fc5672b9a9679

SHA1
5c802f0680c94f69213104fba039762f7a0d75a6

SHA256
82166c64b9ef17ab40a1d01d757f2b29421739ca82976166d3f6875491c67771

SHA512
8e859d7e5e92f009ee9d252c49d31c6ad56b9e317fae6a7642e7b1ad811ab1ece7e3987b93b0b2f6dddb6840dfcd2e9c3cde74de1f217837030ac96a4abbbff7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9d73f2c80e00db4fe4a063edff80498e

SHA1
94ce5e014d3b7ab3c61a65f3beeee71bd10dcb35

SHA256
15ead421e883aba17701a6121070f0c18c43b069b170f2ab3c879971b77204ba

SHA512
80d21d6ec1cd2ad682e44b81013dbc98209a67f5247be556458664c771d412dcb66560c239e4b345f35ebfe60dd44fdb7c9751389db505d9caafe2284eb9a6b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d53ac35ab3976e67caeed75c4d44ffc1

SHA1
c139ab66d75dc06f98ada34b5baf4d5693266176

SHA256
647867c7236bcb78b7d585b476d82a101a077fac43c78dc59e612253fbf69437

SHA512
391355c71734ded913239a6db10a3202087e756bccc8e29411108f21b3f2460d9a9c606619aadd785285be70eddcf61ef9519441cd387cd3823c1399a6967cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
36d5ffe0d83ce1c1145f5ceb866346e2

SHA1
49598d926048a9b1c118dad8d235bab86fbb77c2

SHA256
dd77d2ce830a24b3b48a3acdec0aa3692c6bb12fd9c95b01e614c04575b3d5f7

SHA512
05207c13c83d281d8c5efbd7e28c87266f4ae88e2ed2979738067a37a64a71aea4eac22be7ae1f0ed4b64b1cc2ee0f6f7b1fef2f3e1d56d7981235411889b152

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2bc38e17f224cbfb3a35f39bdfa46630

SHA1
d5644bf85a0f10943417709b9b924da6d15c8fe0

SHA256
4ba4867c617833b75231a8c4e95e620326f40cb9b2e7e5e71c7fe026e92f091b

SHA512
9b7909ac7780753c611d4aeea2cf7e4072ca66accc60411ac6393e63a7ddc27fda8afd78ddb8df787530b694b27783e70670dcab9f1017ae262200d8bc7759de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
1b12e343590cfda1a4b6031f67235eb5

SHA1
5860ac7cfd8c8dc3a19622e1538dee500a8352d1

SHA256
8a9df8df8f98d64b08b642635259cff527573782dd79f0cb82d5c4e61391325f

SHA512
6509c3f39aab55bc128f7e7068f6de3b14531118a526f97bc382d79528efb9a47839a8a8221c43abba2f2a77147caf45d87cd2cb4a67defe79ad6ecab1a57bfa

Download Submit
memory/2008-170-0x00007FFB67810000-0x00007FFB67820000-memory.dmp

Filesize
64KB

Download
memory/2008-139-0x00007FFB64EB0000-0x00007FFB64EC0000-memory.dmp

Filesize
64KB

Download
memory/2008-138-0x00007FFB64EB0000-0x00007FFB64EC0000-memory.dmp

Filesize
64KB

Download
memory/2008-168-0x00007FFB67810000-0x00007FFB67820000-memory.dmp

Filesize
64KB

Download
memory/2008-133-0x00007FFB67810000-0x00007FFB67820000-memory.dmp

Filesize
64KB

Download
memory/2008-169-0x00007FFB67810000-0x00007FFB67820000-memory.dmp

Filesize
64KB

Download
memory/2008-137-0x00007FFB67810000-0x00007FFB67820000-memory.dmp

Filesize
64KB

Download
memory/2008-136-0x00007FFB67810000-0x00007FFB67820000-memory.dmp

Filesize
64KB

Download
memory/2008-171-0x00007FFB67810000-0x00007FFB67820000-memory.dmp

Filesize
64KB

Download
memory/2008-135-0x00007FFB67810000-0x00007FFB67820000-memory.dmp

Filesize
64KB

Download
memory/2008-134-0x00007FFB67810000-0x00007FFB67820000-memory.dmp

Filesize
64KB

Download
memory/4996-346-0x000001B482200000-0x000001B482261000-memory.dmp

Filesize
388KB

Download