a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2023 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[email protected]
Size

14KB
MD5

19dbec50735b5f2a72d4199c4e184960
SHA1

6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256

a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512

aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP

192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	[email protected]
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	[email protected]

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	[email protected]

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\e1173a99-7ca0-47cc-810d-44854c97c8e9.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230417233430.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4312#immutable1 = "Internet Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-2000#immutable1 = "View and manage devices, printers, and print jobs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Power Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15300#immutable1 = "RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-1#immutable1 = "Speech Recognition"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-100#immutable1 = "Mouse"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-101#immutable1 = "Customize your mouse settings, such as the button configuration, double-click speed, mouse pointers, and motion speed."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer."	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-1#immutable1 = "Default Programs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-5#immutable1 = "View and update your device hardware settings and driver software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-1#immutable1 = "Network and Sharing Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-2#immutable1 = "Keep a history of your files"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-3#immutable1 = "Region"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-103#immutable1 = "Customize your keyboard settings, such as the cursor blink rate and the character repeat rate."	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\IconSize = "48"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupView = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-1#immutable1 = "Phone and Modem"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-159#immutable1 = "Programs and Features"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4313#immutable1 = "Configure your Internet display and connection settings."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-15#immutable1 = "Troubleshoot and fix common computer problems."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874385"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-1#immutable1 = "Credential Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "Manage your RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-1#immutable1 = "User Accounts"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3001#immutable1 = "Sync files between your computer and network folders"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker Drive Encryption"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	control.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-7#immutable1 = "Change advanced color management settings for displays, scanners, and printers."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Rev = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-602#immutable1 = "Change how Windows indexes to search faster"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f706806ee260aa0d7449371beb064c986830000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:PID = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Change user account settings and passwords for people who share this computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Customize settings for the display of languages, numbers, times, and dates."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer."	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Conserve energy or maximize performance by choosing how your computer manages power."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-2#immutable1 = "Manage your Windows credentials."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-2#immutable1 = "Configure your telephone dialing rules and modem settings."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-2#immutable1 = "Configure how speech recognition works on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874369"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe

Runs regedit.exe 1 IoCs

pid	Process
2284	regedit.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1196	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1612	[email protected]
1612	[email protected]
1612	[email protected]
1612	[email protected]
4316	[email protected]
4316	[email protected]
4664	[email protected]
4664	[email protected]
1612	[email protected]
1612	[email protected]
4664	[email protected]
4664	[email protected]
4316	[email protected]
4316	[email protected]
1612	[email protected]
1612	[email protected]
3016	[email protected]
3016	[email protected]
4664	[email protected]
4664	[email protected]
4372	[email protected]
4372	[email protected]
3016	[email protected]
4316	[email protected]
4316	[email protected]
3016	[email protected]
4372	[email protected]
4372	[email protected]
4664	[email protected]
4664	[email protected]
1612	[email protected]
1612	[email protected]
4316	[email protected]
4316	[email protected]
4664	[email protected]
3016	[email protected]
4664	[email protected]
3016	[email protected]
4372	[email protected]
4372	[email protected]
4316	[email protected]
4316	[email protected]
1612	[email protected]
1612	[email protected]
4664	[email protected]
4664	[email protected]
3016	[email protected]
3016	[email protected]
4372	[email protected]
4372	[email protected]
1612	[email protected]
4316	[email protected]
1612	[email protected]
4316	[email protected]
3016	[email protected]
3016	[email protected]
4664	[email protected]
4664	[email protected]
4372	[email protected]
4372	[email protected]
3016	[email protected]
3016	[email protected]
4316	[email protected]
4316	[email protected]

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2284	regedit.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1196	explorer.exe
Token: SeCreatePagefilePrivilege	1196	explorer.exe
Token: 33	1748	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1748	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
1196	explorer.exe
3952	msedge.exe
1328	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3304	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 1612	4656	[email protected]	87
PID 4656 wrote to memory of 1612	4656	[email protected]	87
PID 4656 wrote to memory of 1612	4656	[email protected]	87
PID 4656 wrote to memory of 4664	4656	[email protected]	88
PID 4656 wrote to memory of 4664	4656	[email protected]	88
PID 4656 wrote to memory of 4664	4656	[email protected]	88
PID 4656 wrote to memory of 4316	4656	[email protected]	89
PID 4656 wrote to memory of 4316	4656	[email protected]	89
PID 4656 wrote to memory of 4316	4656	[email protected]	89
PID 4656 wrote to memory of 3016	4656	[email protected]	90
PID 4656 wrote to memory of 3016	4656	[email protected]	90
PID 4656 wrote to memory of 3016	4656	[email protected]	90
PID 4656 wrote to memory of 4372	4656	[email protected]	91
PID 4656 wrote to memory of 4372	4656	[email protected]	91
PID 4656 wrote to memory of 4372	4656	[email protected]	91
PID 4656 wrote to memory of 3304	4656	[email protected]	92
PID 4656 wrote to memory of 3304	4656	[email protected]	92
PID 4656 wrote to memory of 3304	4656	[email protected]	92
PID 3304 wrote to memory of 3620	3304	[email protected]	94
PID 3304 wrote to memory of 3620	3304	[email protected]	94
PID 3304 wrote to memory of 3620	3304	[email protected]	94
PID 3304 wrote to memory of 3952	3304	[email protected]	96
PID 3304 wrote to memory of 3952	3304	[email protected]	96
PID 3952 wrote to memory of 4084	3952	msedge.exe	97
PID 3952 wrote to memory of 4084	3952	msedge.exe	97
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98
PID 3952 wrote to memory of 3372	3952	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1612
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4664
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4316
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4372
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]" /main
  2⤵
  - Checks computer location settings
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=stanky+danky+maymays
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff9edf46f8,0x7fff9edf4708,0x7fff9edf4718
      4⤵
      PID:4084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1520,12400340655024474403,15019651664184779836,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
      4⤵
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,12400340655024474403,15019651664184779836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
      4⤵
      PID:3864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1520,12400340655024474403,15019651664184779836,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
      4⤵
      PID:3804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1520,12400340655024474403,15019651664184779836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1520,12400340655024474403,15019651664184779836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1520,12400340655024474403,15019651664184779836,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1520,12400340655024474403,15019651664184779836,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
      4⤵
      PID:2336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1520,12400340655024474403,15019651664184779836,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1520,12400340655024474403,15019651664184779836,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
      4⤵
      PID:2116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1520,12400340655024474403,15019651664184779836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
      4⤵
      PID:924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:3572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff691185460,0x7ff691185470,0x7ff691185480
        5⤵
        
        PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1520,12400340655024474403,15019651664184779836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1520,12400340655024474403,15019651664184779836,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
      4⤵
      PID:3148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1520,12400340655024474403,15019651664184779836,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
      4⤵
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1520,12400340655024474403,15019651664184779836,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
      4⤵
      PID:432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1520,12400340655024474403,15019651664184779836,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
      4⤵
      PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic
    3⤵
    PID:4720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff9edf46f8,0x7fff9edf4708,0x7fff9edf4718
      4⤵
      PID:392
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe"
    3⤵
    - Modifies registry class
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff9edf46f8,0x7fff9edf4708,0x7fff9edf4718
      4⤵
      PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,4323973976948459404,3426634822005804214,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
      4⤵
      PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,4323973976948459404,3426634822005804214,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,4323973976948459404,3426634822005804214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
      4⤵
      PID:332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4323973976948459404,3426634822005804214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
      4⤵
      PID:3024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4323973976948459404,3426634822005804214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
      4⤵
      PID:3208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4323973976948459404,3426634822005804214,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4323973976948459404,3426634822005804214,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
      4⤵
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,4323973976948459404,3426634822005804214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
      4⤵
      PID:376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,4323973976948459404,3426634822005804214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
      4⤵
      PID:1960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4323973976948459404,3426634822005804214,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
      4⤵
      PID:216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4323973976948459404,3426634822005804214,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
      4⤵
      PID:2232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4323973976948459404,3426634822005804214,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
      4⤵
      PID:2680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4323973976948459404,3426634822005804214,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
      4⤵
      PID:1680
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe"
    3⤵
    - Runs regedit.exe
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2684

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1196

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x344
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
462f3c1360a4b5e319363930bc4806f6

SHA1
9ba5e43d833c284b89519423f6b6dab5a859a8d0

SHA256
fec64069c72a8d223ed89a816501b3950f5e4f5dd88f289a923c5f961d259f85

SHA512
5584ef75dfb8a1907c071a194fa78f56d10d1555948dffb8afcacaaa2645fd9d842a923437d0e94fad1d1919dcef5b25bf065863405c8d2a28216df27c87a417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d2642245b1e4572ba7d7cd13a0675bb8

SHA1
96456510884685146d3fa2e19202fd2035d64833

SHA256
3763676934b31fe2e3078256adb25b01fdf899db6616b6b41dff3062b68e20a1

SHA512
99e35f5eefc1e654ecfcf0493ccc02475ca679d3527293f35c3adea66879e21575ab037bec77775915ec42ac53e30416c3928bc3c57910ce02f3addd880392e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
451f1946fc2a626d5c3a0b944a916310

SHA1
800bf991a873e700a04a19789890bfb8803e4880

SHA256
5c5cc65b3a9d94fbea501efe61067190d54073bd0bd9ffeac6b8e88f58a1b73c

SHA512
0a1713a7fae55f50d8e3aea57baa24950ac84a296d3945f526d1e43af797fe7efb81dc9b7ff6c4ab50fa9b4180bd815313bc0cab8a392372146b1d43bc49a97c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
451f1946fc2a626d5c3a0b944a916310

SHA1
800bf991a873e700a04a19789890bfb8803e4880

SHA256
5c5cc65b3a9d94fbea501efe61067190d54073bd0bd9ffeac6b8e88f58a1b73c

SHA512
0a1713a7fae55f50d8e3aea57baa24950ac84a296d3945f526d1e43af797fe7efb81dc9b7ff6c4ab50fa9b4180bd815313bc0cab8a392372146b1d43bc49a97c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
451f1946fc2a626d5c3a0b944a916310

SHA1
800bf991a873e700a04a19789890bfb8803e4880

SHA256
5c5cc65b3a9d94fbea501efe61067190d54073bd0bd9ffeac6b8e88f58a1b73c

SHA512
0a1713a7fae55f50d8e3aea57baa24950ac84a296d3945f526d1e43af797fe7efb81dc9b7ff6c4ab50fa9b4180bd815313bc0cab8a392372146b1d43bc49a97c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
451f1946fc2a626d5c3a0b944a916310

SHA1
800bf991a873e700a04a19789890bfb8803e4880

SHA256
5c5cc65b3a9d94fbea501efe61067190d54073bd0bd9ffeac6b8e88f58a1b73c

SHA512
0a1713a7fae55f50d8e3aea57baa24950ac84a296d3945f526d1e43af797fe7efb81dc9b7ff6c4ab50fa9b4180bd815313bc0cab8a392372146b1d43bc49a97c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db3abeebc02ec56124dfddbf454a1764

SHA1
4dd0f096fbaa0badafe5c756e49bf660142b5e2b

SHA256
f656af292fef6c979ae1508805d17db5e306b6cb1ba4e662bb78f091f8ca3e9a

SHA512
6421fbe486421c91271082ea292512a2e4e6e56ed47fe24b9a885f9b4a30fb380a0d5ce0d948420563dc5fb1d62db8553f5bf48e9732e832b493c1429af182af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2e9ef9ffe247b20c0a7b556168ea5626

SHA1
789c7599294ceb181a88440559abab8d07d63432

SHA256
215f46d3cc949c761b5c8ec1ec9465aa9e1574ab4873afbe99fc9755ba7f16e9

SHA512
283fdebca3ee45494287c8f47cc759a2c374d34925c990e4fd94e03d9e9111d2acebe1683b672f8053dde4dfa704bce764630c344d4680960346db7b460d4e50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
8a44875187f40fb02fc97fc773927d79

SHA1
8844bc48c39dfb6e501df50af3bfd1df651fa4d1

SHA256
a25f7dd72ac0556b5767d8e7fd9701f434b30560a2a68b7e6a92bb20fec13fab

SHA512
f025aa71aeac2b537e8c7860ab769e54db6e7d98e45adfef8ffab85c9efa5feb657795f604037234d4daae4a1f0e01bc0eefe94138ed19542fec61d49a9a17e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
50f235414ec20f55941f477b94a75df7

SHA1
d2164cbac43881e64fe9c17f04c5639453bf6551

SHA256
4bf7fd1bd4544e3e26e3af90a4c1a96cbd5ba05f46a5e047d77bd11b2e43e2f6

SHA512
655f3cb6914bb92f4e7fa266c9f443c3f9dcfcb8038362df70387e479007d90d4a935ba02ada1f997525bc81c8a1ce119d47054919e7b9b10a863dae8014f060

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
50f235414ec20f55941f477b94a75df7

SHA1
d2164cbac43881e64fe9c17f04c5639453bf6551

SHA256
4bf7fd1bd4544e3e26e3af90a4c1a96cbd5ba05f46a5e047d77bd11b2e43e2f6

SHA512
655f3cb6914bb92f4e7fa266c9f443c3f9dcfcb8038362df70387e479007d90d4a935ba02ada1f997525bc81c8a1ce119d47054919e7b9b10a863dae8014f060

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe582a38.TMP

Filesize
48B

MD5
114d30d858ed51ba2e49a1fd28457b19

SHA1
78bf70162028b696802412632c21a0244d0a323a

SHA256
ca56bcde1d811d7f3ae8807cfebb9f22b5b20f5044fc9a26ee5303e8db36eb82

SHA512
aa0bc6d6d6d8ee5006bee7972580630bd2d9f7e0c3921f614f559569f33f167bebb7a2924660057ad2ed3a3706c98b3269b2743f23ad6c4699be25fc7a82b765

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
adc825cef439b4dd5f8cda90164271fa

SHA1
7a3d87e53d40c5ed826bb7ea7bbc97e372deeff0

SHA256
0ffb71f600828e909ca3601ee0e7a74dfb5a286740584d9d4a6fc9a5e846fccd

SHA512
c5b3c07a807cf0ed2a69c03f39449bcbbf3d7a416e16bc08243935eb1be2e65e9fc520820c19f4276a2a50578a3b1a6d561f5c0efd1c927a24d0e3d2fc0423bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
323e2d90f6240a2661eda0c340bbef80

SHA1
3cae00bb666ced09ca7cac6429d10015f8a38eda

SHA256
c70aad10d372bbebd558a563753bd85b8fbb377799a49fac355d59fc19312dc3

SHA512
92847b181d563ff968654b6657f10680908b79728e887256aa2d5e9e8786c2cec1dba97463b2f1b167e396c1f9d65fafb2fff2615c9d9bb3f304b9d987f0184f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
279B

MD5
46a69b37c9438ea74366345b9ebed223

SHA1
047e910e975fab9088665a955ea7f3e505e99c6f

SHA256
71d6ab1a8b3301a541117bb21a784706fd95f54b846e06909c9557f0a31367f2

SHA512
14f71eaa83f6db20198dad8337625ddad866524e66463153fd177a0eb7522d677ef34b3573df6f68d631692abd3f0b0807971ee7b444fbc9d942d97bd4dcad56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
3c1440439d1e2025edc0cc0c633912c8

SHA1
8a8eed2edd720aff5e6304bf37b423055fcc3037

SHA256
7bb319a9b8db0fcb54fe0a4036319288258e700cac4701302c020fa50447081b

SHA512
b8fb14ddb5fda98f0053cdf168935f52c9dbee8016037da41e1e67f23f7a1326d13ddd885594ecae01f02b180890e9de81732c14777758653a71a5d267ebd26d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
585a0a2773640dbf3dc89991b53eede9

SHA1
8158140bcab42b74cfa3932afcdf8ac889bf1d1a

SHA256
21bc5545fbe797e7d7da3bf1d32506f93d8a9178887c6cce92e1256292b7d5d2

SHA512
802b67e01241cd8a5c5d1823ea0800ded09561b1a8493492cdba38a60e30a0d1dd21de2cd9428e961145dc96e063c3cb70a301f778be61553236c0d1796591b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\index

Filesize
256KB

MD5
85b96f5d6c9274eaf3ebc06a1fb06e14

SHA1
2d6d4dcfe854e48d9729d45feba7679384473735

SHA256
08a8f499486249eedc758e325d13773e95bb17e460677f71cbca40ac35317484

SHA512
35a76127b33b6f307ca5303e6359de7f8449c1ec4dd530ed5ea77d5aef2441f4c9290573300b24aed89b1dcf5c3d190b86a399f22c4566fe7358a4a056489e3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
12121f24c8c394349f66799091f8257d

SHA1
cadce9342cd1d33621da42234370c2788249a5cf

SHA256
a80c8b6623a353ae796f0a690c17b26833047a2da8bdbc3670e31beb590c7e00

SHA512
884d54742d3b6e5c4fe22fb3b7fda08c5935489f00f7ac8ccb24b1a35696eb3a820015e08c2b6d46c875137d0454629dbe3831d7ce084c9beadce604a3150bb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
1KB

MD5
cdb0e2e2e85d704c660c861344037e08

SHA1
f40406e9a6a371bb9c91cd503cd2e6a32cb2fcf8

SHA256
d9375d29e4e4b7708682fb38a64ba77c46110826ee15c196c5e7393df9266223

SHA512
665bd3224fbd549dec02de693463e6d21bed317183b97ebd64bcfa12325776f16cc9cfa6181fa6570f3855ddcd2724aa2ec5270a88f6b16c827f5dd1cbf78662

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
59KB

MD5
af25bed60b8d70eef7bc0a20fdf5c136

SHA1
2c05a83e160a41b6ac23315a623a5a2242d088c7

SHA256
1211f17695dfc1b714a0b8ee9f499d5d387ce26eb2d7d539b3b1f78d079cf5f9

SHA512
43c9c58931770924b174bd5aa309d79a1262747036beacec0b93176eb9d2b99384d8fab42eef9801a6e6bda3bed6b61ef824c1b6bd6bd41ace176b95e4bcaead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
b480df9b4ceaa4a12b1a0989311f6e70

SHA1
258b4448539fffdf00c0713fb255675f14cbeb32

SHA256
030d1be6adf5ff0c9577a322852cd34e1dba84deacd195f94328de998ea30f78

SHA512
bf83902bd1b410cbd6f7f5de5457a4851a4eb7a10225f346844ac9c88654976969d11abb6964d8ee0cc2296b96b659f222362822b5c5aed08a838c850c00db62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
61da3e7e967a9335040920bb0d30baf6

SHA1
22f4551324e441b8da5d538cb5b36c3d4007ace0

SHA256
10b37fa0aef8822e52d9bd8354d27016c47287a735456732d6e1389f43305cc8

SHA512
6a9b047a7246b0ea6cdeb62a70098faa43af0246b86d69696aec379241dff9578d74efcdfd346e3a6b8f839f2d1499042cd549086520c8a8777b5de2d2b0919f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
67910432a1772bfd2db7a84345ff8c87

SHA1
8eac67118617deef02848b612b42d30f39ba6d83

SHA256
0fd76dc5d844ca1ffd237512bc133e9e91754eca79224de62335f45ef9a72fc6

SHA512
47ed9e01e071aab0e37e52c82f30c561981b8ef43f0c722b9f4a4d18825fbd88bb4f14306ffb51bf01d6ab6cd9695658c1b6288cebd4a145471d7e91bb0934e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
cb36c49cf7a2fcd0a46b45ba360ae33f

SHA1
34002cf2f2262d483910748648447c9d50219cc7

SHA256
882514dbcf753c8c5b985ab92dfcd0241ce2799fdb897dba90e9201c34891093

SHA512
506d3b8a777f19270c208b32b9f7da261fad51ce7b8e7a5ef9a41c212d5edf4347d313ec6fec5517627fc83597512100ec58fbd92b64920294c7806eb038b92e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2ba720a591cc2d0ba01dd4f5ae51ebdb

SHA1
32df45745031fd929093b168459263394e28532c

SHA256
b4c6e4a1c1ee8bbc491dbfbea8b623774f068a11423f3995a6230e1f63b172cf

SHA512
bf03fd033045d27eb9b8e0911fdcf82568480cfe5d108e9744432dcbc6afd7c3947574538aabdca38ba752e73fcb712843ae5b9553cdf2799d6ad4e5db1f4d35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6490f7e9ae758dd4e413b25432afb05b

SHA1
ae66f1bef2d1bf3485b64c441fe0c0ebabffda2d

SHA256
a4324997d54008e19c399262fe660770ac09f5c773be9e870283a699a875f48d

SHA512
18268ec05d975645efc01a975156bab01ffdc2ebe1b7d325e49dce4ee008699427adbe5bbb1c9c3e9b933550dee99d8e6bcc95e3b95d7f95e2f20a302cd6d96c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
acb0213bc6749e4461205583d7b78fb6

SHA1
d40fa564a1b8da2cc366499e63d64fabe2676a98

SHA256
dccf2f7c5375b731388ced0951c3c4f7493d7ce9c59a426f3fd9f2a97e7e2f3f

SHA512
4d31e2f88e87cc5f9a412bbb714c240dfb09a10efb0406c5bf2ff45b01a03d24d87fc6400c058c2d5bc42693a188a6d2d51dc863dba001dc3b062f0e762f4b8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a6a334e2ac9aedacb7c3a7603a4c06f0

SHA1
89f70e1bd01e5599f615e11a358ce6d03c7fe1e3

SHA256
a40582f4078487185bb73612217bbcfcc90984df2fdbbd75dfb940067210c2a5

SHA512
518e9332da5009e35f8452aced212a9fc27846d6a2b714b79ed6d63fc6e517c33709f8f2431d052bc299551238337da60c9a1558ec2db26a97354691cf5ec4ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9de9d500d829024bf6b59dfbd0f86ffd

SHA1
d6090dcde7dea5704c465b32f11b920551b146bf

SHA256
b330205771e78441d39e84f71818e9a602692b0ce94a87ce14f7c36125d4886f

SHA512
731e769ee6a2232b0b0ff245d262ff5de9dcce6bef7f8550016a6e4ca0566c584acb454c26ae18e7237fe25d9ed537cd20d066572fac415f73821f5e7e3fa2c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6e2d99ae5ca59b9d4fedb11e1b1803be

SHA1
ad3919502aa27eaf23877d70e53ab44bcd8762fb

SHA256
d1cbd694774205deb3e82f73ea5685006eb0d1a92ebbc9c337bc51b5ffd2aacb

SHA512
eeccad64727661fa8a4ac9eb5622cff40e287abcf79297c41f864f3fd3779f95407f0eb1faab7edae5a5944d7007712f6c1e07fc79b94ff70087d265a52ae469

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6e2d99ae5ca59b9d4fedb11e1b1803be

SHA1
ad3919502aa27eaf23877d70e53ab44bcd8762fb

SHA256
d1cbd694774205deb3e82f73ea5685006eb0d1a92ebbc9c337bc51b5ffd2aacb

SHA512
eeccad64727661fa8a4ac9eb5622cff40e287abcf79297c41f864f3fd3779f95407f0eb1faab7edae5a5944d7007712f6c1e07fc79b94ff70087d265a52ae469

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
130644a5f79b27202a13879460f2c31a

SHA1
29e213847a017531e849139c7449bce6b39cb2fa

SHA256
1306a93179e1eaf354d9daa6043ae8ffb37b76a1d1396e7b8df671485582bcd1

SHA512
fbc8606bf988cf0a6dea28c16d4394c9b1e47f6b68256132b5c85caf1ec7b516c0e3d33034db275adf267d5a84af2854f50bd38a9ed5e86eb392144c63252e01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c325881ebe65f710ffde9291a337fa80

SHA1
1ee282fbda5f7c9b49406abfc182cc83148883e6

SHA256
3b769be053cc0fb275a708dbd5e7cca5af41a5b4994385cbd19266e880da9c0c

SHA512
f28ba69ec56f4d1dd8e241cb47d4514ac7f9d9cb177929f1c48dbb04bcc9adea13d95f415dfb4c660eb3c79ad1211ca15459b3c566179365d026ab3e5b4cad0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
90B

MD5
9abaf4657b0d1ccbf1d7dc7b4599eba8

SHA1
ab7243b35d3922f0975d63d8ac304b2df73e6391

SHA256
7f7f2a1a91eee8352110f69208dcfd4e38a0d08c609122c66a03c5a5808442b0

SHA512
477a16ac69421bd2ddcc3de6d1902ca24a179d73d6ae6d0e6094168160890a86d8308ab367332efc5dfa2cae808bc60f16d9d8612db71aab91b7b86c815dfcab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
26B

MD5
2892eee3e20e19a9ba77be6913508a54

SHA1
7c4ef82faa28393c739c517d706ac6919a8ffc49

SHA256
4f110831bb434c728a6895190323d159df6d531be8c4bb7109864eeb7c989ff2

SHA512
b13a336db33299ab3405e13811e3ed9e5a18542e5d835f2b7130a6ff4c22f74272002fc43e7d9f94ac3aa6a4d53518f87f25d90c29e0d286b6470667ea9336ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
90B

MD5
8194552311c78b568c09b3929926a4a8

SHA1
43587264b2487f06e4e42b579b0d9856350faab1

SHA256
ff9cf7809367559355fbc1ce43b2721450655f199d6cff5de56e1bd93aaa2155

SHA512
bb6a2f159e39113a2ccd7d7caa4d8247f1e0729e1104ebed21b4143a3e202fc609b7c9fdde3469f85063dfa5da87e0c0d4bedd2ec5c1ef7fa194b1b289a2a1a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
90B

MD5
a936ad4a2bd4872f08d7d11402ac7472

SHA1
52b605576e73f8be01363734499fb8ff824eefd7

SHA256
a941d2ccbdab5e1b9d8123fd675211b2d26c9e52a289f8ba45379d1c3fd522b7

SHA512
7ba40ed557d3eadfc37765690c561716acc3ffab8d92798f7c2f6e932c1f2f62e7995502a2c1f8f6016d562ce5f0dbd3f69106f3c045e0c729f31e68c984b8cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
4KB

MD5
1f295dcb86ede3c77edaf7a02d3755a6

SHA1
c740049f993e268dc6d44e07d57a5bb73089e052

SHA256
560a17848f9e33c9cadfc4fd5f5d060a96dbbf04e440669f8ddaef950a7f5fca

SHA512
7b1672f38a4434088f211138ca572afdc7f9a1ebde0958c3185b857a9d6369b287e1cdf288d6a39e5423c44d519cf6d06fdbe51ec1d2e9c054c9115611af899b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
279B

MD5
3cacd980900a03fc17f66cb245d5f1df

SHA1
6e1429fcd03111f4d8dc9a3b9df356e3a656a0f6

SHA256
51cee36e23e3a4f4bbd25b8d07164d9fe87143d18ac9e83d5f6a687710334c1e

SHA512
bc56ec88f7619917d1b184b5de18bd146d266ddc42969baa6ba59a795fbc5f33d77ca2024fe19c8c46c24787bccbec45d2f265cb9ad20144af70dbe95511d887

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13326248125189262

Filesize
7KB

MD5
5a5ffcaa71118786cb9e4c13c09f947c

SHA1
2c0d50dabb885ce4335510fdf7031931fe212657

SHA256
885413315f8b9bb8a4ce6c26c7ec337648b678b799e23dc24e0863e1c0c92daf

SHA512
0bfe725d9595eec934ac88e66878f4dc4e4574331b5cebc98d20f2611bbf03c3b541dbfb9dc2aad0cd3fa7d70b7c48122e498937b8fbf455873fd8b9f7800cd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
af508ba7ef5e955be9d1b1a1b375c040

SHA1
dd7bd103e45bdc0165ebb086919035c6a87a11f3

SHA256
9319bc0cc1289c5ef289f5455e41ffd9e65dbec142fdd087a527749c161524df

SHA512
ff15fa7844e61e29689c4114ada9ece975a5bad0b463d1cda60d71585c11d597a1355d4caabfe4186f8a4705876b0b9716c73b6af083004776c28b164ca7e4b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
cab18ba9df8f777b5cd071ffdbc772bf

SHA1
7b2e8ed7ca12775db7e60a93373bb4eee89e23f2

SHA256
e60cc3ce7ce8cac6c96aedc4ed876ab8cba85503eb934a75c2e3f9c401e5dd31

SHA512
909ca223c82e33a8f438a8ddbf9749d06693f66c64f1388fc5dfa66015f3f98a3f6dd692b37a7f3357c50285e4f1d2f63118670aef928169ed5242368647c958

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
b3b3845f8e7846439bd893fab521a78b

SHA1
6b6c0cf62dcdc3abf8306591fd5bdb6cbb33a038

SHA256
1a1c3f1485078eb1c979641a5006920371a39a3ead4564606a3698b4ae6cba27

SHA512
68bc1f8362c17665a40c8ba03639f85c28409cd5bd0eb75e05f9fb3ddd153d1fb04f403d67ed7a3e8e2338729e33314e78949cd3f6fd5334fbcc8f6f0474a6cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Filesize
20KB

MD5
f44dc73f9788d3313e3e25140002587c

SHA1
5aec4edc356bc673cba64ff31148b934a41d44c4

SHA256
2002c1e5693dd638d840bb9fb04d765482d06ba3106623ce90f6e8e42067a983

SHA512
e556e3c32c0bc142b08e5c479bf31b6101c9200896dd7fcd74fdd39b2daeac8f6dc9ba4f09f3c6715998015af7317211082d9c811e5f9e32493c9ecd888875d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
368B

MD5
ae886d2ab759feaa9dcc749a8d2aea36

SHA1
414ebbff6fe2cfc54632978f6407a806d1aa1197

SHA256
b7fc3bedfcbf1406a0aad4e61d0c9d79e0f61519b95bc77913466d840eb33a45

SHA512
ab48704dc33748209411ed0f130465e2c4447ab7e2affc288d6f4828f16a116a820a8e5cb81e39dcaab9c6d55629cd5c902b569da46f4dbd16c2b0391805a94d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
2a5a68fcb8a50ea9d3cf8923e44a9177

SHA1
b60a2b13b79149b2e78a311ff1a0d4c8ab28b9e7

SHA256
13f28ce5c8dec9911371bd7cf95bb047f1d0cd48eada6b7067c6cb5b96a4c6f4

SHA512
3ffa2eecc19871ac30e40aa0f451c227f56d36ab6bb71eaf9de80d9c05d12cff90591b91ba17ce79ad939c3919456d8404999a7bb7c1ed48d6dc0b7be7ab288e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57edbb.TMP

Filesize
372B

MD5
0a180b522e74b7d443f3c217fc869d75

SHA1
b5dd5fe89467a489212afa603a2f1cbec101af8f

SHA256
ce9a9649892ec184bbeb6a0f56a398bace0223db4952245654d0f0361cb9bacc

SHA512
0edafc9afb11cb590d3488dec4ad3e8d03e3ddf3855abcab923e65fd385739e8c631a775731bec7f8e3bf164fc51f21fee254f47f52e326321f0c4ce29b4530e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
681605628613700b573d4f2849530284

SHA1
3743ac1e19299b4cb8e463d3430efb1bc106075d

SHA256
0d39e06daf4616bba6f444abdb40fec03696cccd5389866c6e356397ab2a6ba7

SHA512
d7a53c02bc5d96583ab992e62dbe66616809fe77de0c6129c11033206c305aa272e06496180e18d60d14eb22d598d88304a21a93811cd7f5dead74a1a4a10680

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
4KB

MD5
d9f84c8cf73422f2ca07d7e7462b9534

SHA1
cff6e092bf5bf1f3f47b7074847e204042a881ae

SHA256
5bf7b14dde109f722782628bbcf3011a23cd2416e7621a62b49ee0333cdec6c2

SHA512
1ea893c62d64304c35b9086e2c7e760716ea5ce220bafb76632670fcd2f97eca5c6693ff98004a861b190060c47c9d97ac92b41e3b1da1a4e8f89d9638548c38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Filesize
1.7MB

MD5
017e7809527af2b42ff941b2e5d6d298

SHA1
d14d84ba7d931fd7aa9ccf9db7b949d6702bd39b

SHA256
17e61a242e31755d409725ea4eadc07e9aed0ebe3469946699dc1d0196274b5c

SHA512
745ad1f314b4997b7b5bb4afd7902b631b71cb651c37f9560458439ca71ed96019a484d2c151f8deeb0b50cbf154cab2609b812bfbb4307757d773ef01a03aa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
187B

MD5
c5c03192efc202637e303668b966739f

SHA1
e99e9f1edfdf1cb7e056dc2a1e629aa3e7195713

SHA256
2a43fbfe5f6e9e1974267a032dc77acf9b8091a50e71fbbe330acbb0d014fd7c

SHA512
ad54c1681c00546528e0661f5f28cf3e903a9df7371709d793ccd557e67bfcc4bb5ba7a5a92ed39625b1e1cf3171fb89d787bcb3ec34522e4577bb5e98dc1245

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
281B

MD5
b7e98af9b9fa2d1f8df05551f04efeec

SHA1
8063fdc9ffd2a0d4c8f5dd97a3bdbd15d20382ff

SHA256
be27c11fdf780356f9e1046aedf92fac5004572a78970ecda1160e5c16f602de

SHA512
e94c3ddea05c2c5727b95c690f7574f530b7b100bacf9c8f8d487d79e8b1eb5b124519497552552316f6ba812f51a6e0fb86a358b9f57ddc2f20fdf8e5371b6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
531B

MD5
aa06936d71825a5243c99a0e63bc02df

SHA1
f7c7775a0124918a770e578728681644302fe468

SHA256
7480ec3a902c3a594006c6ee683e3902c8a7ff995a081e943e2bf7c548def3be

SHA512
c00cd1bc336fcbdcfe311cff7b1162c8c8fd3b1ef1213fd3bfd2135d2dec4f642583bce2b6eff25b213a7e13de463ff24819b29cf438209aea53bd7707904d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
299B

MD5
0e458cf5bed37f6b9661fd25ece613f3

SHA1
6b25f8cf26dd597bea1599a21baed5396a215c61

SHA256
2803a0f9f68f08c66c6ba5d3ebecf73fe9fd024f188d86f30147182855568884

SHA512
2d87424e3e70998b20e37672291a6ad46d0c9ca3d9381400c52c5bdd87ca6d94443ecf570f3767fc0ce5f20aab691b1b88004d7fb4d425b8293e64ad0aabc797

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
36ee30c5c126bec4f46d588e0c7676bc

SHA1
c60f1e6022db41db57a24c598d256eb6ce532b8e

SHA256
6b28feb848a74171656ee3626c3fc76accf52e38bf35c198123ae3caab67b845

SHA512
cb14f03a78d9ffb091facd2f012dc354c418593fa85e630dd66187baa19219af46d896680a4f0b236edde0638c15c4e3c33ce39b27a0a597e4e186eae993f553

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
a5048e185f886afcd3983389cf83169a

SHA1
9645e08acd1171fea073ef4c102f4378776e8ce8

SHA256
bdcb143f69ce7c354838ecf6ed5fe31c70910f225fdb766ad7fdf951062416d5

SHA512
0203eb1aa6f688604367de2b467983084d451f901696897caf8e3f20320c6143b845a45c4f38560ae5b9c44e52ec46f09f87f72667e57320c6a10c20e89952a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
545038681ae38c4d10e0f4e01859b82b

SHA1
1e50c3ca612f0e49535164770bbd4e69b7353103

SHA256
2e900d790c8876c3bd05f8e8fd78408adf5f6e4b46d493393ab30254e5aac973

SHA512
d743e4eb215b6b80e06e806702723725e82cd4bb35e378241a39673305950e31943c62255191960a6075d37979124c16fb23d1c409e375ebf996f83ba3d87c8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
5e3502ad2fb375245c059d2afd28e011

SHA1
d181b4b0237e8107b1960965e93adf701e68f0dc

SHA256
4cb0be48b81de7ada43d21856bc8f5a06f7de51574a79acbac298d04fedf1159

SHA512
37d83e8dc641107f68484de95095c779e5f0ac702226fcbb0d93a3cc94920794ef05b63a41c9c8653052c6ed9f8c81e9ee54024ebc7f0d531ecfa9f89da82354

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
5e3502ad2fb375245c059d2afd28e011

SHA1
d181b4b0237e8107b1960965e93adf701e68f0dc

SHA256
4cb0be48b81de7ada43d21856bc8f5a06f7de51574a79acbac298d04fedf1159

SHA512
37d83e8dc641107f68484de95095c779e5f0ac702226fcbb0d93a3cc94920794ef05b63a41c9c8653052c6ed9f8c81e9ee54024ebc7f0d531ecfa9f89da82354

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
c64084fca41bba92baad32481eb34c89

SHA1
e698120ada889b49ccd462696bde8dfe83d2b785

SHA256
ce8fb09d562ca7f093573f333e017b3ee3e3a1df3ab7be734da1b77b16a5f22a

SHA512
589efa5d178d77a7227524493b67f42848cdb793120ce882ef099b9a141f4adfe421d43d215aafa8381c70c383528eacac4b9aebeeeece6ba66a09d7893b375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
ede1d6dff6d4d8edf5c100064e82b740

SHA1
6e64be7e7fa0882e134252fb568c9ba2a9b893f2

SHA256
b116ecac09b2237ccfcffb465c79202a93fedcba6c57beab2f39c35698b81884

SHA512
d4366de2a99408b0881854e949524d6cd10b52a233dd904fae4429a84ec65bd6b807d402fe85304298f32a3e8c30f6d9b34864492f370fa601141085e3a85951

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
ede1d6dff6d4d8edf5c100064e82b740

SHA1
6e64be7e7fa0882e134252fb568c9ba2a9b893f2

SHA256
b116ecac09b2237ccfcffb465c79202a93fedcba6c57beab2f39c35698b81884

SHA512
d4366de2a99408b0881854e949524d6cd10b52a233dd904fae4429a84ec65bd6b807d402fe85304298f32a3e8c30f6d9b34864492f370fa601141085e3a85951

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
50330cb6281bf1dd9011d851dc95672c

SHA1
5dfa80e6bced4a2fa9beaaa58a7a3a01db45666f

SHA256
47fc92ea18c0cc72825cd515774c044a2d0f928fe66ebcf277080a8019aac680

SHA512
8971d812bba688e404e5b022475ab0b4628d15fea5707708b1e8b5e9bfbec4d8fa75805ef253bba2815ff7f897d6db107636e465aa86a6943993cd573cf51f2a

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit