Overview
overview
7Static
static
7Annelids O...11.apk
android-9-x86
12D.map
windows7-x64
32D.map
windows10-2004-x64
32D.mapinfo
windows7-x64
32D.mapinfo
windows10-2004-x64
32D.webp
windows7-x64
32D.webp
windows10-2004-x64
4Play-Bold.ttf
windows7-x64
3Play-Bold.ttf
windows10-2004-x64
7Play-Regular.ttf
windows7-x64
3Play-Regular.ttf
windows10-2004-x64
7annelids.rcss
windows7-x64
3annelids.rcss
windows10-2004-x64
3ask_for_rating.rml
windows7-x64
3ask_for_rating.rml
windows10-2004-x64
3background.frag
windows7-x64
3background.frag
windows10-2004-x64
3background.vert
windows7-x64
3background.vert
windows10-2004-x64
3background.webp
windows7-x64
3background.webp
windows10-2004-x64
4background_2d.frag
windows7-x64
3background_2d.frag
windows10-2004-x64
3background...r.frag
windows7-x64
3background...r.frag
windows10-2004-x64
3background...r.vert
windows7-x64
3background...r.vert
windows10-2004-x64
3background_city.frag
windows7-x64
3background_city.frag
windows10-2004-x64
3background_decal.frag
windows7-x64
3background_decal.frag
windows10-2004-x64
3background_decal.vert
windows7-x64
3Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
09-06-2023 23:27
Static task
static1
Behavioral task
behavioral1
Sample
Annelids Online battle_v1.115.11.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
2D.map
Resource
win7-20230220-en
Behavioral task
behavioral3
Sample
2D.map
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
2D.mapinfo
Resource
win7-20230220-en
Behavioral task
behavioral5
Sample
2D.mapinfo
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
2D.webp
Resource
win7-20230220-en
Behavioral task
behavioral7
Sample
2D.webp
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
Play-Bold.ttf
Resource
win7-20230220-en
Behavioral task
behavioral9
Sample
Play-Bold.ttf
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
Play-Regular.ttf
Resource
win7-20230220-en
Behavioral task
behavioral11
Sample
Play-Regular.ttf
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
annelids.rcss
Resource
win7-20230220-en
Behavioral task
behavioral13
Sample
annelids.rcss
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
ask_for_rating.rml
Resource
win7-20230220-en
Behavioral task
behavioral15
Sample
ask_for_rating.rml
Resource
win10v2004-20230221-en
Behavioral task
behavioral16
Sample
background.frag
Resource
win7-20230220-en
Behavioral task
behavioral17
Sample
background.frag
Resource
win10v2004-20230220-en
Behavioral task
behavioral18
Sample
background.vert
Resource
win7-20230220-en
Behavioral task
behavioral19
Sample
background.vert
Resource
win10v2004-20230220-en
Behavioral task
behavioral20
Sample
background.webp
Resource
win7-20230220-en
Behavioral task
behavioral21
Sample
background.webp
Resource
win10v2004-20230220-en
Behavioral task
behavioral22
Sample
background_2d.frag
Resource
win7-20230220-en
Behavioral task
behavioral23
Sample
background_2d.frag
Resource
win10v2004-20230220-en
Behavioral task
behavioral24
Sample
background_border.frag
Resource
win7-20230220-en
Behavioral task
behavioral25
Sample
background_border.frag
Resource
win10v2004-20230220-en
Behavioral task
behavioral26
Sample
background_border.vert
Resource
win7-20230220-en
Behavioral task
behavioral27
Sample
background_border.vert
Resource
win10v2004-20230220-en
Behavioral task
behavioral28
Sample
background_city.frag
Resource
win7-20230220-en
Behavioral task
behavioral29
Sample
background_city.frag
Resource
win10v2004-20230220-en
Behavioral task
behavioral30
Sample
background_decal.frag
Resource
win7-20230220-en
Behavioral task
behavioral31
Sample
background_decal.frag
Resource
win10v2004-20230220-en
Behavioral task
behavioral32
Sample
background_decal.vert
Resource
win7-20230220-en
General
-
Target
background.webp
-
Size
7KB
-
MD5
2eb141c3cf82936e58f2ffb397e10c76
-
SHA1
b2bdd8d7fd04f04db4ae9ca0214e9f5ccf02051b
-
SHA256
ccf0606d129dadfbaf5c51cdec59aec972cd0fae28a4db8d50461ad4f1082eaa
-
SHA512
af6851beda3ff04a7063da885b10e48c6218b6877f81c05d2c29ae9803c6e463f865d9b2df3bdb48ccd956b42606ce423216d3c5895890d3eb8e1aa8e3c1540f
-
SSDEEP
192:pw99Gdi+lGClqGYi/T2TqD4asgEQvL0UnAeAHKenE0jsSzsygi6:m9Qd2MjDL2TE9sUvLOeAHTE0j7zss6
Malware Config
Signatures
-
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6cd7832f-9256-462a-b0c4-16a19e1e2066.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230609232837.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3780 msedge.exe 3780 msedge.exe 3332 msedge.exe 3332 msedge.exe 2336 identity_helper.exe 2336 identity_helper.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exemsedge.exedescription pid process target process PID 3888 wrote to memory of 3332 3888 cmd.exe msedge.exe PID 3888 wrote to memory of 3332 3888 cmd.exe msedge.exe PID 3332 wrote to memory of 3904 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 3904 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 1580 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 3780 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 3780 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 3836 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 3836 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 3836 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 3836 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 3836 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 3836 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 3836 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 3836 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 3836 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 3836 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 3836 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 3836 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 3836 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 3836 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 3836 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 3836 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 3836 3332 msedge.exe msedge.exe PID 3332 wrote to memory of 3836 3332 msedge.exe msedge.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\background.webp1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\background.webp2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7fff1d3f46f8,0x7fff1d3f4708,0x7fff1d3f47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,10931273443635347409,542697755944165582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,10931273443635347409,542697755944165582,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,10931273443635347409,542697755944165582,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10931273443635347409,542697755944165582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10931273443635347409,542697755944165582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10931273443635347409,542697755944165582,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10931273443635347409,542697755944165582,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,10931273443635347409,542697755944165582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3564 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7d99c5460,0x7ff7d99c5470,0x7ff7d99c54804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,10931273443635347409,542697755944165582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3564 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10931273443635347409,542697755944165582,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10931273443635347409,542697755944165582,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,10931273443635347409,542697755944165582,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1340 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD578c7656527762ed2977adf983a6f4766
SHA121a66d2eefcb059371f4972694057e4b1f827ce6
SHA256e1000099751602ae1adcec6f1c74e1d65f472936817b45239dfed4b043984296
SHA5120a8e58ae95163b3cdf8e81b5085887761e73cb7c836a1a6a972e837fb3df69b2ac70cfd6311d06d40656344ec35eb48e512f007561480f0345486ac2b329be0b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5099b4ba2787e99b696fc61528100f83f
SHA106e1f8b7391e1d548e49a1022f6ce6e7aa61f292
SHA256cdb1db488e260ed750edfe1c145850b57ee8ab819d75237a167e673116a33ee8
SHA5124309375e10785564ceb03e0127ced414e366a5b833f16a60d796471d871b479e4c044db5268902d9dfd14715ca577cb26042bab8f7b0f31fe8abf33947feb9d1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.icoFilesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnkFilesize
2KB
MD5449c317f9d27be28e0d62b2a348529bb
SHA121236d97c03eefb26930230d524d781dcde61f51
SHA256c0dbb3df061d3177ebfacb974fbe073f638ffaa8e1bd4cc7802966ec61ee8cd0
SHA5122edc5ee897e6bb6fadde83148f326d394a280b61931a39961248b54ff8be70fead1e2acbe5662c025c846b1ad0b58b1413e851a90c3a5940df64209ef42fe04b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD51eeff168170d6a2626f134aa525e85ac
SHA1cf4e7cda8361851a7f5e94d03f86a1046f584114
SHA25638466e84e055aa2e443f1367175b3ff335222942c5326d52ef57c2c3d7ff42cd
SHA512ff6da36d0b783b6d3133c6dfda77e893f93fadad59bf5655f51068beb3402d6d71b2e1c2126e5ec94cd921e3b3b31ce8eb4df6870f6b263c755a71186186433e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
4KB
MD56035886997f3e8d8a5d51e0c76779166
SHA101b4db6f6cb0276dd042dfb72bb67adb55cd4684
SHA25680b0e5b13c3dac1f203241d45f0cfaac0481d99d78e1dff3c357957c77397c69
SHA5129fd3a7ec6f632334e48ff61a253cc2b3d0463075509a5fd9ee798704a919da1f2c85f30843b8805ea868e8b37692c882cdcd9e84d00c6586d41acaf9bb540c7d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD516efdc05b0bc1e74689a3f013ecf263f
SHA16a6f7fb49618940534cd47dc11519cedcd114ed2
SHA25699ad672e27371ee0531fc08eaca18c330b016d6702e6d58ac4ee918ef54c6020
SHA5121872bf5f2d5c03d98071c484a621b79736864290e4e3fc18457d26959811ab84176204dbf449c8cca96c13a163e5b40d41e0dacd1f114ee6f15c8625c044d238
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD502ee7addc9e8a2d07af55556ebf0ff5c
SHA1020161bb64ecb7c6e6886ccc055908984dc651d8
SHA256552d3ed359b7a52278ce621674d16428d8a7969f6cd5663df18e240cce66aadc
SHA512567989543c3848a0c3276d96b96ca761f750e4b71fb74f36d809f590ffe16a72fd5ece251737a8b1ffe65f0051e211bd7ad19d2b8b0b7ca1b7ffc86dd2a52883
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD53966348bbd403f0d73c498b32b42c474
SHA1e831a80dc7540db9afced875d230530380ec5119
SHA25685295f1484a81c8e36f1287dbb3d8c2ff4f80a5b2dc0985b88abcf49850d7542
SHA51275a7fe567b809507d121ecfccd5cb85d7dc8e64609f916a450345a1ba959f7535767619970de25f9474c498666ad1b08250697222d5696f7a589f663a035c41c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD53ad93f22848ce5dde18b82b5206695cd
SHA182f94822a58e8f9c7cdec51fc80dd326f3fa0765
SHA2565e508f48fc00a13f82e78c5234470cea1406f97f1f9ef8c1d820dcd744d5c9d3
SHA5123bb52d001972458f06323c4181182f8ac2aed592edcbe274aeee50a3a0394a1018fbb556df41a5ca51232aaf89063f09886868d878bbb2fb8c8de76ae7a88c3a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
9KB
MD5d50cf0cc5ad6a8b171be020639dec874
SHA167a8496e92483f10cbfff0c7f88472833c68104f
SHA256614920bb12b48a43b08737a3881ff4d6bc97e25df6d94b832e3b2c06125234de
SHA5124d0114a1938d15dbd21c8322263a2db379bae9aeabd7f5e2232433e84c83b4394ed0e97cc42a9e6f2b334b7307324a901def5867ca58f7e7e00d92c436858000
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-msFilesize
3KB
MD5d01c3810fa37a4a626272d5b61a90e7c
SHA1ddac18b8e66645dc115cff3792e94744a9bc1c23
SHA2561fa8a7ddbf2e4c8358f168cea701f4b148b2c6fdd32d154c7fed827adc08af0f
SHA5129c59e3bc043e41174e0f979bdaa028e65544b88783edfb329e0bbb655eb5f6dfd0b9d857757b7bd470be7f84ed7ece51b533a95e749912c9cfc28772d60941f6
-
\??\pipe\LOCAL\crashpad_3332_HTWILWPKOHEYXGBOMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e