hxxp://viewpdf[.]net

Resubmissions

17/08/2023, 13:09

230817-qeadvabb5w 1

17/08/2023, 12:33

230817-prk6faba3y 8

17/08/2023, 12:27

230817-pm82psba2w 7

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2023, 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://viewpdf.net

Score

1^/10

Malware Config

Signatures

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 42201.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
1972	identity_helper.exe
1972	identity_helper.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2228	2824	msedge.exe	84
PID 2824 wrote to memory of 2228	2824	msedge.exe	84
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 1600	2824	msedge.exe	86
PID 2824 wrote to memory of 3840	2824	msedge.exe	85
PID 2824 wrote to memory of 3840	2824	msedge.exe	85
PID 2824 wrote to memory of 5100	2824	msedge.exe	87
PID 2824 wrote to memory of 5100	2824	msedge.exe	87
PID 2824 wrote to memory of 5100	2824	msedge.exe	87
PID 2824 wrote to memory of 5100	2824	msedge.exe	87
PID 2824 wrote to memory of 5100	2824	msedge.exe	87
PID 2824 wrote to memory of 5100	2824	msedge.exe	87
PID 2824 wrote to memory of 5100	2824	msedge.exe	87
PID 2824 wrote to memory of 5100	2824	msedge.exe	87
PID 2824 wrote to memory of 5100	2824	msedge.exe	87
PID 2824 wrote to memory of 5100	2824	msedge.exe	87
PID 2824 wrote to memory of 5100	2824	msedge.exe	87
PID 2824 wrote to memory of 5100	2824	msedge.exe	87
PID 2824 wrote to memory of 5100	2824	msedge.exe	87
PID 2824 wrote to memory of 5100	2824	msedge.exe	87
PID 2824 wrote to memory of 5100	2824	msedge.exe	87
PID 2824 wrote to memory of 5100	2824	msedge.exe	87
PID 2824 wrote to memory of 5100	2824	msedge.exe	87
PID 2824 wrote to memory of 5100	2824	msedge.exe	87
PID 2824 wrote to memory of 5100	2824	msedge.exe	87
PID 2824 wrote to memory of 5100	2824	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://viewpdf.net
1⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc2e5346f8,0x7ffc2e534708,0x7ffc2e534718
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,14413193078345382518,6251782214847349843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,14413193078345382518,6251782214847349843,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,14413193078345382518,6251782214847349843,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14413193078345382518,6251782214847349843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14413193078345382518,6251782214847349843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14413193078345382518,6251782214847349843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,14413193078345382518,6251782214847349843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,14413193078345382518,6251782214847349843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14413193078345382518,6251782214847349843,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14413193078345382518,6251782214847349843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14413193078345382518,6251782214847349843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14413193078345382518,6251782214847349843,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14413193078345382518,6251782214847349843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2180,14413193078345382518,6251782214847349843,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,14413193078345382518,6251782214847349843,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5476 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14413193078345382518,6251782214847349843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f6f47b83c67fe32ee32811d6611d269c

SHA1
b32353d1d0ed26e0dd5b5f1f402ffd41a105d025

SHA256
ac1866f15ff34d1df4dafa761dbb7dc2c712fe01ac0e171706ef29e205549cbc

SHA512
6ee068efa9fbd3c972169427be2f6377a1204bf99b61579e4d78643e89e729ad65f2abcc70007fd0dd38428e7cd39010a253d6f9cd5e90409e207ddaf5d6720d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
b335b14bbcc535cde75cda4fb4ca59e4

SHA1
a23fa19144c559f935af0462ca7f6151f81ef0cd

SHA256
2fb67acd441e3db9fa228baf588a909e0161d38a3ef0ced712d7ab875dcea615

SHA512
a4c3123f1669751450f77186567225a09dcf55d06c172266dfe719fbd0a79422db024cde5d621aaea0d5df57b7587d17b35d0e1b5e0dadb41c8988403fe21152

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
732B

MD5
30addb931cce363d15e1fdb443e1c865

SHA1
3ef929586a94d23ea1154440a275e0d2fcec0fec

SHA256
1497a7699a48282bd697ba3ebdb5bb0562e4c94e7469ae8773e499350eaf9796

SHA512
6adb49ba6ea61d6ba401ca3cab5bc1a0dc7e4a5fafebf823a4b7b8dd7fcb7d1b3e26b493fd32d01a1db959771a5ac91d3e1fb0f5c1936f74f95ffea34df4ccd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a933bff69b64bc21f3435f5b79028db5

SHA1
2035259d8191ebed3be2886002b76d1a75c9768e

SHA256
558b900dcfb9d717c909f73957b4dcf47e2b4513a2912490702d388487234a3f

SHA512
1964c326b407d491664b3619bb73b89ccbc1e36482eabcba157efe5654c0691a5ea6434f404b47064bb19fefcf979d833603d81fc70de0dd9466baa8e1532e3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
346756c5e94c341e987ac3f0abb25828

SHA1
3086abc8e3d2335f772b823b018b1dd781f85133

SHA256
af44fd7d82a41d3e863eedd896cebf379e922d9de35d57133f98db594ee48317

SHA512
cfd7c9333a045e514eb1ee1613d68a3b4cf3b557cfc1cb08a1ab9ca760201ff2ebc3feb57c64f9424d3cdad7ab917ceb433ef344d89c18d32d6a01214a10ce7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fc2c254549d933c9f46a6edaf8418143

SHA1
48865cac4ce1743bd09a412d95cad87fa13b2ae6

SHA256
71ba076b0d475188216b78fb7af0ea854f97baf3af8313acc24a1123724fa343

SHA512
4ad69226b4411a69367679413aaf61114d3e5f6c11f60775bb4190ddde19e364e7d9fe004be19d1fe6807c9e728abc7148fa23e12536b8a37e6413b27a0ea355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d803c62c927958b264c0afd6f9bfeb9b

SHA1
1cf7fba40a6341517327cf46e7cd904e3698e026

SHA256
1f5ce219668b049ddc9a620f160a0dccef6d735b296c75190d2e26e4a409d418

SHA512
70da4e9ce5c0fa7dc0a7a90ce6c292620e49a5e55fe1fea8a6781e36b428ce7ff4a5d2330f09a74cb5705d8b300dbdba91c2b8a3b6e9917901fdace59abec034

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f8328928fe060a1040ef00ea6246f54d

SHA1
1367975adb91b3ce9ed6004d0a431c851939b44d

SHA256
21b8557c11e5a5571722bfe01aded28df72c8e040d78ca9c8030873c6ef9a0e2

SHA512
d21980e2b51a036d5a564722077525b820911b27493655218ae50b25e8627e60a3263eedce206b181fd7ca87e37d4796af508775a376ecd0ca4867d8485b83de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5544c64f2a8f49dabc19eb84267b1c9b

SHA1
c5b78d63a8bab1c7b985f7ea2f268d0d7809071e

SHA256
a1fcfee2974a77e76a7431a2069db301861ab42dd41769cead8697f41f5a497f

SHA512
38c80d7c810441fc87beff38929473088cf426b0a25a30820d8a060f493350d99bb8521b314afe00578ea54648fce2aa4e55880a83a4f1048c56307991726565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
c39ca5045c95b6d5c32f3acab20e828e

SHA1
ddf5a9308df003ffc7995cf47d4e02c45bc448a9

SHA256
c85fa26def2cd9e61aaa42c2b259048dc378473670d020a29ba26aeb027566ef

SHA512
8f5eaee72aeabe5ca38baea7d735daa9c4e19b3c45b20112db3577411254bae58c2080626f5b5642a138e5de9d17e18737f52436e63a9d9e9ef61deafab6364b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
d188e6ca32c732a23dac432f2e8e8139

SHA1
5db88057ed5d8f9768bdef1505eadc8ae4c6c342

SHA256
2b75c4997aa5386218c9f2dd4d35a63f212a1fdd5b4ddf07d669b67e299271cd

SHA512
10de7a85074b68fc67ad33ee34d0d1af231ceefc23676b438d25a497ae3c0f4ca5e3582e121ab6cf28aa52ce4d1cc3c9a2bdd54d99b7953f272609f6beda5ee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6ecde5dd731abbc3e5713ffd72fb2b4a

SHA1
db7fc66a3a8de41b29f7c7859972ad097e996209

SHA256
a1bb86c0c709260addd254024f6b3e26771059a5e9a66ee043c22e484bde206b

SHA512
0611fd448f88af38661d5f651f7c78aead200a574dbd8b040a5ca14837c57f437cc8ad76a4cc641fd025f9e2cecd7805d90e48339cf97a433198a2ff53d4e961

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 42201.crdownload

Filesize
93.0MB

MD5
4b92d6757d2bebfcb101c9d534d073ba

SHA1
690faa352b7963ce9f32bf4f2f7dc96104ae5e6e

SHA256
67420a77879eefab5da6ab6a1158f7894ef8a5a5c451f950aa47dd1b807028e7

SHA512
3cbf9862f2e8afdc9da3e6d68ec1a50c50f0b28f790e8b11cefda0f03412ae2d16aa637963605ed80591e844fbc94376e0928e6d4c0b85aa3692bed9b7397bdf

Download Submit