hxxp://ocsp[.]globalsign[.]com/gsrsaovsslca2018

Resubmissions

04-10-2023 14:11

231004-rhk57aec72 1

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2023 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://ocsp.globalsign.com/gsrsaovsslca2018

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
2200	msedge.exe
2200	msedge.exe
4580	identity_helper.exe
4580	identity_helper.exe
1448	msedge.exe
1448	msedge.exe
1220	msedge.exe
1220	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2468	7zG.exe
Token: 35	2468	7zG.exe
Token: SeSecurityPrivilege	2468	7zG.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2468	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2240	OpenWith.exe
2240	OpenWith.exe
2240	OpenWith.exe
2240	OpenWith.exe
2240	OpenWith.exe
2240	OpenWith.exe
2240	OpenWith.exe
2240	OpenWith.exe
2240	OpenWith.exe
2240	OpenWith.exe
2240	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2768	2200	msedge.exe	85
PID 2200 wrote to memory of 2768	2200	msedge.exe	85
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 2124	2200	msedge.exe	86
PID 2200 wrote to memory of 3620	2200	msedge.exe	87
PID 2200 wrote to memory of 3620	2200	msedge.exe	87
PID 2200 wrote to memory of 3800	2200	msedge.exe	88
PID 2200 wrote to memory of 3800	2200	msedge.exe	88
PID 2200 wrote to memory of 3800	2200	msedge.exe	88
PID 2200 wrote to memory of 3800	2200	msedge.exe	88
PID 2200 wrote to memory of 3800	2200	msedge.exe	88
PID 2200 wrote to memory of 3800	2200	msedge.exe	88
PID 2200 wrote to memory of 3800	2200	msedge.exe	88
PID 2200 wrote to memory of 3800	2200	msedge.exe	88
PID 2200 wrote to memory of 3800	2200	msedge.exe	88
PID 2200 wrote to memory of 3800	2200	msedge.exe	88
PID 2200 wrote to memory of 3800	2200	msedge.exe	88
PID 2200 wrote to memory of 3800	2200	msedge.exe	88
PID 2200 wrote to memory of 3800	2200	msedge.exe	88
PID 2200 wrote to memory of 3800	2200	msedge.exe	88
PID 2200 wrote to memory of 3800	2200	msedge.exe	88
PID 2200 wrote to memory of 3800	2200	msedge.exe	88
PID 2200 wrote to memory of 3800	2200	msedge.exe	88
PID 2200 wrote to memory of 3800	2200	msedge.exe	88
PID 2200 wrote to memory of 3800	2200	msedge.exe	88
PID 2200 wrote to memory of 3800	2200	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ocsp.globalsign.com/gsrsaovsslca2018
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd91d946f8,0x7ffd91d94708,0x7ffd91d94718
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,1674609503179289204,10754746618853060025,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,1674609503179289204,10754746618853060025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2840 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,1674609503179289204,10754746618853060025,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1674609503179289204,10754746618853060025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1674609503179289204,10754746618853060025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,1674609503179289204,10754746618853060025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,1674609503179289204,10754746618853060025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1674609503179289204,10754746618853060025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2924 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1674609503179289204,10754746618853060025,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1674609503179289204,10754746618853060025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2000,1674609503179289204,10754746618853060025,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,1674609503179289204,10754746618853060025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1674609503179289204,10754746618853060025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1674609503179289204,10754746618853060025,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1674609503179289204,10754746618853060025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,1674609503179289204,10754746618853060025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,1674609503179289204,10754746618853060025,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3444

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4552

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2240
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\gsrsaovsslca2018
  2⤵
  PID:4800

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" h -scrcCRC64 -i#7zMap19623:86:7zEvent11900
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1222f8c867acd00b1fc43a44dacce158

SHA1
586ba251caf62b5012a03db9ba3a70890fc5af01

SHA256
1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a

SHA512
ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
04a059256f325fe81ab15bf08cc9bcf3

SHA1
b22ceb11f2c6d05962d7eceac3850b60a22e589f

SHA256
2e2b8db2fd6f8b45365978ab93b922a6234070c1e724f53aa2194c8228028726

SHA512
f9b114f1b545fc96cffb65e26bd8f19784d1d21e63bc1e667fbe14cb28d94751a142b3f095149320dd4198a531b8915b790b7bbf91a0ea564e2682504d9dafd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b3c59ef17c7ef03d0902bb3f57ec8207

SHA1
f1a58ea549df35c150266b8a507c46ad30f7a90a

SHA256
19f101428ece312d425a6dc016fa09d6f58bb9f5e179fce38a3bfb710005309b

SHA512
de072f18f0660ad7ee1b9bd74fd24b781920487ca528e9575c4410d15907f7f570615245a43be934b832f8d0fadb8568d126c73167379e63240a2d391c118db2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b51cfd7a06475d7b1960f8c9366a50b3

SHA1
90515678330f2b68b71ada642153df2bbc92a342

SHA256
7beaea04bef4c4c2c648bcc9361517b003fd39e59e090c6b580151db8312a49c

SHA512
845751b7b1641e6e2d9f81fd14cbe5108eb3cbed9a94e7c6520361abf6e572c70964ccb5e6fdeed9b9f0c9bb7c5d3822f612503bf52f5d79cf4cc9809840e5d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
15ad31a14e9a92d2937174141e80c28d

SHA1
b09e8d44c07123754008ba2f9ff4b8d4e332d4e5

SHA256
bf983e704839ef295b4c957f1adeee146aaf58f2dbf5b1e2d4b709cec65eccde

SHA512
ec744a79ccbfca52357d4f0212e7afd26bc93efd566dd5d861bf0671069ba5cb7e84069e0ea091c73dee57e9de9bb412fb68852281ae9bd84c11a871f5362296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
30038da50f054f7ea2f26056278789dd

SHA1
ece66b3a804e433cd30f3e31d45b35d3bf08b605

SHA256
cc00decd69249ad88e17b88b5f757bf500c17e6309e1f4598b4effaeddda29c3

SHA512
17b7b1935697bb5d59e246f7733b898c4035e3f114fbeb3c391b1adc88a63baced61aa3481b2299cb69a9381b3304c259e4d112fdf947207ab3cb57574a29e44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1b1b14b461656aed3134ac413ff889e3

SHA1
155e408ee8e0a3d5fd58704c9fd0abeee7e1f7d0

SHA256
1fdaa6655539b22a4514d33cb1ec9834dc263ab3d1d8b1a5de9dac0f1d2a5016

SHA512
1707675878bbbe205f7d95b85bba933ea157b87e66d789f5f77f3b58543f8718901a0a1b9e4c865cdf33c793b1fcdfc624158f6810ac03d4f8d6562e0f02312a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6855a94e82c201c4c582ac47dea06fdf

SHA1
2b362ae9209947cb68c68f01be5b60759916e864

SHA256
e5679dffd9c9d241e3ae2c5cfb8686235e2eb10a7760e2ccf337f2e225fd0e44

SHA512
16530c65d781fab40a341dccb5711603f57be2725b57a50c2ac58c76280d951e2c749b36b22b575da095a230f14d4dda706e12abf39eb18396902ad3f3b18616

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 14076.crdownload

Filesize
5B

MD5
4842e206e4cfff2954901467ad54169e

SHA1
80c9820ff2efe8aa3d361df7011ae6eee35ec4f0

SHA256
2acab1228e8935d5dfdd1756b8a19698b6c8b786c90f87993ce9799a67a96e4e

SHA512
ff537b1808fcb03cfb52f768fbd7e7bd66baf6a8558ee5b8f2a02f629e021aa88a1df7a8750bae1f04f3b9d86da56f0bdcba2fdbc81d366da6c97eb76ecb6cba

Download Submit
C:\Users\Admin\Downloads\gsrsaovsslca2018

Filesize
5B

MD5
4842e206e4cfff2954901467ad54169e

SHA1
80c9820ff2efe8aa3d361df7011ae6eee35ec4f0

SHA256
2acab1228e8935d5dfdd1756b8a19698b6c8b786c90f87993ce9799a67a96e4e

SHA512
ff537b1808fcb03cfb52f768fbd7e7bd66baf6a8558ee5b8f2a02f629e021aa88a1df7a8750bae1f04f3b9d86da56f0bdcba2fdbc81d366da6c97eb76ecb6cba

Download Submit