b2e9bddb252989a3d23eaa78fe94638292ba1c98a3bd8f97cf955c4790a47a4c

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 15:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

039d48028913d8e292bb30581e5b47e0.exe
Size

461KB
MD5

039d48028913d8e292bb30581e5b47e0
SHA1

4d67fc8e3e449f1da732c4bcb9b70974f6e3fc2c
SHA256

b2e9bddb252989a3d23eaa78fe94638292ba1c98a3bd8f97cf955c4790a47a4c
SHA512

891d38eb20c1e537624e820f1f44bd499df22b2e449bd20465bfd2b76aacb81cb612bb625e1e8ad86024db045b2a91a73e1883340ff161f84a90493ce8b301d4
SSDEEP

12288:iPptoY05ee6U1gx/ewbQTSoKZjdijpcPnj:U4ee6U2/XbQYijpKj

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	039d48028913d8e292bb30581e5b47e0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	039d48028913d8e292bb30581e5b47e0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	039d48028913d8e292bb30581e5b47e0.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	039d48028913d8e292bb30581e5b47e0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	039d48028913d8e292bb30581e5b47e0.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
932	039d48028913d8e292bb30581e5b47e0.exe
932	039d48028913d8e292bb30581e5b47e0.exe
3972	msedge.exe
3972	msedge.exe
856	msedge.exe
856	msedge.exe
4672	identity_helper.exe
4672	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 4756	856	msedge.exe	104
PID 856 wrote to memory of 4756	856	msedge.exe	104
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 4180	856	msedge.exe	105
PID 856 wrote to memory of 3972	856	msedge.exe	106
PID 856 wrote to memory of 3972	856	msedge.exe	106
PID 856 wrote to memory of 1332	856	msedge.exe	107
PID 856 wrote to memory of 1332	856	msedge.exe	107
PID 856 wrote to memory of 1332	856	msedge.exe	107
PID 856 wrote to memory of 1332	856	msedge.exe	107
PID 856 wrote to memory of 1332	856	msedge.exe	107
PID 856 wrote to memory of 1332	856	msedge.exe	107
PID 856 wrote to memory of 1332	856	msedge.exe	107
PID 856 wrote to memory of 1332	856	msedge.exe	107
PID 856 wrote to memory of 1332	856	msedge.exe	107
PID 856 wrote to memory of 1332	856	msedge.exe	107
PID 856 wrote to memory of 1332	856	msedge.exe	107
PID 856 wrote to memory of 1332	856	msedge.exe	107
PID 856 wrote to memory of 1332	856	msedge.exe	107
PID 856 wrote to memory of 1332	856	msedge.exe	107
PID 856 wrote to memory of 1332	856	msedge.exe	107
PID 856 wrote to memory of 1332	856	msedge.exe	107
PID 856 wrote to memory of 1332	856	msedge.exe	107
PID 856 wrote to memory of 1332	856	msedge.exe	107
PID 856 wrote to memory of 1332	856	msedge.exe	107
PID 856 wrote to memory of 1332	856	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\039d48028913d8e292bb30581e5b47e0.exe
"C:\Users\Admin\AppData\Local\Temp\039d48028913d8e292bb30581e5b47e0.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://crusharcade.com/ca/thankyou?s=69TC0dS2x8rB1tDXwdLazvPAwcj%2Fx7vGxsaxxrXBsbPFwbawsv%2FFwsrPxsc%3D
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffef58346f8,0x7ffef5834708,0x7ffef5834718
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3769919107353557765,6183735156246039303,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,3769919107353557765,6183735156246039303,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,3769919107353557765,6183735156246039303,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3769919107353557765,6183735156246039303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3769919107353557765,6183735156246039303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3769919107353557765,6183735156246039303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3769919107353557765,6183735156246039303,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3769919107353557765,6183735156246039303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3769919107353557765,6183735156246039303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3769919107353557765,6183735156246039303,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3769919107353557765,6183735156246039303,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3769919107353557765,6183735156246039303,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
e99c729661d361cfdeccb76fb786aea4

SHA1
f91d515bd1fd8fbe2a4d274f8062af1d0bd23a8d

SHA256
ffab13b85532e329f80d61cef78d604e593cf8d409e5aa117e3b9b3c96926159

SHA512
4317e4bc797f0efca9ce3ab3bc404e35d965a8135e5efc17a5b92c7751c060998339640a0f66d5ad815d7c9ccd06d34cc8f6c22d092d3698fc13cfd283ec3241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
50bfdf6b3bd78e9409b462cfcf8248cf

SHA1
b8df211108f044d3e70dfe0925c817f78b6f77e9

SHA256
7d7f92ef05cd85e7ab300404608d235842334bdee26d88d0eedaee1037f38ef6

SHA512
e3898c89367501b807f8fcb3c8f46905f1f6d2ef43914829e693c64167a31a13a21eb9a9dea02358ef493df97a34869f37d4ee3ff04b08edfe05af8aeccf0f55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
0b047cf32aead9467c663356c71384d7

SHA1
0a4e3833042e2d457239908c31eb703f5a74dde4

SHA256
815d7b6c1a51a9be4732886985b9414e80126b442e104b19850a61a7c675e676

SHA512
981a8ea992cd6a67a9148a69f85a93d6136900818d3e16cf4baffa13a2744e46b1063b4511934efae1a9accfccbd900ff83635e9c15badb7644c51b76b222848

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7a5862a0ca86c0a4e8e0b30261858e1f

SHA1
ee490d28e155806d255e0f17be72509be750bf97

SHA256
92b4c004a9ec97ccf7a19955926982bac099f3b438cd46063bb9bf5ac7814a4b

SHA512
0089df12ed908b4925ba838e07128987afe1c9235097b62855122a03ca6d34d7c75fe4c30e68581c946b77252e7edf1dd66481e20c0a9cccd37e0a4fe4f0a6fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
4d6f4c80064a4fe9619f27eb240c4810

SHA1
54c1ec15c0a6abd840cf3c944d4004e378ca6b7d

SHA256
88cafdfdecf85592ad87131ef73f165087f37ed924c65c217da3378be64ec72c

SHA512
64e638472edca757326f1db90bc83d18b32e554e718518f210d5320fd9988ef21ee70159712593a7c573ee97a9ffc5205f65ff4b6909cbf9aa22c6c344f41439

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
921B

MD5
948d3dd2c98e64894b45b844694abd77

SHA1
46ffbd7fb0ffaa0d48df8f6d35c082d24b876af7

SHA256
42e4c5a9ea3cdd279e856505c2114c5db201f4a74bd19845e3ef8ac8698fc324

SHA512
3e04e7fb271fe3c43c57f5fc42bb9d9b4fcad92b64fd7dc9e9b1f2e90a0c4c38c7068dfa8f34d5d49a32439333be482fc435241f1de303b7b69b6e91a2a36e1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a1b14b468ad0373015122ed6086ff519

SHA1
ad3d14e3a4e83420cebf598690d13c98dd90f433

SHA256
9ad2dd460c4295abd6463357553fbafdfa44ca70ffbeae34ec37702c04866fb9

SHA512
a0847fa4df76c642e78efc3441f13a97dc7e3fba25b09eba2d14c1204c87c183d69d176e1a5225363ae741b5201a966526bccbfcd518a2ed1562524b600a6e9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c6dbbd12ff97d6cb97346ebedc236ef0

SHA1
84ade20d6932962abde61e00f585276670c42c84

SHA256
a6b25717ea01049192afcd7fc112205f9c31bb8ae2a51e02f4fe2f9d7d2d400b

SHA512
2e57f86776eb1c77f524d62b203eb4ddb05f9f95340fe3daf00b320187e0ccf4be7ea60e5831a30c3078ed268ecb57a8aa070dc3f795dad2ade9d839c0cc8d2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
52826cef6409f67b78148b75e442b5ea

SHA1
a675db110aae767f5910511751cc3992cddcc393

SHA256
98fc43994599573e7181c849e5865f23b4f05f85c1115dff53c58764d80373fb

SHA512
f18df18cab6b5ecd71b79c81a2a1fdac42cc9960f62f06ac25f4d6487792705f2766ee3a10239eaac940d090186e6bc820e4eb7a5ee138f6e5c1c64f951b960c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a43bbb5c1ed584ddd99d70665a917b15

SHA1
043b39b70ae42835ecf6363d3f7d3baeeaf21f13

SHA256
3b1203b51c6ef7304544908677d35d06f83b5e620ff3de18fdb42b914bd78ab0

SHA512
b13b09987bc64f58af9581347dd3057584fa8e5955d30fd9e24034014c34cf44bbac8c68861a30ea277e6bdfb9bba43b4267a1dd1ee9454b10fcc339ad31207c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ca735C.tmp.exe

Filesize
2KB

MD5
69adc7e447fc670ff847b4e4a357d4b1

SHA1
1362fd5e23751bde02de70a6135954e5d88d3e14

SHA256
9fb9b1d96a76f91d0dfc54e7280f5b4b9a574c7e05cf02396694fbbdc60abf0f

SHA512
b1f3171356bc2279516747021ec8660d1ceeb34fb04edcd00f0305292c77641e25edd950de102a69219a40a36cdb28064cec291576f389cf3198c719e8bd7b08

Download Submit