158c00a01d65620bbd4180f904415a3895e2f87ff6b7cff34ac364a87867fe84

Analysis

max time kernel
151s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d5537970469346a4cc5f6c70fdbc786.exe
Size

461KB
MD5

0d5537970469346a4cc5f6c70fdbc786
SHA1

9cb3b3ae1060376504dfb1cacd1d16d9181060b6
SHA256

158c00a01d65620bbd4180f904415a3895e2f87ff6b7cff34ac364a87867fe84
SHA512

0b21c583a9143b157678f32986fa7db1af90a965360c73cb01e1879a8430017c0c52dd8551f0ffdb1ba38f0da12c76148ce4932a38684855e01f08a746d0f40c
SSDEEP

12288:iPptoY05ee6U1gx/ewbQTSoKZjd9jpcPn5:U4ee6U2/XbQY9jpG5

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	0d5537970469346a4cc5f6c70fdbc786.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	0d5537970469346a4cc5f6c70fdbc786.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	0d5537970469346a4cc5f6c70fdbc786.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	0d5537970469346a4cc5f6c70fdbc786.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	0d5537970469346a4cc5f6c70fdbc786.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1620	0d5537970469346a4cc5f6c70fdbc786.exe
1620	0d5537970469346a4cc5f6c70fdbc786.exe
3580	msedge.exe
3580	msedge.exe
3608	msedge.exe
3608	msedge.exe
3744	identity_helper.exe
3744	identity_helper.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 1996	3608	msedge.exe	100
PID 3608 wrote to memory of 1996	3608	msedge.exe	100
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 1212	3608	msedge.exe	101
PID 3608 wrote to memory of 3580	3608	msedge.exe	102
PID 3608 wrote to memory of 3580	3608	msedge.exe	102
PID 3608 wrote to memory of 2764	3608	msedge.exe	103
PID 3608 wrote to memory of 2764	3608	msedge.exe	103
PID 3608 wrote to memory of 2764	3608	msedge.exe	103
PID 3608 wrote to memory of 2764	3608	msedge.exe	103
PID 3608 wrote to memory of 2764	3608	msedge.exe	103
PID 3608 wrote to memory of 2764	3608	msedge.exe	103
PID 3608 wrote to memory of 2764	3608	msedge.exe	103
PID 3608 wrote to memory of 2764	3608	msedge.exe	103
PID 3608 wrote to memory of 2764	3608	msedge.exe	103
PID 3608 wrote to memory of 2764	3608	msedge.exe	103
PID 3608 wrote to memory of 2764	3608	msedge.exe	103
PID 3608 wrote to memory of 2764	3608	msedge.exe	103
PID 3608 wrote to memory of 2764	3608	msedge.exe	103
PID 3608 wrote to memory of 2764	3608	msedge.exe	103
PID 3608 wrote to memory of 2764	3608	msedge.exe	103
PID 3608 wrote to memory of 2764	3608	msedge.exe	103
PID 3608 wrote to memory of 2764	3608	msedge.exe	103
PID 3608 wrote to memory of 2764	3608	msedge.exe	103
PID 3608 wrote to memory of 2764	3608	msedge.exe	103
PID 3608 wrote to memory of 2764	3608	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\0d5537970469346a4cc5f6c70fdbc786.exe
"C:\Users\Admin\AppData\Local\Temp\0d5537970469346a4cc5f6c70fdbc786.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:1620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://crusharcade.com/ca/thankyou?s=6%2BXC1%2Fa77ebk5u%2F64uG3yfbAwdD%2FxsG6wbHCwbq2wbrGusLG%2F8XCys%2FGxw%3D%3D
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe36c746f8,0x7ffe36c74708,0x7ffe36c74718
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13064848957316425753,15435467572539656918,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,13064848957316425753,15435467572539656918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,13064848957316425753,15435467572539656918,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13064848957316425753,15435467572539656918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13064848957316425753,15435467572539656918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13064848957316425753,15435467572539656918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13064848957316425753,15435467572539656918,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13064848957316425753,15435467572539656918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,13064848957316425753,15435467572539656918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4192 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,13064848957316425753,15435467572539656918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13064848957316425753,15435467572539656918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13064848957316425753,15435467572539656918,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13064848957316425753,15435467572539656918,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4748 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
3c4792ead59fe6538329c1a375de28c1

SHA1
041fcd353eb1830a08e060606b72c61a2ee434e7

SHA256
1f673e580daa5b0943520e86a6dc96d672aa637cc34f90172a8dd7391f637cbc

SHA512
61f6b03ac30a600d955cfdcc51406edcfe1a6416023a6fcf50c7e0f73093a84bdc42059e9e8b5ccf7284897580a1cb00a2f578eaf9ac35aa38ae8ae917c22e40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
74aa2be8d61a3dfe93ec165f5f1b123f

SHA1
faafedc9b0741122744158f23f302b03073e4276

SHA256
e7d5317ba86fc441f65c96fa6e53a0d244c194c8c55d438a1f18842ac7a5bc74

SHA512
df49d38a2f16c6ee08c56d6ee4c9fc0df1c651c4f0c48acb18b3546e116b532498c2a39b2f19c2463ba6b403d1611b8ca58c869e5c7f212562114907996dc609

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
97007fa720e142dd1add2eac3c8745d0

SHA1
006cf3fa06e3e15d7e1f70a14abe9e6b6c20cc57

SHA256
35121468688d7e5b0d3351278a71896d45550ac45affb7f005eb283b11c1f004

SHA512
9cd6c953d376abed5c7369a4908d022dfb7adbd52323fb3d536452d3640a124e21fae3f1672e5c21fd105bf474d931d70b4178af0e9687837e722e7d97399f31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7a5862a0ca86c0a4e8e0b30261858e1f

SHA1
ee490d28e155806d255e0f17be72509be750bf97

SHA256
92b4c004a9ec97ccf7a19955926982bac099f3b438cd46063bb9bf5ac7814a4b

SHA512
0089df12ed908b4925ba838e07128987afe1c9235097b62855122a03ca6d34d7c75fe4c30e68581c946b77252e7edf1dd66481e20c0a9cccd37e0a4fe4f0a6fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
3bcef3e8c89cb0ba4688730002ea841d

SHA1
4181fbd0a9d941d6e1365cd4735f7b9cae07a2bc

SHA256
c29d24b31d9458d1112f5a58a9cf2f4517c82a5840557ff25939cd4c3ca5616d

SHA512
df0a2d8d0f8549cffab5f8b42650275cc6f69364cf3e696320666b02ffff9fbb22ba29df16dedca3825af54b217eaafaced7e8037d69f4cdc33d3758d6dce4c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
921B

MD5
17d7c897536bc1b987ec2a4b68de2b86

SHA1
eb9a5f3b01a1f0d0e60d0e0561f248559e4af327

SHA256
b85c31e0c056a32b64764a970ba22b8e14edca6bad6e8b5463b63d8755545d49

SHA512
4dbd2106a0be5a5cdf29ff05650decad0d67a38d0c2a2634f97edb432aef842ad24d3f5cc06e9ad3291ef24bc3440186051815c3b95a1d02f536a2d6442161b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d7c15eaeaaec8f309a6450498dfa1e8b

SHA1
368163771d248f25030966d75dcd1b10f8ee8ab9

SHA256
1f03ba472eccb9681c12bbed097584b405df5167e50a31513f4926dffe2adec6

SHA512
716287e38e82ee582d3eb48e1318636000a23fa1b5c69d2481d16a0e028baddb5ca77d2d09d1fd4e7c7524b0a0e2960e4937cd8eee4b2cd0380aafccc5d1024b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fb3076380da925c76914e67c0c061f52

SHA1
7b74913ecf5302dfc2a3e7dafa04b9ea169c47d8

SHA256
b5febfbb0650f1f52ec13be6b11c629bfb583a7cc2f02befdb32c70daaae791b

SHA512
0c09763ec64c60445e6383562ae9c1ddef34f65616acae484ec0b468d6d4820d595f112a51575c7b2359a988ec6fd2d55e3b74e327ceda53eb4ad0b605d6c483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
52826cef6409f67b78148b75e442b5ea

SHA1
a675db110aae767f5910511751cc3992cddcc393

SHA256
98fc43994599573e7181c849e5865f23b4f05f85c1115dff53c58764d80373fb

SHA512
f18df18cab6b5ecd71b79c81a2a1fdac42cc9960f62f06ac25f4d6487792705f2766ee3a10239eaac940d090186e6bc820e4eb7a5ee138f6e5c1c64f951b960c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4038fcc1fa51d6e1ea9f63432d333f34

SHA1
89a7bfe2b79a66012b2966345bede1988ad7e6f2

SHA256
f8977eb558ed4d62b512fe8cc402f616c578d18fca9a43e9be277db05d322ad9

SHA512
843ee3ed747fba6c9f7385b27e982d62496ffcf3eaf79c7412d909713dbc12f7966f307993678821d9ee0c654661c336dd19356030e562d898aa047cde69d2da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
29b7e55a668a46b25efdb42a96d12820

SHA1
2e0a30d0101d7c386ff9b6dfe1b633055e512aeb

SHA256
2a3c6f63d64f63bc8f8243122ad04e58c35a9adc25264128db1f424d43ee3a5a

SHA512
45861b6b25f58794f24a260f94e27cae9eee0ff26a3f0ec25072c1e8683b0050031b37c5231ed2db04f4aee062d9a75db23e95b40d497e70aaeb775d3a438a60

Download Submit
C:\Users\Admin\AppData\Local\Temp\ca9432.tmp.exe

Filesize
2KB

MD5
69adc7e447fc670ff847b4e4a357d4b1

SHA1
1362fd5e23751bde02de70a6135954e5d88d3e14

SHA256
9fb9b1d96a76f91d0dfc54e7280f5b4b9a574c7e05cf02396694fbbdc60abf0f

SHA512
b1f3171356bc2279516747021ec8660d1ceeb34fb04edcd00f0305292c77641e25edd950de102a69219a40a36cdb28064cec291576f389cf3198c719e8bd7b08

Download Submit