cryptolocker | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker[.]exe

Analysis

max time kernel
84s
max time network
78s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
05-02-2024 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe

Score

10^/10

cryptolocker persistence ransomware

Malware Config

Signatures

CryptoLocker
Ransomware family with multiple variants.
ransomware cryptolocker
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
4944	CryptoLocker.exe
4772	{34184A33-0407-212E-3320-09040709E2C2}.exe
4152	{34184A33-0407-212E-3320-09040709E2C2}.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000\Software\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe"	{34184A33-0407-212E-3320-09040709E2C2}.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
31	raw.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 604883.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe\:SmartScreen:$DATA	CryptoLocker.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4128	msedge.exe
4128	msedge.exe
1500	msedge.exe
1500	msedge.exe
1380	identity_helper.exe
1380	identity_helper.exe
2452	msedge.exe
2452	msedge.exe
1580	msedge.exe
1580	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4592	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 3208	1500	msedge.exe	76
PID 1500 wrote to memory of 3208	1500	msedge.exe	76
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 3932	1500	msedge.exe	77
PID 1500 wrote to memory of 4128	1500	msedge.exe	79
PID 1500 wrote to memory of 4128	1500	msedge.exe	79
PID 1500 wrote to memory of 4788	1500	msedge.exe	78
PID 1500 wrote to memory of 4788	1500	msedge.exe	78
PID 1500 wrote to memory of 4788	1500	msedge.exe	78
PID 1500 wrote to memory of 4788	1500	msedge.exe	78
PID 1500 wrote to memory of 4788	1500	msedge.exe	78
PID 1500 wrote to memory of 4788	1500	msedge.exe	78
PID 1500 wrote to memory of 4788	1500	msedge.exe	78
PID 1500 wrote to memory of 4788	1500	msedge.exe	78
PID 1500 wrote to memory of 4788	1500	msedge.exe	78
PID 1500 wrote to memory of 4788	1500	msedge.exe	78
PID 1500 wrote to memory of 4788	1500	msedge.exe	78
PID 1500 wrote to memory of 4788	1500	msedge.exe	78
PID 1500 wrote to memory of 4788	1500	msedge.exe	78
PID 1500 wrote to memory of 4788	1500	msedge.exe	78
PID 1500 wrote to memory of 4788	1500	msedge.exe	78
PID 1500 wrote to memory of 4788	1500	msedge.exe	78
PID 1500 wrote to memory of 4788	1500	msedge.exe	78
PID 1500 wrote to memory of 4788	1500	msedge.exe	78
PID 1500 wrote to memory of 4788	1500	msedge.exe	78
PID 1500 wrote to memory of 4788	1500	msedge.exe	78

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8aa773cb8,0x7ff8aa773cc8,0x7ff8aa773cd8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,17763438286004790423,5124383214379401442,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,17763438286004790423,5124383214379401442,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,17763438286004790423,5124383214379401442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,17763438286004790423,5124383214379401442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,17763438286004790423,5124383214379401442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,17763438286004790423,5124383214379401442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,17763438286004790423,5124383214379401442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,17763438286004790423,5124383214379401442,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,17763438286004790423,5124383214379401442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,17763438286004790423,5124383214379401442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,17763438286004790423,5124383214379401442,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,17763438286004790423,5124383214379401442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1700 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1892,17763438286004790423,5124383214379401442,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,17763438286004790423,5124383214379401442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,17763438286004790423,5124383214379401442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1580
- C:\Users\Admin\Downloads\CryptoLocker.exe
  "C:\Users\Admin\Downloads\CryptoLocker.exe"
  2⤵
  - Executes dropped EXE
  - NTFS ADS
  PID:4944
- - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
    "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\CryptoLocker.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:4772
  - - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
      "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000234
      4⤵
      Executes dropped EXE
      PID:4152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:936

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5cabc17286e25c0ade7a7f050b6e92a6

SHA1
c25ab09177ad0da9ee6caf78310236bdc2cba319

SHA256
0e75f9140c154297d8f741aea07b90fc1be1b8deb79c3f204148471800e322b6

SHA512
0cc35eda0168f51e5e719ba0bfb226c9f5293a6056d47190a23377deb98244f42c62b8416696cdd13b2db6228c1c8a2513cdf6dbb1d4b59f0c1c889d1acee6e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ee0024c759da9e58ac88bcd6d467fcff

SHA1
cfdfd7653786700039d0f13b66d3894d53f485f8

SHA256
89a121cbcd09a68f38345b418b9909a16e1037cabd836a67ee529bee640507a7

SHA512
fd6e9f86962648db97f6fd6a333e472d1c5e18ef8dd9e1cf24a386268a784e4dad1689834fa44cae07a61f13efc20852cd33f3bd18ff1fa315dcdc9006a04dfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
a7d1701142cca705f833d70023ef4e1e

SHA1
1b76853132abfcddb4fefac42bf9df5d013c9815

SHA256
6c92f51e7f056e73c407228fc280cb7ca4d00ab02674d1dda4eafd7dc9f070f7

SHA512
806b7ccb375cc6116e64a9fa15229d783615d13b54cf40251561d9b664f0925915c5375ad88f5ca8d061e01367de239c29da79adf693559af53eeb7d9b1ba1a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
afdf9bb938ead50423f8e450e94f1ed3

SHA1
6a66161dd39848f2176a725a828de4bd6edcd5f4

SHA256
ff6d621ba804e5907c3cf00402dd70857fc61ac4af4f34781e9853ae24e32fef

SHA512
ac859d5876781b7c2d5263c99820414115eaa9b610bd3c3abdcf7efe417b8d7493a496eaf7a6da7aad030da5638effbcb75fa6871e362c2e289c31ba62a230ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
04514d36ded58d0748d89e8618a16b27

SHA1
a56c7ef3dadfda27cef0f94d8462083f06ba4581

SHA256
b1cac71e2b53c7a0bcbcb2e8999e9409aac9f12d66247eea6544b282f7a15746

SHA512
7e91074d7533ba52af249a51c0d2cd494e37706fd0308f1848d6ea7812b6140aca68bbea29104ee6e6a81fb40bc8f945ad8421c826f31c5377e308b52a73f356

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
90c17072baae733c3bfff26e7014eb88

SHA1
75e3cd418309b57a084074eb85de5553d5a65f2b

SHA256
998fe6926a473eb8d348fb6eb9cc0685114b3fd93782b726680806e726e3555a

SHA512
d0556e5ccfee3932eec9f1d04e3bd74a91d36176ad284fd0d1474a27118db00385eceaa15c008777681aebb55bf9fab6e1a7bcfd92f3ee5726db55d89d65c606

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
68fe6f34e7d6603a3d2f4c95919f8408

SHA1
c7be30582f94d46f05338cc39726f72c9e2fa4cf

SHA256
8cba909149b2d3fc45315cf63cdb8fbe42a4b7c614347171ba00aaf859639c1a

SHA512
48eac2f55675b01ebeb28680ed9af6dcb9c558f76fd647cf05f8a7e1fa04ee57f7a8c70bc0ea882bdbca48b29d62ea7af74b76a03b09c19762e4c93118929be1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
901f3dbc032d2dbafe2e9a133a9e745d

SHA1
308f833d4f2d1aaea94809f00e3538cd15aaa907

SHA256
09d05c480b088508e1c51f7265d006a01364e311f32a8fd344dc07ab1008651c

SHA512
362ed6a57a25c44ab46af3abce9cd461fcfae3649f13190238a29429d67f2b9c67abb57863e27c100ad74a0798e004bbec79ee195d491329f1a5a348c36de6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e8adee2eb8f13f7d9e9993aec38082c5

SHA1
1bc386d80664353b4ebada642baadb111f9e1ed9

SHA256
5f13694a8511420ff82351c34f724761529dc25bddbb2246725fddccbeee171c

SHA512
e18da05aff31ad4849aca74184de65f91274421aad96d9ba209273a94ba00b19d4c20a4cfa884c89b0ea7ea63e361e84e5eb2bc1a89c739ef0e11018439511ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cda0.TMP

Filesize
874B

MD5
02d2fbe4b7999e127faab0af676bc784

SHA1
5f0cff222bfdbb3dbba4156cb863a955772464a5

SHA256
bed5e51c2cae87a1c149052e980f14206a6814041cc8908bd02a209fc940ad1f

SHA512
5b96161ddb013f07754d58c935f6d393ce85c9cb1679290255a2c67e2903b2e81068aad187d197d6d3a60bd4b006b2507b280e83f9bef65443fa57c89a4b144e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
de164212d0c620774cce28f62fedb66c

SHA1
a51fce2ce4a17aef11509a8b5cfe4fcf710eaff8

SHA256
ffc1aba0774ee7b8e3a494436ff4207b7c6bdafd65418b6c4596c4d3b12dbfe1

SHA512
a0a478ba9f9b2c77eaa160ec964e379dd43937cdac6e1b17ee8be99e69ff8b4868c8e0efa7d689f2e448f5e8d0283a63a09c32a7d0ca66d02150a51136194984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4769dc2a93086e788edd8b41721da02a

SHA1
0db39e4a895cd008677d9363e681c2d7919361c2

SHA256
77de1e312d8541e0082e2e47940576856a2a31f19bb71420a045be8873e9d754

SHA512
277437b7f302091bd3e9374877b401b16109a20060012e336d820888f4382c89b0015bbfd3e5f612a589c84a8ebb4dc37b464436c333795dfb8a6dd5ee270c17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f99dbf244b98026d2df25744de38d517

SHA1
0315163e93adac743f2aa46a0b48f8b2e7707947

SHA256
168425ca59ff2b4de37c3fef75646dbc71986bdd7fcc857913dc3e5de7d34768

SHA512
600176a1d3184eb8f225f08cf96d7694aee294325b851c410812a597387da17a15fd4d65e889078d06bf1a2958965db81ec7de3a67cb49f483484044802e3067

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
11KB

MD5
9525ed790aaa25e346ee37d85fd2607c

SHA1
02db19a5bd9119cb90329f438c287cda89b2d032

SHA256
f48431cb6a0247a5019286176ed5fc3db474a95b119b96ea4c5b1295747e3e75

SHA512
6bb92cbc68468f106f542485aadfcceb6bdbe6bc8b12782fdb83bdca290bc72e0c1c3b0cc657893365e5b02494884002c858e1f8114208e6b317f623172be7e9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 604883.crdownload

Filesize
338KB

MD5
04fb36199787f2e3e2135611a38321eb

SHA1
65559245709fe98052eb284577f1fd61c01ad20d

SHA256
d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9

SHA512
533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444

Download Submit