719ce6fa8d023a0ecccf4c2caeda8961debacf6d23444f76e7c9a50274bcd33e

Resubmissions

21/05/2024, 11:02

240521-m5dmeabb56 7

21/05/2024, 11:01

240521-m4sd6sbb38 3

21/05/2024, 10:58

240521-m25xgsba9t 7

Analysis

max time kernel
81s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 10:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ZoomInfoContactContributor.exe
Size

259KB
MD5

1c0674970e55ff28e3d6d4b9fc435f39
SHA1

e33df0cd1ead927fb3ad769ff311e5598c533da2
SHA256

be790b55b11f6502be0c8cf14f2ab4f9e97debe7e07efde26cf24f3927d791db
SHA512

d7118c1d4df00ba69ac69a8d8907a93122e7414c127280250d1e8dcf5603c762923fc19e26c770b5dcecec306fe1559bb1ea813cdcfadc0031ca72ae29c5b74f
SSDEEP

3072:6gXdZt9P6D3XJazx7Op5KmEOm9Ek1ydrZeDAf1OnV8AHzsFypc9U:6e348t7uUmq9EnvAH4F8uU

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 19 IoCs

pid	Process
1492	ZoomInfoContactContributor.exe
1492	ZoomInfoContactContributor.exe
1492	ZoomInfoContactContributor.exe
1492	ZoomInfoContactContributor.exe
1492	ZoomInfoContactContributor.exe
1492	ZoomInfoContactContributor.exe
1492	ZoomInfoContactContributor.exe
1492	ZoomInfoContactContributor.exe
1492	ZoomInfoContactContributor.exe
1492	ZoomInfoContactContributor.exe
1492	ZoomInfoContactContributor.exe
1492	ZoomInfoContactContributor.exe
1492	ZoomInfoContactContributor.exe
1492	ZoomInfoContactContributor.exe
1492	ZoomInfoContactContributor.exe
1492	ZoomInfoContactContributor.exe
1492	ZoomInfoContactContributor.exe
1492	ZoomInfoContactContributor.exe
1492	ZoomInfoContactContributor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
1720	msedge.exe
1720	msedge.exe
2560	identity_helper.exe
2560	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1720	1492	ZoomInfoContactContributor.exe	92
PID 1492 wrote to memory of 1720	1492	ZoomInfoContactContributor.exe	92
PID 1720 wrote to memory of 3316	1720	msedge.exe	93
PID 1720 wrote to memory of 3316	1720	msedge.exe	93
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1688	1720	msedge.exe	94
PID 1720 wrote to memory of 1640	1720	msedge.exe	95
PID 1720 wrote to memory of 1640	1720	msedge.exe	95
PID 1720 wrote to memory of 640	1720	msedge.exe	96
PID 1720 wrote to memory of 640	1720	msedge.exe	96
PID 1720 wrote to memory of 640	1720	msedge.exe	96
PID 1720 wrote to memory of 640	1720	msedge.exe	96
PID 1720 wrote to memory of 640	1720	msedge.exe	96
PID 1720 wrote to memory of 640	1720	msedge.exe	96
PID 1720 wrote to memory of 640	1720	msedge.exe	96
PID 1720 wrote to memory of 640	1720	msedge.exe	96
PID 1720 wrote to memory of 640	1720	msedge.exe	96
PID 1720 wrote to memory of 640	1720	msedge.exe	96
PID 1720 wrote to memory of 640	1720	msedge.exe	96
PID 1720 wrote to memory of 640	1720	msedge.exe	96
PID 1720 wrote to memory of 640	1720	msedge.exe	96
PID 1720 wrote to memory of 640	1720	msedge.exe	96
PID 1720 wrote to memory of 640	1720	msedge.exe	96
PID 1720 wrote to memory of 640	1720	msedge.exe	96
PID 1720 wrote to memory of 640	1720	msedge.exe	96
PID 1720 wrote to memory of 640	1720	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\ZoomInfoContactContributor.exe
"C:\Users\Admin\AppData\Local\Temp\ZoomInfoContactContributor.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cswapper.freshcontacts.com/client/installfailure?client_version=62&failure_point=DetermineOutlookCompatibility&os_version=Windows 6.2 9200 64 [ ]&outlook_version=none&outlook_bitness=none&client_id={305EE58B-C681-4A42-B99D-B954E8711E97}&error_message=&reachout=true&appid=4
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xd8,0x110,0x7ffe97d846f8,0x7ffe97d84708,0x7ffe97d84718
    3⤵
    PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,7444669314983007927,13435703988371914637,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,7444669314983007927,13435703988371914637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,7444669314983007927,13435703988371914637,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
    3⤵
    PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7444669314983007927,13435703988371914637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:2648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7444669314983007927,13435703988371914637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2196 /prefetch:1
    3⤵
    PID:728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7444669314983007927,13435703988371914637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
    3⤵
    PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,7444669314983007927,13435703988371914637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
    3⤵
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,7444669314983007927,13435703988371914637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7444669314983007927,13435703988371914637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
    3⤵
    PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7444669314983007927,13435703988371914637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7444669314983007927,13435703988371914637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4396 /prefetch:1
    3⤵
    PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7444669314983007927,13435703988371914637,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
    3⤵
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7444669314983007927,13435703988371914637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
    3⤵
    PID:5492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7444669314983007927,13435703988371914637,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:5500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1932

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1d6f6854-be8a-49da-8bf8-c6384c303f73.tmp

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
f45c6a0b908496771f184378209c9a64

SHA1
8a0854aa304dafd71320beafad2d413c8b874728

SHA256
438cdce843265c22bb4ef0fbf29a00e264a71c008838b1f80c54ac0fe2bff120

SHA512
d9a8c6f238de140bf81053d80e528476676a45a134785f9921207168d817c70a7293fa36b19ab998397ec683f240f4c82b7ed17ffb1bbd345eaff4e8f725884b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
d79888b26c09c1941c36d75c1424f683

SHA1
2d2cbbebe9a02607b98033e8b3be039da0b06cab

SHA256
f949ce82b2ea5a7c1cff675bc4586a62393c900e57630dbbb3568e9393a1fd74

SHA512
39e04d6a71e3016a553d95e2e600bb92f644566716998b477de3fc12d97f788bca4b2cb8dc107391fe32c68cec36637c0c27091b3e115e1eb613b83ae4b2f7c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
a884fa644d6492cb98f38cd5e1319db6

SHA1
e0bb89dba58532c01931d536d7a802afe75ab119

SHA256
94ef1010204173f9f51dceba7bcd74d3837c6da9a5015d5d59253c2a2cb7ffbd

SHA512
e27ae8394d252516dd284c034ce6dd850d751aee357a2c4f1bb932a6a12f6c71efd3df8bd3f05fabf560af89ceb5b7af42c3895d2dfa87ad3ee4af2c4afebb44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1fddcb3f0718d83371363c04085c9ef7

SHA1
ea1b2fe4502706c40fa2674fc2352752b986baa3

SHA256
877b13e29cf97f9a289323de24cc840debab74d8382e1f62b636a76d7ce245a6

SHA512
108c987eb352dffcd445b20825a5974d715020a938741f85ce0e2297c024faa9d738f6ba2d5ef304ec17d49dbbd7bb0e7f39651110ae28e500cdf187712decc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e609934c5d44741e03945e9141313269

SHA1
f6dd421efbd435b9dd4ccc4ba5795a6a8f5b16de

SHA256
9a8e22881fdb6d1f1743c669b9cc1359e8ff1e01113a8d45a1baa626de990c44

SHA512
c19faf71b6d1def850d2acdd5034ff39088ab0c060f2aa511675a942a1f0af607c33b67447a05fef14fe1e30ecb0eb891247f6efda7f75d4565b78b7c18176eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3ad1a1d60a2a30d658afe31636af3cb5

SHA1
50fba45f68094eb848e82dbd840d3563c7cd649e

SHA256
2cf996fddfa2ff371669fa09c935f2191eb056dad57a4578fec6c906be5846b1

SHA512
22bb35f66d4b8d266d51edc1cc0851fdacac0c6b610d37e78c145e6d24081b501d3aec0d8276f707248a5994c1e7d95bf98aa91fbde568ef32c701678ab28784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
14a87c9c57db56df0c943562c619762e

SHA1
98423c491c9e1bddb4f5beb04a54098807199fd6

SHA256
63e66cb6dbb147e11cdabf68f0ce142178a84be50cfeda7a9936df5d46683124

SHA512
5133a77b9a4e74b2d4c5d418978123a26fdfcb57c335be71ce08c7f0707a304dea70a631e6a96d729683e6bc13818f9e2f0c6a8823246d807e2b0843d69d384e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
41f6e3cf4317b5cdd99641a2078e9752

SHA1
a20b2b4e5f6b73fe6880f6c4a32fcca505166112

SHA256
40f29efbde085077aa2ee32588d8ad1c16113daba75789cf6094e2a1413fe5ae

SHA512
f21fc67993445fc974bcfdecfccd274d6ca259cbebea3a4deea67e48fd05ed162ee1b7b71d799e9ab5eada21548d73e3cfe85e7a07d1d61d241723c32d721597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
008e6788b1c59976237ca39182a24096

SHA1
cbf39b2a6de6dd64701ae0fe4526522c85cc564e

SHA256
d60e39c78df917ee165b6038e1055e5e710de727026b1837bd2f367cf2e7c5b6

SHA512
e6f43ff1895a823bf11f821afd43a425bb077d31296dab02e3b650f226c68fe1187f2eafb3c6d4523bbd219ebccee65d05118301fab5416583c7e3cf1611f01b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cd14.TMP

Filesize
2KB

MD5
b1488fb00820c62351991b1872b66d2c

SHA1
3d44e6bd9e46a72c57a4efabd6faa1f1809e89f7

SHA256
9e598fc6e979306ef763fe3288bde4836331a6df355f3be103663a655c73a00c

SHA512
3b798825d860d274c9b6913668f47da6759a4be573b0d63bfcd06490805007a6f1510a5f0ab9f2a279af20e57f811ab1ccdc258da2da7f201e7fa8eb686a59b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
78b268ef2e63bef3e2fd537155474eb0

SHA1
9bee93dd8e2a245cadb7a450e5b4e547c50a3eaa

SHA256
20245a1e950a70027ab458387e2ab27e8c9355f1dd33cd56cc9e58568ef92cdb

SHA512
7dd1f9f0b601027d134f172c3833228a4c18c28320f3ad34c2fc4d986762e4d035db5c62e976bbf62417ace7b627b21470b62b90324340d69279e526352c88c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7f2bbd8e945da2b5d7c1fa0e2e8637b1

SHA1
edc573966967beaa84979d404ad64676ff188def

SHA256
f1ee9673755b74fe17c34949eb2e1de5bcdb25be998e902a8868fa10b010bffa

SHA512
22185b8639399113fe0113d368fe74ad7741a8623ea225cced77e463b47279ca4bc32f80394e19a13689be98a34c9f988fd7ab678630598d94e7860ae0dd0246

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5777.tmp\GetVersion.dll

Filesize
5KB

MD5
2e2412281a205ed8d53aafb3ef770a2d

SHA1
3cae4138e8226866236cf34f8fb00dafb0954d97

SHA256
db09adb6e17b6a0b31823802431ff5209018ee8c77a193ac8077e42e5f15fb00

SHA512
6d57249b7e02e1dfed2e297ec35fb375ecf3abc893d68694f4fa5f2e82ec68c129af9cc5ce3dd4025147309c0832a2847b69334138f3d29c5572ff4e1b16f219

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5777.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5777.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit