1846a6270fbbb0fc3fd55788699ac1acc3cb6b339bd8ad004ddbf32dd41e6fd2

Resubmissions

23/08/2024, 18:50

240823-xhew3azhjb 10

23/08/2024, 18:47

240823-xfkpjazgja 8

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

that_is_lgrachov.jpeg
Size

27KB
MD5

f085fe12d8ebb8b7783f6d734e9bac29
SHA1

35cc62e74855c6e3235715fbda3fac4951d421a6
SHA256

1846a6270fbbb0fc3fd55788699ac1acc3cb6b339bd8ad004ddbf32dd41e6fd2
SHA512

b8a138236eeb09fca969f88d7034d8c1ac0b93b58b71ce25a19c6b8174cd0e46ff6bbca8e6603cd6bf3228bd100d2d2fa8f3ab13696687fb6e200de739af73ec
SSDEEP

768:iIPPEs/U7nXOU5tZJIyW1crMvPxHvedPvHG3:iURqXOoKgYvpenHG3

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
133	raw.githubusercontent.com
134	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2718105630-359604950-2820636825-1000\{B4FAA6F7-EE36-4207-BF8E-8B1E0580101E}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 49097.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3376	msedge.exe
3376	msedge.exe
4520	identity_helper.exe
4520	identity_helper.exe
4492	msedge.exe
4492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 4292	3376	msedge.exe	112
PID 3376 wrote to memory of 4292	3376	msedge.exe	112
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 4500	3376	msedge.exe	113
PID 3376 wrote to memory of 3576	3376	msedge.exe	114
PID 3376 wrote to memory of 3576	3376	msedge.exe	114
PID 3376 wrote to memory of 956	3376	msedge.exe	115
PID 3376 wrote to memory of 956	3376	msedge.exe	115
PID 3376 wrote to memory of 956	3376	msedge.exe	115
PID 3376 wrote to memory of 956	3376	msedge.exe	115
PID 3376 wrote to memory of 956	3376	msedge.exe	115
PID 3376 wrote to memory of 956	3376	msedge.exe	115
PID 3376 wrote to memory of 956	3376	msedge.exe	115
PID 3376 wrote to memory of 956	3376	msedge.exe	115
PID 3376 wrote to memory of 956	3376	msedge.exe	115
PID 3376 wrote to memory of 956	3376	msedge.exe	115
PID 3376 wrote to memory of 956	3376	msedge.exe	115
PID 3376 wrote to memory of 956	3376	msedge.exe	115
PID 3376 wrote to memory of 956	3376	msedge.exe	115
PID 3376 wrote to memory of 956	3376	msedge.exe	115
PID 3376 wrote to memory of 956	3376	msedge.exe	115
PID 3376 wrote to memory of 956	3376	msedge.exe	115
PID 3376 wrote to memory of 956	3376	msedge.exe	115
PID 3376 wrote to memory of 956	3376	msedge.exe	115
PID 3376 wrote to memory of 956	3376	msedge.exe	115
PID 3376 wrote to memory of 956	3376	msedge.exe	115

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\that_is_lgrachov.jpeg
1⤵
PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffabd946f8,0x7fffabd94708,0x7fffabd94718
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2008 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3400 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2696 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2024,6430387111178915139,12737157445205251305,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  PID:1696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
96a363f3be29a18fe5c248a50448be5f

SHA1
e63ad2e0961e5c608d649174d51ddce5fd9b10dc

SHA256
8fe5940a803f7424f77c1ee466c7c8aa78624111dd8caa53f4105e82eb5cc335

SHA512
0cbad5179538c25cfafd9c52bd33f5443e3a25ec57ad4641df558a35807f7015e25223c55e2854b5e4b3b9ba42a69cf6392bf2c0d002a0dab698e23f2ee1fb14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ef2fa39f7dda1a0a9b4b7a26a45e44f5

SHA1
be1b8b73e2d91117815ca47e7b22172b3e6babae

SHA256
80eb0cf69bcb7093eded2693fc649d887aa3e1b08839808d29a07eeaf0fc3cf0

SHA512
93cca965aaf1a7ca85a0c491143fba84f114144c846702e1fc572680e3d940c85b98c06d8acaa15f23edc96dfabe664ec8a0a229fd78aa8fd07de2fb7e357890

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f0a3127867ca74410b54535c5ed11917

SHA1
f16c6268014598524b421c53e4a787dddd0abcfa

SHA256
e43add1316037446078afc0b242ad226d730f74cdf28df8defd158ed1c435312

SHA512
3b3b29d0c119324a70df51b75f2bd4f59dcb7ad6c7ade41d7bf22a0af9ffe25419a9e8225aca94d53b2f112ca7c767476adffd6dde680a01b51c31f2857a509f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
52846464f88836cab0e87b11b00eb25a

SHA1
24879eba1c53ff34024e6f601760b253950e684e

SHA256
1f3ce07480fccfe06bd8dd8b0d5fa55af4881a4e977d64f0593b08183bdfe913

SHA512
6226b34129f58851d7cc10303051ff859fddefbbbd51bc56482c7398856d6f831bd0b4cd5b873e5ed0e22b5f832521d60d1b6e1e16aa17e54849edfe4d4b577f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ba19f047debf94763ba969a2b81ab083

SHA1
26fcce896797de9fe8a00e57b5185944ad05b28a

SHA256
c1da2a01a875c515f0bb41b0aa587141fd3d7062495a4f390729aff8d409aacd

SHA512
adb0ce0dd8ed236f766a5c6f551039645810bca5fdaf19a8f8b9694eb7f833755a7154b85bf45ea1e8218a36dd41be4ed5d224775f603632177d7c047954869e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
48866c68632105fb0d6197410c2115d5

SHA1
a89be904ba29cbcd06a8e2eefd61ae152c6eb2e6

SHA256
d678fa024b32fcad179e8e0131402c774148fa7867fca7793b7ca5beb8a8e0d2

SHA512
5563b5aa9dc3b58f748393c64f9bfda8a90048ef84562b6b9f32cab56cd177a4fbd0d52b688f6ecdcb2aa28570170d4aa62abd667cb3a154fabe56b2c2f3324e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59aabd.TMP

Filesize
538B

MD5
ac8d9c8050c49c553c533b4982f89940

SHA1
b1db31d80c748d4d2ff8434978f7ba535f0d85c8

SHA256
d3dfa4d1d978e54bf06b0adcb61760a90291c1105435cb1686155a98d8c07889

SHA512
2f6edf98bcd2473a3e0179bdf7e8a72c65444e2aa10c484053e23eab231bb498babaf8d2e5b5e0ae46a8622149b49485daa1645e75e46c146da7391df10b9ebb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
03e5c64d337cd059c1962e06b4a0ce07

SHA1
147eac43698a1e137cc678a3ad402924828699b1

SHA256
7ce625fd1d9ce2c2e75e4dc7c1494aee57dd8d2c3a5cec9786ec18898e0ffa6a

SHA512
b4bd915705e460ecbd4f3b83e00614db033276e849aacf07f83c834058ee47df2f94510b39fc06b7cb696195ba88d88838a83ef4331e7556c06298369d4d052f

Download Submit
C:\Users\Admin\Desktop\Recycle Bin - Shortcut.lnk

Filesize
359B

MD5
e91e2e19d333d2869ecd4e84dadce0b1

SHA1
4cc8f4571869f83e2c0ebfac3dd17f0c51654bd6

SHA256
1bae20e282456a5df55249f23d3c89430ed079c5e0f25d16976128f303db9e61

SHA512
b540108474cd92140d824e7aedc50b24fc30bcd9d5a87ac9c5f6af11b1079d518006c1942a156da093f3e27481cb5182d60118c4e984f099a38cff68fbb59867

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 49097.crdownload

Filesize
3.4MB

MD5
84c82835a5d21bbcf75a61706d8ab549

SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

Download Submit