Overview

overview

8

Static

static

1

98icons1.png

windows10-2004-x64

8

Analysis

  • max time kernel
    1014s
  • max time network
    1016s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-11-2024 16:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    98icons1.png

  • Size

    8KB

  • MD5

    e095491c395e62f161d55edd1f0d7d97

  • SHA1

    a9a5454993e3f219d611a665c0c3abfd4bc142e8

  • SHA256

    de82cc6e49fe5501e27e81701636e7aeaf5f3c252ba467d8a1f1824c235bb3bc

  • SHA512

    c7f55c45099f0497781e9ef8f13e56f5b203932ca5a4040017533c00b193f1b08519e3e07b38e2243d843de556d3df4f8a4c276fe86f983fcfc8dec7943d32ca

  • SSDEEP

    192:igCaAkM0Kj1TLr+hBYbxnN/y+e0sUFfarZot73i41:ibe61Hr4GnLe01aGjiK

Score
8/10
discoverylateral_movementpersistenceprivilege_escalation

Malware Config

Signatures

  • Modifies RDP port number used by Windows 1 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry 3 TTPs 5 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Remote Services: SMB/Windows Admin Shares 1 TTPs 1 IoCs

    Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

    lateral_movement
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 4 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 23 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies registry class 64 IoCs
  • Runs regedit.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\98icons1.png
    1⤵
      PID:3516
    • C:\Windows\regedit.exe
      "C:\Windows\regedit.exe"
      1⤵
      • Checks BIOS information in registry
      • Maps connected drives based on registry
      • Remote Services: SMB/Windows Admin Shares
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies registry class
      • Runs regedit.exe
      • Suspicious use of SetWindowsHookEx
      PID:3576
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:436
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbf25a46f8,0x7ffbf25a4708,0x7ffbf25a4718
        2⤵
          PID:3060
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
          2⤵
            PID:1812
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:5028
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
            2⤵
              PID:1524
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
              2⤵
                PID:4880
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
                2⤵
                  PID:4020
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
                  2⤵
                    PID:4332
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
                    2⤵
                      PID:1752
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3392 /prefetch:8
                      2⤵
                        PID:3324
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3392 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1228
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
                        2⤵
                          PID:3052
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
                          2⤵
                            PID:1464
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
                            2⤵
                              PID:5008
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
                              2⤵
                                PID:4996
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
                                2⤵
                                  PID:5272
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
                                  2⤵
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious behavior: GetForegroundWindowSpam
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5432
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
                                  2⤵
                                    PID:5684
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
                                    2⤵
                                      PID:5804
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
                                      2⤵
                                        PID:5812
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
                                        2⤵
                                          PID:6020
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
                                          2⤵
                                            PID:5604
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
                                            2⤵
                                              PID:3024
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
                                              2⤵
                                                PID:5428
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2648 /prefetch:1
                                                2⤵
                                                  PID:5456
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1308 /prefetch:1
                                                  2⤵
                                                    PID:5272
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
                                                    2⤵
                                                      PID:5700
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,15959400723131657406,6010026903300005430,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4772 /prefetch:2
                                                      2⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5172
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:2364
                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                      1⤵
                                                        PID:2848

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        Filesize

                                                        152B

                                                        MD5

                                                        dc058ebc0f8181946a312f0be99ed79c

                                                        SHA1

                                                        0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

                                                        SHA256

                                                        378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

                                                        SHA512

                                                        36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        Filesize

                                                        152B

                                                        MD5

                                                        a0486d6f8406d852dd805b66ff467692

                                                        SHA1

                                                        77ba1f63142e86b21c951b808f4bc5d8ed89b571

                                                        SHA256

                                                        c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

                                                        SHA512

                                                        065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\70060a25-f4c2-47ff-803d-05e82f2b41af.tmp
                                                        Filesize

                                                        7KB

                                                        MD5

                                                        f9c5c30063b6b7ee44834ff50b5bfcca

                                                        SHA1

                                                        76bdb4d9e7ed0b08004d2d22dc799eb1147eb2bb

                                                        SHA256

                                                        561ff5e6c1ce176c613453a905fe60b605b9e7b0f1f1681f9243ffde2adb4358

                                                        SHA512

                                                        a244910dd797b556bb95bec73a6ea71236425f311efba87ef4274ff8fc87d0ff6ed211248bbc676657306f3726462a377aadd6ac452f249bd8f615eea442153b

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
                                                        Filesize

                                                        62KB

                                                        MD5

                                                        c813a1b87f1651d642cdcad5fca7a7d8

                                                        SHA1

                                                        0e6628997674a7dfbeb321b59a6e829d0c2f4478

                                                        SHA256

                                                        df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

                                                        SHA512

                                                        af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
                                                        Filesize

                                                        67KB

                                                        MD5

                                                        b275fa8d2d2d768231289d114f48e35f

                                                        SHA1

                                                        bb96003ff86bd9dedbd2976b1916d87ac6402073

                                                        SHA256

                                                        1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1

                                                        SHA512

                                                        d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
                                                        Filesize

                                                        19KB

                                                        MD5

                                                        1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

                                                        SHA1

                                                        6dd8803e59949c985d6a9df2f26c833041a5178c

                                                        SHA256

                                                        af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

                                                        SHA512

                                                        b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
                                                        Filesize

                                                        63KB

                                                        MD5

                                                        226541550a51911c375216f718493f65

                                                        SHA1

                                                        f6e608468401f9384cabdef45ca19e2afacc84bd

                                                        SHA256

                                                        caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

                                                        SHA512

                                                        2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        526ade5f7b7f6efc33a4059825b154d7

                                                        SHA1

                                                        8b6c488a74fcf3e5863a2c7ac62e0affb00be276

                                                        SHA256

                                                        f7a53b8e8066d05d5e6e6e24c2c073232b2a5714c10556821e5612f7eee8a956

                                                        SHA512

                                                        4b075d29e73a639245785249d6f08ef8fc550f989c5f135a1d03b8c1ade1c85b7f6670b4caa681f1978963a4b3864b6b77bc5b45abe16cd4804f8f961119c67d

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                        Filesize

                                                        471B

                                                        MD5

                                                        53fe8e3f7c2bfad4428f006849d99e20

                                                        SHA1

                                                        e114fb17fedb45a0106cf482467ebb2331c74412

                                                        SHA256

                                                        08861afcba6bc43a844c00620d095dd06f55d1d96abfcf692d94f198093fe422

                                                        SHA512

                                                        2e7a868ab8d3381cd6eda0d7f1cd7dea60d0de35e8df6aa48126110f975000847d86b67b16ee36639212b929716c24fcd434f5c2434bf18d1a4e541958f01a5b

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        Filesize

                                                        6KB

                                                        MD5

                                                        4d57237d24d9a6d89377411320174c90

                                                        SHA1

                                                        c10df044c4b6825fd98e5d8c49db6db98387777d

                                                        SHA256

                                                        75bdf5ab936349871adfd2b149a486c5049332858fd26799231825bbfa67db49

                                                        SHA512

                                                        05e8d8cd23f23a141c9423c75c424c5f772d65cac235c4511c9cd44cb3f552eeefa71fd17d51066c4b9bd352c80ac638a1aa2b698b627660c3186eb14872df1e

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        Filesize

                                                        5KB

                                                        MD5

                                                        14d69be53751e22430bf0c97d1654ede

                                                        SHA1

                                                        09bce9ac5cf2c10b2fb93123019d657002a23d31

                                                        SHA256

                                                        7e24872115269b8d020522a49b5073ce84f3dfb9eb65f8bc677d37c535579d13

                                                        SHA512

                                                        e0920b27da21864a3f81ffce54a8755e57e9dadaf4bb61a48fab876c33061db582e68d4b531716bab83419c87c5485e8ede08e038487d9888e4afcdeb882f0eb

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        Filesize

                                                        6KB

                                                        MD5

                                                        5f811c2763caff6b52c4afb45871d119

                                                        SHA1

                                                        760889562a4092bcda4abcbb4b101dfcad5dddd8

                                                        SHA256

                                                        67645b366fb8471cc716af7cd3d2daae6312bfc4a5485634488e4b930ee378ab

                                                        SHA512

                                                        fe70ccb0fd1688cdd69cf969e4282333f8a909ff6667194ea242db4a748a2d41477e38212ec229a3b810d798d13f125be3cf5b08ef6f580006cace5e5153b5cf

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                        Filesize

                                                        538B

                                                        MD5

                                                        39d880007b3242b78db626d69d39015c

                                                        SHA1

                                                        b29780645713d23121eabb4e8b9f752dfcfc4790

                                                        SHA256

                                                        6f772da771be0d16f1c6b4efbb168b9f138216de327c0edd6793be12b4dd8bda

                                                        SHA512

                                                        4802967e163fd7fb3846b0b2026a977260c9958c4209aef0a9a29ef7de4bf9cac9486cb3c5a71c0b801fb85a68ec0ca077d13bc63161fddf1f2fbb055a25d675

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d5e9.TMP
                                                        Filesize

                                                        538B

                                                        MD5

                                                        881f85cae9f0896a2f41481faf44bb9b

                                                        SHA1

                                                        394a4eb9633adaf46dee5eb2256c9ae48a0cfd24

                                                        SHA256

                                                        4c7ee7d5e7e07d3c0d6e4e521dbb0139c0831e5a97d5b15908fac42b3b4c8b4d

                                                        SHA512

                                                        66a2ddae2cd5fb7d2c4a4bc57659f4189a6dbff0a251bef24135b1d9c36fa0a10969770d77f774f7234c8bcf1868eeeb0f47fd2c4f7ad77850beb35b605ea4f3

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                        Filesize

                                                        16B

                                                        MD5

                                                        6752a1d65b201c13b62ea44016eb221f

                                                        SHA1

                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                        SHA256

                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                        SHA512

                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        Filesize

                                                        10KB

                                                        MD5

                                                        5c2f754b0fba158981aa20c775dfc824

                                                        SHA1

                                                        17f5f00d67840d2def525b561b247844024d793e

                                                        SHA256

                                                        25eae6abc6ab250037d746a33e23db9599b7d5105b08e853d7ebe372eb5e45ee

                                                        SHA512

                                                        685fc32256feaf82cdd4a3c611812681e7a0c59b2dfaee14f43d0633831e2adae9aefd430e9b17a126c09536e71af10309100cf976b2a69a13059cfa86f9991f

                                                        Download Submit