hxxps://github[.]com/KhanhDey1260/duper-utils/releases/tag/2[.]0[.]0

Analysis

max time kernel
40s
max time network
42s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
20/11/2024, 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/KhanhDey1260/duper-utils/releases/tag/2.0.0

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\dupeutils-2.0.0.jar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe
3168	msedge.exe
3168	msedge.exe
4840	identity_helper.exe
4840	identity_helper.exe
4928	msedge.exe
4928	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 3884	3168	msedge.exe	79
PID 3168 wrote to memory of 3884	3168	msedge.exe	79
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3576	3168	msedge.exe	80
PID 3168 wrote to memory of 3476	3168	msedge.exe	81
PID 3168 wrote to memory of 3476	3168	msedge.exe	81
PID 3168 wrote to memory of 4988	3168	msedge.exe	82
PID 3168 wrote to memory of 4988	3168	msedge.exe	82
PID 3168 wrote to memory of 4988	3168	msedge.exe	82
PID 3168 wrote to memory of 4988	3168	msedge.exe	82
PID 3168 wrote to memory of 4988	3168	msedge.exe	82
PID 3168 wrote to memory of 4988	3168	msedge.exe	82
PID 3168 wrote to memory of 4988	3168	msedge.exe	82
PID 3168 wrote to memory of 4988	3168	msedge.exe	82
PID 3168 wrote to memory of 4988	3168	msedge.exe	82
PID 3168 wrote to memory of 4988	3168	msedge.exe	82
PID 3168 wrote to memory of 4988	3168	msedge.exe	82
PID 3168 wrote to memory of 4988	3168	msedge.exe	82
PID 3168 wrote to memory of 4988	3168	msedge.exe	82
PID 3168 wrote to memory of 4988	3168	msedge.exe	82
PID 3168 wrote to memory of 4988	3168	msedge.exe	82
PID 3168 wrote to memory of 4988	3168	msedge.exe	82
PID 3168 wrote to memory of 4988	3168	msedge.exe	82
PID 3168 wrote to memory of 4988	3168	msedge.exe	82
PID 3168 wrote to memory of 4988	3168	msedge.exe	82
PID 3168 wrote to memory of 4988	3168	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/KhanhDey1260/duper-utils/releases/tag/2.0.0
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa20f53cb8,0x7ffa20f53cc8,0x7ffa20f53cd8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1764,10993551167666534720,13907694987717552742,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1764,10993551167666534720,13907694987717552742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1764,10993551167666534720,13907694987717552742,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,10993551167666534720,13907694987717552742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,10993551167666534720,13907694987717552742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:584
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1764,10993551167666534720,13907694987717552742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1764,10993551167666534720,13907694987717552742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,10993551167666534720,13907694987717552742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,10993551167666534720,13907694987717552742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,10993551167666534720,13907694987717552742,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,10993551167666534720,13907694987717552742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,10993551167666534720,13907694987717552742,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1764,10993551167666534720,13907694987717552742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4348
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\dupeutils-2.0.0.jar"
  2⤵
  PID:5004
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\dupeutils-2.0.0.jar"
  2⤵
  PID:796
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\dupeutils-2.0.0.jar"
  2⤵
  PID:4868
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\dupeutils-2.0.0.jar"
  2⤵
  PID:2528
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\dupeutils-2.0.0.jar"
  2⤵
  PID:1228
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\dupeutils-2.0.0.jar"
  2⤵
  PID:1088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1240

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3728

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\dupeutils-2.0.0.jar"
1⤵
PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
6bfe4784154d98b48151d2d02d44db89

SHA1
e12f93adb384af7aa38ee746f0946e5a52f6f3e1

SHA256
a5c7a45f5a418d2b06b44904d985ad525ae7047e8ecf80ff5f2f4de3baec6ed1

SHA512
11c2e49b40418ae51980393e5e06c9c92923f9175403c51b1aab2311b1ab62eb01be7ecf2164dd11cba64918b50ed3016ea321ba2821529e15264f4edf8d63b2

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
03eee8b8a7072c639a07d47f1692491b

SHA1
b875090fb30fad27b0136719e07f880d185d131c

SHA256
a076a2eaaad0582d49fbb0e85ef6c9f32cfbd0ebaf8f23255dff61c06abbf3e9

SHA512
818a677263a91041e41f412a27b2c8184734874aa97d27f769110767c5dd31d5d1e030c3a997dfa3eb3758e6fa4d89b22c17a36ad122894491927b87995c4e80

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
3a54062d06730513ff8b03b135c06b5a

SHA1
9f4178154dcd804b09bd537dcff1fd7c140d86ef

SHA256
2373adb49bbedaa3f12c48fd50b0842aaa8bf02c32b3b39257947fba96063a4b

SHA512
d759467831ce0a96a0cb0804804c1e02b1434b5d8129b245d6dc21b684a446b97b453a6a96a610bc414f2d82d17dc9a78b95bfc084e70009745e44809daaeeb2

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
6ffa0840eb0f5f2788fd534079a1ccf3

SHA1
e9a3a3aaa15eae4ba3caeb67d46becd3ffc5b78a

SHA256
4160cd7caeecba66e74f7968d82022fb7e7477e61f9dd39aa5735b601f9de075

SHA512
cef56c73eb04fdbffc5940d567120bee13f379e557f02a71afa65fa12ca69756937702b2ba94f0651d71881861cb420dbf35d3861a81438975ed214016ec64f3

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
80efb614f8360d4231930354d969845d

SHA1
f8155658cdcb5044d565334e6ca6296d81068aeb

SHA256
2191930fcfb814d6c41390acff0957bd9ec4c0578cdd2b6242809f3acec67b05

SHA512
873e604027bb5ddb7aebbd0127e1a2ea0ce3c9cd00fed73851b26b4311f33cecd33e576759b238ec8becda3203363e5c3efcda7acbfc56bea87e0453a5449726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
554d6d27186fa7d6762d95dde7a17584

SHA1
93ea7b20b8fae384cf0be0d65e4295097112fdca

SHA256
2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

SHA512
57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a28bb0d36049e72d00393056dce10a26

SHA1
c753387b64cc15c0efc80084da393acdb4fc01d0

SHA256
684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

SHA512
20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
56405207adda50a77ca8f3a9798f72d1

SHA1
dd3beaa8c631f790fb4e8b25dd188a97868fe625

SHA256
b830660d0efb07b20cd5b97d5e2b8a403ce38b2cae94c88482af4f116b7ffab3

SHA512
eab31fd9796970a6888be82fc1cb2149f270b65b6a8e01403636444c955134626bda507d47bfbd12ee57e001407c9ece55e0a0c1164d948405bb5af72124ce16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3a3fe8f5fe0b490e76c927715377ae7c

SHA1
aa13aa7f1825a0f6b9ddc0cc53423418ce2a9fb5

SHA256
fce5b57413102406a4f5d1a22fe7ebe6d646ed4fdaf7229a62c9f05984809b88

SHA512
7b265659fc0607b38134d5816766f411190b8fd0cf9a0a94331dff9ac46d794b5882d9e121a8fda4120a6f92aa7cb0bf741eba10df89f5ad96605da40b552b54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2292cf24f7e3b6839b2051c2f73ef315

SHA1
998dafc3cc962053f43c854d1b08c5c4ffb07154

SHA256
a0b5d39e2013356ce366f845bac5474fbc17b98b8c957120b252abbb76af6f2a

SHA512
cf478b1aa100b02beb1cd40dfe649afb3082abecd1e8a77f9b3ea7b23a266c418545641e15dff056be221b5cd43eb6c9d24474dba80a88cad9efb8bd2acc01b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
42e8737949f17ea2b3f45c97e662b496

SHA1
cd182cf3bd51ff03452e10313a1dad21ed4557e4

SHA256
68d5b801fa9710179bf3221ea54226081f919cc58d49f7d4396d4ddab51de4ca

SHA512
88ab2654fc33d35c501ddf22fc889ed2ebe2d54e63e00f9711010b8f324cb5b9fce902681a95683fea4e97d7095f0ac80e9b2eeb56dcf14fdf478dfeeed79d9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f0c8.TMP

Filesize
874B

MD5
267e6c73ab1375b32c30622f982e6ea9

SHA1
892ed3ee5db47dfc666e5d939147500336d2feb5

SHA256
8f58a5102d61219f8375351117ae2910dfb7b8f9629a892908cd222f40818d21

SHA512
e78ad8a5900951bfa3fc539336cad5f5a0e66b648514e7951856a2d3238899fb2cb2825853b19ce3e37a46bc5d14daaa94bb689e85d7854235ff56dd87a65f29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
40109ded50205466ced6aced878ae1c9

SHA1
f722673cbe83623d56183b5c5ceb3e8d332f9d41

SHA256
ed03e98d941a9037919c880437a307e9b725b0521b7d2038a54df26f21e1259e

SHA512
a6a99bc1a67e243ebf3816d2bf474712d76ed132c03d5d0fbcf10a728f0e09d65ca27b372e88b0c4c17eca584b29eaa3f80ad47e03a2a695ce971b2cea717953

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e483aad5e01c23529d892203e68492ec

SHA1
19b0d83e96f93ae873b02c1003ffcc739e0b7581

SHA256
26d3d65285b7186ae31b5069ab9baa8777a3c1358f26c774aba35553835ee5e3

SHA512
9dd7660a6b4466b259290c37321a6c762e9c2558ebb4ff6a1e2ad786f8dbc5449e8319b6e8a3b14f9ca9984ea51c689a52b62667e506af6643738138a8fbe656

Download Submit
C:\Users\Admin\Downloads\dupeutils-2.0.0.jar

Filesize
47KB

MD5
2f00987c2cb450533172780f77161dd4

SHA1
fd702ff1706da533f1781dc392faef8b2d589c2b

SHA256
d9ef305f249978653e22c3798ef4d74967ffbf2bd3481753db4a7d00fcc17ee2

SHA512
fb96150c2449daf8fd49d47dee0557e64549a95e2d73bf60f9fe18a924ffcc76b55c644f5350765d1064658e5a7435246d0f2597404bbd59772e6f34d2144a4f

Download Submit
C:\Users\Admin\Downloads\dupeutils-2.0.0.jar:Zone.Identifier

Filesize
102B

MD5
baa076236a6cb26d08767dd2efa54df2

SHA1
04783649e39454b04a9a2442a1032365f8158a18

SHA256
16361d6ac42e3867ddbbaa20c2d65a5b0cd5477861e90e44d25b8c51c838c0af

SHA512
687788788efc628db519321621a551def53ba4767cc36b3f230d2f3941629c4056ef686145fa4c7dedc2c3b3d276a1c749e390c6e3ccb26a673cf9e6b00c5fc4

Download Submit
memory/796-221-0x0000017602920000-0x0000017602921000-memory.dmp

Filesize
4KB

Download
memory/1088-266-0x000001F2FF5F0000-0x000001F2FF5F1000-memory.dmp

Filesize
4KB

Download
memory/1188-287-0x0000016D998E0000-0x0000016D998E1000-memory.dmp

Filesize
4KB

Download
memory/1228-254-0x000001B9C7AF0000-0x000001B9C7AF1000-memory.dmp

Filesize
4KB

Download
memory/2528-242-0x0000017059760000-0x0000017059761000-memory.dmp

Filesize
4KB

Download
memory/4868-230-0x0000020E67050000-0x0000020E67051000-memory.dmp

Filesize
4KB

Download
memory/5004-206-0x00000232E3480000-0x00000232E3481000-memory.dmp

Filesize
4KB

Download