hxxps://www[.]upload[.]ee/download/15657107/813ac1d2bfa81d7f177e/XWorm-V5[.]0[.]rar

Resubmissions

30/12/2024, 20:44

241230-zjcjfazrhy 8

26/11/2024, 18:42

26/11/2024, 18:41

11/04/2024, 09:32

11/04/2024, 09:21

Analysis

max time kernel
45s
max time network
54s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
26/11/2024, 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.upload.ee/download/15657107/813ac1d2bfa81d7f177e/XWorm-V5.0.rar

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5d77b5f4-7d5f-4905-a30a-da0b2f491176.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241126184146.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5952	msedge.exe
5952	msedge.exe
5980	msedge.exe
5980	msedge.exe
824	identity_helper.exe
824	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5980 wrote to memory of 1380	5980	msedge.exe	80
PID 5980 wrote to memory of 1380	5980	msedge.exe	80
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 6084	5980	msedge.exe	81
PID 5980 wrote to memory of 5952	5980	msedge.exe	82
PID 5980 wrote to memory of 5952	5980	msedge.exe	82
PID 5980 wrote to memory of 4312	5980	msedge.exe	83
PID 5980 wrote to memory of 4312	5980	msedge.exe	83
PID 5980 wrote to memory of 4312	5980	msedge.exe	83
PID 5980 wrote to memory of 4312	5980	msedge.exe	83
PID 5980 wrote to memory of 4312	5980	msedge.exe	83
PID 5980 wrote to memory of 4312	5980	msedge.exe	83
PID 5980 wrote to memory of 4312	5980	msedge.exe	83
PID 5980 wrote to memory of 4312	5980	msedge.exe	83
PID 5980 wrote to memory of 4312	5980	msedge.exe	83
PID 5980 wrote to memory of 4312	5980	msedge.exe	83
PID 5980 wrote to memory of 4312	5980	msedge.exe	83
PID 5980 wrote to memory of 4312	5980	msedge.exe	83
PID 5980 wrote to memory of 4312	5980	msedge.exe	83
PID 5980 wrote to memory of 4312	5980	msedge.exe	83
PID 5980 wrote to memory of 4312	5980	msedge.exe	83
PID 5980 wrote to memory of 4312	5980	msedge.exe	83
PID 5980 wrote to memory of 4312	5980	msedge.exe	83
PID 5980 wrote to memory of 4312	5980	msedge.exe	83
PID 5980 wrote to memory of 4312	5980	msedge.exe	83
PID 5980 wrote to memory of 4312	5980	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.upload.ee/download/15657107/813ac1d2bfa81d7f177e/XWorm-V5.0.rar
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0xdc,0x130,0x7ff9c3e146f8,0x7ff9c3e14708,0x7ff9c3e14718
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,9080988725967589477,17235868994831636108,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,9080988725967589477,17235868994831636108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,9080988725967589477,17235868994831636108,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9080988725967589477,17235868994831636108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9080988725967589477,17235868994831636108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,9080988725967589477,17235868994831636108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff67f1a5460,0x7ff67f1a5470,0x7ff67f1a5480
    3⤵
    PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,9080988725967589477,17235868994831636108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9080988725967589477,17235868994831636108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4436 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9080988725967589477,17235868994831636108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9080988725967589477,17235868994831636108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2905b2a304443857a2afa4fc0b12fa24

SHA1
6266f131d70f5555e996420f20fa99c425074ec3

SHA256
5298bdb27d48c2c2b5e67bdd435445ef5b06d9b36c11394705b413ff3d0f51f3

SHA512
df85de0c817350d8ca3346def1db8653aaee51705822b4c4484c97e7d31282a2936fa516d68c298dcbbb293b044aa7101b3de0c7852c26e98ac6c91415162b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f5391bd7b113cd90892553d8e903382f

SHA1
2a164e328c5ce2fc41f3225c65ec7e88c8be68a5

SHA256
fd9710650fc6774ce452b01fb37799cd64d3cdc282ac693e918e38322349fe79

SHA512
41957bea3e09c2f69487592df334edc6e3e6de3ab71beb64d9b6d9ce015e02a801b4215344d5d99765abe8ab2396394ac4664fced9f871204453a79463cc7825

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe57ab63.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ee87cf131140b1f2c1363d03d269a552

SHA1
b50d52d4ebb56bc6c5abb3d83c8082bb2d706acc

SHA256
6adf1127f8cb348915d4bbc399074ce1200f5ed625540fbe3271f9db64983319

SHA512
ed9534792204d935d9833d7a6f0283ff80752745c792d1e6ef6284f1f416769c403587eda22ae145ec3936b741f9a4cd6c3162633130e16a38da6ebf890353a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8eef6cb9e4d4f04f7202a6bcbb23dc4c

SHA1
7b24e8b3d5f5a2e163946bd9e28e1c67bd8fee4a

SHA256
94d1e91f87064876161a321019a8f6653246efc1e0c8a6347eeeb8478a6faf68

SHA512
762be0e6f39e42a0c8f640973594f58cb4ac72ff41ba4c6f40e390311159d3cd5a1c7452ab586d1fbff7609289cf714e65cdedf94721e9050fec8110b3658f3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c6a93258d4082f1615e8b97fe467d85c

SHA1
1dcc3c52ad6156033b772045de872d2fc1313e17

SHA256
ef88479d930a02384319c5364586bce4065081ca148a814ffecd4bd2151b5af8

SHA512
dfb4f7b69cae7e5dd5f501021cb146b881c5f06b04d9b91f23b32de446b72e14f74fa71f67f8f97b29bce3ca17d07e51ae93cf96d533c14678079f136c35b6bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7ad9709100fb43b77314ee7765b27828

SHA1
5cd0c406c08c9c1073b0c08169ccaffbd4ef6b98

SHA256
04b61824ffce6fdbae4e6a527ae58b85813226ee28fe4d631feb76b5f936a1a9

SHA512
fc55ee34b1107e298f2cfcb20dce42b5dbc98a7b68e72ed80a6ea594f66dff6f9e9cb70ad5ccbf5ad2171275f375abac1defd8dad4118afa280cd9c1d9f6a538

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
88617bce301e89fdf9bcd2f005232b3e

SHA1
0fcc1d7ab06ba2a9531685bd524343048a95d8eb

SHA256
043e48c90d0e753226f59e24045fd5263048e63ac605fb18316bd39db843aced

SHA512
caaf6d38bdc781fc3002b47d4a46dbdc942b2c84df52b22c77cb1be49d6555004b7cb264941aaeae4dfbded65bcc0feac2e8adedd169a08ef0e111eff6a8f4d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
325d9cf00e5d9f03932f565b3f19c17d

SHA1
d71c9fd3bc31c40a00be1ab402f66dc98115fe06

SHA256
3e4b7fb2f33a9643685f79cc629182519cf6a20be37edc1e1482e1784f8c2943

SHA512
6ee430a613127079bcf339f54cc797ac59e7313f68dfae3172778f8b0d43234c6fd0e7c958b1c6a12e182f84f033d6561633119c30ba187fafb4e39f4be2f7bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
071e2dab423695d4ef5a327d71c38f08

SHA1
b4f09701555c56fec83056b85a1d4342aaefd06f

SHA256
dd327a548492139de6d1c395c47c03792b811e5ff0352412916f96812dee3c36

SHA512
190f3c9e44df8b6677ecd2d5853d2bb872748bf4faf2c7d342e9bf066ec4c564f45dac67fe5c8e78be61482cab4339af5eee5b365d918753f440018720972c11

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
2dc1f32a980a1ac1cf018251658b1d44

SHA1
8a19b37a2afaf53df7e13ff1ac3df5259b70ac0a

SHA256
a985074bf283e03edd866cc33e4f7421a4141f55798f1a2d5084eea6bf48e6bc

SHA512
0210d6d86d7d5552168ea5c070086c4d3a918ab83e40dd3fae33419d5bab599e80c27eec9c8fd5c0f1fff0e5b56d94ff466bd574fd38c10006c64745482a4d10

Download Submit