Overview

overview

10

Static

static

3

2025-01-22...er.exe

windows7-x64

10

2025-01-22...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    135s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-01-2025 03:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-22_1748fc9c3457f6102469044a18a67095_globeimposter.exe

  • Size

    55KB

  • MD5

    1748fc9c3457f6102469044a18a67095

  • SHA1

    ff7a2abf8f53c2cac4d2d7d8c70b1784362414bb

  • SHA256

    aec151ab1896489a13e03e2897d3facc8678ffdbd53bd08a01a2d3837f792adc

  • SHA512

    3b2baccde64139657ba2cfcb17398078956b8302f32347ff344861ade61f26496e61a8f913df02ce56d7628ee58381b695fd58f92500cd0f9d0c00a9bd6d3463

  • SSDEEP

    1536:3ibgutzZi79QlgTHf4tq6KhxXwr3+mG3Kk:3itz479QlOWWXKNGak

Score
10/10
globeimposterdiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\Videos\how_to_back_files.html

Ransom Note
<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 5px; color: #FF0000; background: #303030; } .letter { color: #DC143C; font-weight: 600 } .tabs1 .identi { margin-left: 0px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top:0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>AF 34 6B 66 0F 8A 1F 20 A3 96 9F 4C 92 9A AB 06 EA 8D E2 B7 AC FA 67 67 07 E5 DC 57 A4 C8 5C 02 6B 5A EB 6B D2 63 3E 6D C7 9F 31 46 12 1A E8 70 85 23 AD 68 62 37 CC CD B1 5C 45 B1 7C 03 90 59 8E 98 74 C0 EA 36 E4 07 AD 18 20 61 DD A3 10 A7 45 35 4C F7 78 C6 8F C9 30 06 AF 07 69 78 1C 9C 23 B2 24 02 9C F7 16 03 D9 15 57 DF 38 21 9B 98 98 16 08 84 6A AC 3E 82 6A E0 19 B6 09 2A A1 64 89 8B B3 34 BD 82 A9 62 BF 97 3A 4B CB 46 ED 0C 83 B5 17 C3 1A 8E 07 B6 21 51 96 4E A5 9D 10 78 64 79 2F B7 4E 79 EB 5F 38 98 7F 2A BA FE 82 E3 1A F8 A8 8A 54 3F 27 92 CD E6 FE B7 90 D7 C4 F0 C2 00 76 27 D0 4E D5 05 69 1F 28 8C AC 67 54 CC 69 A6 D8 F6 D2 86 3E F3 8E FC 6C 67 8B BD AA 5B D9 01 B4 AB BB 25 AD 57 24 49 52 EC 64 B8 4D 52 FC B6 67 2F E2 CA 24 69 8E 63 A3 D9 57 2A AC A0 </p> </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>&#9763; Your files are encrypted! &#9763;</h1> <hr/> <h3> To decrypt, follow the instructions below. </h3> <br/> <div class="text"> <!--text data --> To recover data you need decryptor.</br> To get the decryptor you should:</br> <p>Send 1 crypted test image or text file or document to <span class="letter"> [email protected]</span></br> (Or alternate mail <span class="letter"> [email protected]</span>)<p> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files</p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.</br> <hr color=red> <center><p style="color:#FF0000">MOST IMPORTANT!!!</p></center> <center><p style="color:#FF0000"> You can not decrypt your files cheaper than we offer you. You can refer to other services that promise to decrypt you, BUT IT WILL BE MORE EXPENSIVE. No one, except [email protected], will decrypt your files with a guarantee 100%. </p></center> <hr color=red> <ul> <li>Only [email protected] can with a guarantee decrypt your files </li> <li>Do not trust anyone besides [email protected]</li> <li>Antivirus programs can delete this document and you can not contact us later.</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> </ul> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Globeimposter family
    globeimposter
  • Renames multiple (8788) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 29 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 57 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-22_1748fc9c3457f6102469044a18a67095_globeimposter.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-22_1748fc9c3457f6102469044a18a67095_globeimposter.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:4048
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4788
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\how_to_back_files.html
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdbd9246f8,0x7ffdbd924708,0x7ffdbd924718
      2⤵
        PID:772
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,7256489339592678924,1156677260464445376,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:2
        2⤵
          PID:404
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,7256489339592678924,1156677260464445376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2148
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,7256489339592678924,1156677260464445376,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
          2⤵
            PID:4092
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7256489339592678924,1156677260464445376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
            2⤵
              PID:452
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7256489339592678924,1156677260464445376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
              2⤵
                PID:5024
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,7256489339592678924,1156677260464445376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
                2⤵
                  PID:1280
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,7256489339592678924,1156677260464445376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2376
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7256489339592678924,1156677260464445376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
                  2⤵
                    PID:1760
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7256489339592678924,1156677260464445376,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
                    2⤵
                      PID:3168
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7256489339592678924,1156677260464445376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
                      2⤵
                        PID:3668
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7256489339592678924,1156677260464445376,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
                        2⤵
                          PID:2864
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1960,7256489339592678924,1156677260464445376,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1856 /prefetch:8
                          2⤵
                            PID:3200
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7256489339592678924,1156677260464445376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2032 /prefetch:1
                            2⤵
                              PID:4440
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7256489339592678924,1156677260464445376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
                              2⤵
                                PID:3500
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7256489339592678924,1156677260464445376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
                                2⤵
                                  PID:3100
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=printing.mojom.PrintCompositor --field-trial-handle=1960,7256489339592678924,1156677260464445376,131072 --lang=en-US --service-sandbox-type=print_compositor --mojo-platform-channel-handle=5888 /prefetch:8
                                  2⤵
                                    PID:3912
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=1960,7256489339592678924,1156677260464445376,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5984 /prefetch:6
                                    2⤵
                                      PID:664
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=printing.mojom.PrintingService --field-trial-handle=1960,7256489339592678924,1156677260464445376,131072 --lang=en-US --service-sandbox-type=pdf_conversion --disable-win32k-lockdown --mojo-platform-channel-handle=5680 /prefetch:8
                                      2⤵
                                        PID:2320
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:3480
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:4928
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                          1⤵
                                            PID:4376
                                          • C:\Windows\system32\printfilterpipelinesvc.exe
                                            C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
                                            1⤵
                                            • Drops file in System32 directory
                                            PID:4696
                                          • C:\Windows\system32\OpenWith.exe
                                            C:\Windows\system32\OpenWith.exe -Embedding
                                            1⤵
                                            • Modifies registry class
                                            • Suspicious use of SetWindowsHookEx
                                            PID:4008

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                            Filesize

                                            152B

                                            MD5

                                            36988ca14952e1848e81a959880ea217

                                            SHA1

                                            a0482ef725657760502c2d1a5abe0bb37aebaadb

                                            SHA256

                                            d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

                                            SHA512

                                            d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                            Filesize

                                            152B

                                            MD5

                                            fab8d8d865e33fe195732aa7dcb91c30

                                            SHA1

                                            2637e832f38acc70af3e511f5eba80fbd7461f2c

                                            SHA256

                                            1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

                                            SHA512

                                            39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            Filesize

                                            6KB

                                            MD5

                                            3198b3e6247eba083b7352d9c5f33355

                                            SHA1

                                            1322341e28723b148802068b40112178a35905be

                                            SHA256

                                            123dabe3c5301dbee409abf8bc519e67576c63a2eee9b911b1631a89e4bbad88

                                            SHA512

                                            878e45c63b44bba3866b537fbbe2e6efa3f2eda0ab8824ccaedd3f3b926d310fa8a0472e35ae5cb4b54f252f5dad12c554d21500fc0ddf52ff4f5b73d8ab3770

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            Filesize

                                            6KB

                                            MD5

                                            efb9af17e76c27f872e7274faf6ebce4

                                            SHA1

                                            aba60fda94f01272dce76d9fb7dcd9379779f698

                                            SHA256

                                            3811af44dd89ff994c7da49bcc13045372fbd3a00e7ceb0d025db168f02dcb90

                                            SHA512

                                            3c7e6514dc5a23ab1752f88152cef8df6e81f8627ffe55e73116138a5d0ec15701def7b94c086147ebe4f444c3a4f7b6c5a8e76525750424779c0dd0282897b1

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            Filesize

                                            5KB

                                            MD5

                                            56f9bf30f13746fe0baf89251e0610e0

                                            SHA1

                                            89106fc5c64453080557ca1fb507faecee4f368c

                                            SHA256

                                            b4cef89493ac495c0e210d61b505afd9e2f3469e907c59e6e67f6d8b1a2b539e

                                            SHA512

                                            2ffe4261d0a9db8386cee51e0c264beb2445997d80961a0c9a0ca1bb1017cff8877f11ef7ef2bdea89c4ba8cc8dece0fcc377ff33869f00c3f5000ffcf748e61

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            Filesize

                                            6KB

                                            MD5

                                            483fef04fcc8260d93bcaaf09554fa05

                                            SHA1

                                            5b53458c049a1619ad5dbade88b95326301b145b

                                            SHA256

                                            e888d6d0944790400d7f48962abf9069f18ce43b8ef15f9d3e4bdb56075c41a8

                                            SHA512

                                            c74aead952eab36c438a0a4ea1499a61347b44f4c3fd07ef854ba12aebd30b9879e9ce19c688bfb1d7b434af9dbb138d49da736fc64c8dc867d9ec7ddf840ef6

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                            Filesize

                                            16B

                                            MD5

                                            6752a1d65b201c13b62ea44016eb221f

                                            SHA1

                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                            SHA256

                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                            SHA512

                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                            Filesize

                                            10KB

                                            MD5

                                            d394d6fa2141071a69190dcfa70d4b0d

                                            SHA1

                                            e3fcc0a8272ed2f46db913473d9112b18e13932d

                                            SHA256

                                            2f24780199b90717cded36b8d599169c4adff455518b098e535df8dc347611b5

                                            SHA512

                                            dcc8f224100b3e121e604f9606fda39cfed37084d34685486171e96c4f5891d9f262b7b58370a6e1c5f655ebdf74170c0efae115d817bfba98d650bf8bc8439c

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                            Filesize

                                            11KB

                                            MD5

                                            883cf8e1eac8509499a9e56c7668fdab

                                            SHA1

                                            d8cf26784418e926ec5e3a808738cba2c0c02757

                                            SHA256

                                            c47e139e270cfdae4772af407bbd7a5a54bfccbde3e3c21f8552f6f53c328a49

                                            SHA512

                                            8e67994c10879568afe0453813d9d4cbf060c830531aa9619cf26363b5e193d98c4ac67b03d1638ea6cf65e7333a4458d6b63b1b463514b40d03f7b4b8dde8a6

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                            Filesize

                                            11KB

                                            MD5

                                            1f8988978c22d3d24ec28003ff60fc39

                                            SHA1

                                            e95e9361775624eaedb4783753706590194e422c

                                            SHA256

                                            b683cec5413c46617ea786c38564bb8d75a9932cb61bd4790aff72d14afe6a60

                                            SHA512

                                            f175f99bf2e5cb30252596e75e1930520b8f59c47ab9962cb8565fd36ba2ebb33ba8c7dd39732b22c59cb66e6de2d41aa7a9cb16d499179190875a506f890863

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
                                            Filesize

                                            264KB

                                            MD5

                                            c5fc5cda65d53e1b0a8f13f2cb0bc1ec

                                            SHA1

                                            dcb7020250d8ef34ff8c222d846e6c8d9bd781e1

                                            SHA256

                                            579303356010e84fdfa08feffe4234cee7eac779913b14770393bdaae5569a62

                                            SHA512

                                            d88032ef606af416bd657d09c070c7fb0d1af20423da12d2cbefbc7c4d7d672e10965904d0ac556ec5ccbd39706b6530bfbf7320fd2b5ce3808b75aab6ca2508

                                            Download Submit

                                          • C:\Users\Public\Videos\how_to_back_files.html
                                            Filesize

                                            5KB

                                            MD5

                                            c1aa596fff608ef52e5a16a376b73d98

                                            SHA1

                                            7d206a6c35f441820496e9cb8d27cbd041edcbe5

                                            SHA256

                                            7be0f42e945d8da7c00a060c9809c19fa20442e9157819accef8921166a44975

                                            SHA512

                                            2ad38bd115082d45e40480a56faeb4e8ac59ae2944d0ea2f674962adc6def6dde4af160bec0574e5c6052d9761582b779a704877d0c10374811e3bb179506737

                                            Download Submit