hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure[.]apk

max time kernel
147s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
19/03/2025, 16:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
80	5900	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
3204	Anap.a.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
75	raw.githubusercontent.com
76	raw.githubusercontent.com
77	raw.githubusercontent.com
78	raw.githubusercontent.com
79	raw.githubusercontent.com
80	raw.githubusercontent.com

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Anap.a.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anap.a.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133868759462194700"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1678082226-3994841222-899489560-1000\{CF3BC3D0-F9C5-4261-ACC3-A5803112BD8E}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1678082226-3994841222-899489560-1000\{65CDA393-1710-47A5-8D73-4469A14F9BF6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Anap.a.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4072	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 3680	3404	msedge.exe	78
PID 3404 wrote to memory of 3680	3404	msedge.exe	78
PID 3404 wrote to memory of 5900	3404	msedge.exe	79
PID 3404 wrote to memory of 5900	3404	msedge.exe	79
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 3384	3404	msedge.exe	80
PID 3404 wrote to memory of 6132	3404	msedge.exe	81
PID 3404 wrote to memory of 6132	3404	msedge.exe	81
PID 3404 wrote to memory of 6132	3404	msedge.exe	81
PID 3404 wrote to memory of 6132	3404	msedge.exe	81
PID 3404 wrote to memory of 6132	3404	msedge.exe	81
PID 3404 wrote to memory of 6132	3404	msedge.exe	81
PID 3404 wrote to memory of 6132	3404	msedge.exe	81
PID 3404 wrote to memory of 6132	3404	msedge.exe	81
PID 3404 wrote to memory of 6132	3404	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2a8,0x7ffc076af208,0x7ffc076af214,0x7ffc076af220
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1884,i,7986832462603886147,6365750959779566871,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2656,i,7986832462603886147,6365750959779566871,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:2
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2172,i,7986832462603886147,6365750959779566871,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:13
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3432,i,7986832462603886147,6365750959779566871,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3440,i,7986832462603886147,6365750959779566871,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4824,i,7986832462603886147,6365750959779566871,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3416,i,7986832462603886147,6365750959779566871,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5764,i,7986832462603886147,6365750959779566871,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
  2⤵
  PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5748,i,7986832462603886147,6365750959779566871,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5864,i,7986832462603886147,6365750959779566871,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5748,i,7986832462603886147,6365750959779566871,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6024,i,7986832462603886147,6365750959779566871,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:14
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5824,i,7986832462603886147,6365750959779566871,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6548,i,7986832462603886147,6365750959779566871,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3068
- C:\Users\Admin\Downloads\Anap.a.exe
  "C:\Users\Admin\Downloads\Anap.a.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3632,i,7986832462603886147,6365750959779566871,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3608,i,7986832462603886147,6365750959779566871,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:14
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4136,i,7986832462603886147,6365750959779566871,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:14
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=5876,i,7986832462603886147,6365750959779566871,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=6204,i,7986832462603886147,6365750959779566871,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=4804,i,7986832462603886147,6365750959779566871,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6272,i,7986832462603886147,6365750959779566871,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f4,0x7ffc076af208,0x7ffc076af214,0x7ffc076af220
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2120,i,16516593762104695904,10388306986159031427,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1836,i,16516593762104695904,10388306986159031427,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11
    3⤵
    PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2464,i,16516593762104695904,10388306986159031427,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:13
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4376,i,16516593762104695904,10388306986159031427,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4376,i,16516593762104695904,10388306986159031427,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
    3⤵
    PID:5352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4624,i,16516593762104695904,10388306986159031427,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:14
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4640,i,16516593762104695904,10388306986159031427,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4656,i,16516593762104695904,10388306986159031427,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:14
    3⤵
    PID:5188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4468,i,16516593762104695904,10388306986159031427,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:14
    3⤵
    PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1984

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4844

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:408

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:5144

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5040

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:4148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
19a88bad99bffbae6102e191cfedd75b

SHA1
df476b325df883b73eda1b2349bab45aa22e808d

SHA256
0d576dfbde1712b7288e4561e3eea75ffdad84dc50a77ceb57a6e9c37d60465a

SHA512
9ec5eb487d8c8fc8e283a94bd43afd740edc4df6a4509d83629416d040586bd42330eb0da6dd41ec1e5550bce9a6643319ff8584f8638a9cde9042fa406825fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
9bc22d173a26e502490d2d36e1e8d189

SHA1
82a4126f216d26ed0f75f2ba9ff86d4e5a506c5e

SHA256
202f06ae485b85b2f121d30bb2e8d271669d6c0e796e097db39e75614419173e

SHA512
1d262f921f6f1d3d15a8cb962682ef1ccbe77408cf66bc47d228e2f3449537468eb5e82a5eb38828e613c3f0e096a81a45690af6eee0eb866d7ad63f5337b8a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
8b8c9e47fdc434647ea4405dc2693efd

SHA1
918be60473bc0801b5720de3953389076c0d3723

SHA256
5a64f44d5f12bc9541a0fa3e473c1f952256298c4c80ac2e9a3f0d77650a8b1c

SHA512
1c2e2c0cedab41607a0d7cda0d762010c9b018344534bb3b180fb52f4aab2891ba223c322374b7f3084fb9df2b19f3d872589a0bf1d6d03889628b1a992c5352

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
a64319dd1f6ccf83fa048587df76a3a4

SHA1
eb9bd7c3cd78d92f5f1d17edaebe2e37b1b82781

SHA256
07eb11f77a2be82e25ca709cd52e77f1e4d72a9c276b563eef8f98c3dd43eb28

SHA512
a5501db56a4ec818009b3d9a7339f87a2ccea27972535546ed945c704247861358a2ad4909c7e7ebf3c3f6249403e61ff436c4de46c984f529e08c7df3eaf53e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
adae0ca3f2f82ec6ed1133b2e9e7a928

SHA1
8b7e32af7d63132f862b110deeace8e467caccab

SHA256
d351898edff2abcfcb1242f5c83f863a2f8a6dae0838fbefd9a77718c80d4457

SHA512
61de7eef80d2cd43ca00c452bb39c8110e201f0d8e24d25f629de0feb713b1238561f0ef861604ff00cc4a0a2f41fcb7e9730c5847b522cdd3bdb850ee64238a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
83af0857533fc913981e67d1f9e822f5

SHA1
c99e55c41679f96aba0f4c73de3e65fbad874beb

SHA256
d40a63f988d71cc28412429680a2b67236ec8905a56e28cf59b15816a83c0b7b

SHA512
424743eef2d852ab2dd0aa316986bb0104ca722690e1e183501192cdc6276fd2e7e4e39f85c045db624af475085e4ae9253d0c9819b8c0da2e7dbb61ff817a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
8.0MB

MD5
536e079228aea05d08970edb57ce7443

SHA1
36e3d66d6a3edfd2fa6f4b3d331ad61b8f6a45d4

SHA256
964cab313076a077276963ab10a83f70c7ecea65bfa3744950baf49a0afb4f3d

SHA512
83454274c71917cf230fc46b134b59571e50fcef439d88bbbae465c3cf92c837ab2b46ec9d2eb2e133524dac6b78cdde35a760efe5651a8c1133c0d42f801576

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068

Filesize
42KB

MD5
4a42c21b1b6fdac9ef3cff08e7b7fab6

SHA1
80b8b8cc63340335534b3edff16cbc9081b96960

SHA256
67d0ff9b55e8d4ddf3fe9130a62565420d8989b8dbe3de94c74cace94f183bbf

SHA512
376c4c1c32f30a8b2ac279dd6f53b66256945ad1aee00b26b96a00d9c39eafcca1b3517b66f8bcb351fec2edaa5326bd63277d1f8d03fe2c849791133e3f2d06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069

Filesize
38KB

MD5
b8103746b4757c6332fe545f11de8f70

SHA1
588965d6333eb015af39c7f44ce71dfac67fb0f7

SHA256
4177d563a186175d3a67091c399db6c57fc271e202406e244d4bc8ad95b1aebd

SHA512
c83bd52d674d90752dfffeb76971a4f9684054d6f02cfdbe8f336758ac46d8b430f306cc64be00112b8c38d191afd1b8395d58600b12cefcb6a052ab70214ebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a

Filesize
37KB

MD5
9a0f2fed78beabcb1af818103e79eb49

SHA1
e36dcc0472152bec227a1f5a81b5024ff3624452

SHA256
bc3ea6c39f4b013cb279391c0adbbd540219cae079703926d37a82dab9046450

SHA512
c4a96707d57cb474f45d669a52e31cc4f34e783b3600781c683c88d470cc6f6c3a5c5a399af33b8a193c57df87e797087fab9f6817048baec5a75e44ff835c6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b

Filesize
21KB

MD5
eb5f2f8b27b3794eb0b9d7302f3ed208

SHA1
ceb14ae185daed71ebd356c06f067ee90ca75a3a

SHA256
16a56eb5759e2174470278fec544af28e58f93a2e895141c140eef9409efeb60

SHA512
4c1441f9bc16c6c03df5c727c75e238d41aa24127904f86d18eb755564765eed86674de1d6d19406c2f9085454bbaa26c9b65f31973a364906878a9fa4688eb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c

Filesize
21KB

MD5
80678f6ed41a38a6699c82db27d6b3f5

SHA1
fbed73e70a8aa5b813ea71407a57031a1c039488

SHA256
8631146d86ef18d86fa4e2b65830fc0c6be52b7c597edc7c52a79dbdee9496fe

SHA512
327857df5211502f252ddbb511d30779ba1fcfa6743d172927033bbee016dc5a6d394e72d81fa9c1b5c326d2f121b74e2b8f30603ddcdb4d491e7af087e37b13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d

Filesize
27KB

MD5
482e69a70bd0db3690f0422498dbfe51

SHA1
03d8c267e5f48ccc5f4e781e82c7e443e354794e

SHA256
e24cd258636323a750f60e58600f3cfda0f90cea73d9fd79294b5748b7d2ef6f

SHA512
862300384a8d6218654f7c231e9627b3ec3744817bcf4267008cad979d17f413ff06f5e7c84c822683c4a36676e92aa85bbb9d6216ae3f8187a5e2c710938de5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e

Filesize
18KB

MD5
89ee4d8818e8a732f16be7086b4bf894

SHA1
2cc00669ddc0f4e33c95a926089cea5c1f7b9371

SHA256
f6a0dfa58a63ca96a9c7e2e1244fcff6aea5d14348596d6b42cd750030481b82

SHA512
89cc7dfae78985f32e9c82521b46e6a66c22258ebe70063d05f5eb25f941b2fd52df6e1938b20fe6c2e166faa2306526fdf74b398b35483f87b556a052b34c5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f

Filesize
18KB

MD5
84c3ce1d3d0b1d971e3d3f239f877830

SHA1
0cc932781f7bac01196ab2ce181ff298b98bd0ee

SHA256
ada01876fc7687a6fe35fafd68fc071adef5bcbf87323635bf985878a67b973a

SHA512
77df6eb947b861b4d5ee4c1dd1abb3f89d4a24170edc1fc4bc2460eabfb92accd687384d2ed9891bb9f1bedcb52d6f583d4604ce5c924a1e91249b8632e2f558

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070

Filesize
16KB

MD5
dde035d148d344c412bd7ba8016cf9c6

SHA1
fb923138d1cde1f7876d03ca9d30d1accbcf6f34

SHA256
bcff459088f46809fba3c1d46ee97b79675c44f589293d1d661192cf41c05da9

SHA512
87843b8eb37be13e746eb05583441cb4a6e16c3d199788c457672e29fdadc501fc25245095b73cf7712e611f5ff40b37e27fca5ec3fa9eb26d94c546af8b2bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071

Filesize
60KB

MD5
71fe7e61e7b9075031b40a1905c31c77

SHA1
1b19ccdc0f0d3b5e40673397ce71b6589eaeea59

SHA256
5438d062ba58c782f2aec6cc59b09d276cced94918e5cd9155dddf3326051e4c

SHA512
0426864ac6a35c06d7604d3114fb55972c772304d196f412bbbfc4aac0dcaec8acd7782abc223392aaf3a4f196da4a47968b420348d9a78b72a69e0f96c5127a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072

Filesize
45KB

MD5
4dbcb483e57db903c4e2b0ade4ef157e

SHA1
97ce0b9911d353c8f68a18429ee6000af2440897

SHA256
bb92dae15cae348977d29d480aa14b1c320930a1b3375857e6120f3f160a00d9

SHA512
dd6efccec52900da1c4f92738ebfe2f1fccfbf9091e89a0bf35787ce5787d4937c6f77bae5b06c79505e8b1fccc395e37bbba08a0a9f37bd435c8dfcaedbf78c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073

Filesize
55KB

MD5
92e42e747b8ca4fc0482f2d337598e72

SHA1
671d883f0ea3ead2f8951dc915dacea6ec7b7feb

SHA256
18f8f1914e86317d047fd704432fa4d293c2e93aec821d54efdd9a0d8b639733

SHA512
d544fbc039213b3aa6ed40072ce7ccd6e84701dca7a5d0b74dc5a6bfb847063996dfea1915a089f2188f3f68b35b75d83d77856fa3a3b56b7fc661fc49126627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074

Filesize
87KB

MD5
65b0f915e780d51aa0bca6313a034f32

SHA1
3dd3659cfd5d3fe3adc95e447a0d23c214a3f580

SHA256
27f0d8282b7347ae6cd6d5a980d70020b68cace0fbe53ad32048f314a86d4f16

SHA512
e5af841fd4266710d181a114a10585428c1572eb0cd4538be765f9f76019a1f3ea20e594a7ee384d219a30a1d958c482f5b1920551235941eec1bcacd01e4b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075

Filesize
110KB

MD5
212fb70cc1811eed57c5aaf5bc070dcf

SHA1
94ec17177f218c87d58828020705ba19a054b364

SHA256
f570fc5a000981d30666094c0820795186217dc40768d082e38b47c556fb4b4e

SHA512
69b4257439e14d4fa0ce55c70deb8f21e5ffd259f149b3a31c7feb284d7e28305cca0fd54faca0b5bea451abc6c0fb6c1a1b9471ef8cfc267605781d9745c0eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076

Filesize
67KB

MD5
2701f8d127a892639d6f923ee1cfae68

SHA1
c893abb7368638b1b0082da5c9ea8549936c87cc

SHA256
13a1b413eca2ca3d863393c6f5ab48893bce7bba59072a062aee57517fb715f4

SHA512
afefbba5768323c3c9057b031358aa6011dad394fa5859b78ff84c96f454f6ae0a91610f672da24f3c2a72eff3a5bd7ddef249e13553188bb609543ab0238dd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077

Filesize
16KB

MD5
dc491f2e34e1eb5974c0781d49b8cbaf

SHA1
b73ca9b5f9c627d49da4ecbc3455192e4b305a3f

SHA256
f956049f0d96d455a71003eba400cb94f7067bc52620cd05b81006ecfdd438d8

SHA512
5c9bd0d5c93a05ca76eb727328a0fde40f2be7fe53b6b6c9eb260e8f20f92cfc831fd4b46f954d85baf151ae8aba1cdd6f76b0faf96217922cad844c905f3645

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078

Filesize
19KB

MD5
5e5ae2374ea57ea153558afd1c2c1372

SHA1
c1bef73c5b67c8866a607e3b8912ffa532d85ccc

SHA256
1ef458d087e95119808d5e5fecbc9604d7805ea4da98170e2c995e967da308f3

SHA512
46059e4a334e0a5295ebcef8401eb94b8fa0971b200f0f9e788ed61edae5018c917efd30b01631cbd6bdadc5240c9fcad2966ea0aa9c94b538bcc369e10bbbaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
7eeaec3f452e7fe2cb515a200d185333

SHA1
0079f33ba80f1f8cc55b63b17342a6b8cdb3daa1

SHA256
dce6b546efcbd13dc493a7bf960a0d623d3ce65f50533e81aaf19a9f5c53af85

SHA512
fba41c778e22ecd369ff264611f115c6f8f6cf6e2f1376c9802387a4153310f2a34db995e415ce6aeb8144fcd57e4abc7895cee4f71e114412a6206051f12503

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe581846.TMP

Filesize
3KB

MD5
e9388dd5d3b8bc6a7720d74048271a8d

SHA1
c748d1a19ec4cb3cc534e675fc58e603275d71bc

SHA256
5315619f5b0ebb5054390e07ef8055940c65fef0dd31d87a9d9fac036054e53d

SHA512
8bb61e83b90bab11180ae1fc3c4c3f9983e77d06a39ffcc789f69e3a78f7a2e1c5413739b6502fe5c06687eb6bea50f594d0af4862c716a2a43035c0ecdec4d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1

Filesize
264KB

MD5
95764cccb0b6a4896989f896ba522a69

SHA1
6c14006c1a6816be4a23c5a86ef3c7f87c51cb47

SHA256
5de9a603af0b38b7dcc2bf8e0921324c897cf47cec87ceb8a36b266019a93422

SHA512
fe7eca144772b52e7ed84ab4f35778192107468d3afac5689ca3b18c4102cddc3b50fd120e338ce0c78895a1cbb2d75e2cb02f4fcbe04c1c49c75c4c416a4959

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
dd7bf140fcb2caabaf499f6f450b2f15

SHA1
4fb18dfa0a2c05330f53c710d453f1662e74c3ac

SHA256
1b9faaf367b5f6c4bccf911f48586cb8ec9ee20a21a98489ed836621a69c23f2

SHA512
63c307ba59a7b56657da3aa245e3052cc593a47279146971fc8bd3846456487cdf8947987a448f0990d41c20f73e2a4167ad9c234ac84051677a8faa651356fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
bd3cc2ee68ea8e85d04efc6223cb813e

SHA1
dec63cc7e1b52aff5337aca46a2ec68530faa6d0

SHA256
9f8335515d279ec50741f31b2f365096d209f75b9cf256086f18bee16d9e8a99

SHA512
9fc0f32d50a1536f464ef720f26ffd48be7ea8aab02b936d97783d96eee005baa7199186a9a81a01f6205479b35ca731156a95592326a078eb6b3a579e530fca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7b6f142e-1323-4e82-95a2-fbd075f5e1bb.tmp

Filesize
2KB

MD5
d6950f273aff5d00a503f1a7ae68a41a

SHA1
3068e099bd3bc3755d72f97d6e679b19ac2dcae6

SHA256
7436b7de3e064680f84e9dc4271e12d467be928ef7fb728517e91fcd89a62475

SHA512
55597765c36a63fadd2d365cef8860c7ce182ddc3855e081de0367d928eb3c67292a38569664f0f829f4d8232557f7b3b476e0f1b965961f78a39bda6b296fca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Filesize
20KB

MD5
e8b44633e8b0e1fe733ae9ca2fb89348

SHA1
4c90f9cb9abb986e718d9dd0e2e4db5a5fdaca9a

SHA256
1c2a6bbec0025ce5bea4e7cf1643c5c225a6bb9191402332fb7b27d539221107

SHA512
1eaa95d9164cd46cc4bc16d8b485b7af3c38b3923a93b25d69920774f23ebaf397375a25af98a7de82240f54e9c93d37e13841e4224af9968b324f30a952c122

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
ff1f2cc3c2441e0187b714cdf3c922b8

SHA1
c5112670856b0c31e05f27764f9f1fb392c8ab3f

SHA256
651fade3fabd3e79db1b6b7253575f7c1ac666bb02640c0246dcf4aeab7e7c35

SHA512
f6e6876ad3abf46afedc8c33b8b1777504ad0a54e79d3d4501c9c9a944ed30d9b3232be8246fd7dfdb58a7f8f5979a7f8093f4c2cb9abc8eacc57ec403aa6b5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
86c785d2c9996b483b611ab45839050a

SHA1
b3485b5f94d6bf41a961049b6bdb7e219bffb44d

SHA256
8bd6da9ca8610552aba79afea1604bfbc00f70ce9f3bcd09717ac4acd2040aed

SHA512
4ccf21d512dce78bea107fa24da3fbcfcc2dd0fd22d8e98b5737d7e7d602b1581147bc0096516f426409e53d1ece78bb8e181bf64b357e6b87598ab3fab8d4e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
929ad55b90e6d4629e340a29fc0f0a08

SHA1
2f123265c3fba0cdb242092c6720e74bf6afe34c

SHA256
d1ce6fa720d7c45dd2c6d1cdb3f9c320cf72459289b286d81fe8dc9fc882080c

SHA512
eb28df19c83d69bfc95d186c018f8088cb8a28d3b9823d434035ef423a1495e633f387d1f7674ca28f76c61a9fa1da63f093080cf99121d473c8abe25d7d0802

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
9c71e0d483949c48073af7aa3910d5c7

SHA1
ea78b53b0e3fdfcd1d0f7be7cb913af74a419041

SHA256
f98cb580f13b9de2c18a533c6b940cf6b33caf9a4c1f9487ae43e1eedc091132

SHA512
6eee591e3cf6eda1bf8291658737424b621b3d8b217b972e4ddc4b83446f6c8f2dead1e02dc4b9fad5e4e5d9f9a600750dacde5fd2759f1366da1d109d27fbba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
ff0bf941a2441cfc6aa485aefc92012c

SHA1
892d181e69cbd50e0d4ff9ab06d9b59391b644ab

SHA256
783b210f2cf6c88a028fb4662e1176d005906945a9337bb379cf8f141b6b3b99

SHA512
ff3665cfc7eeb37bada7f30295a8a91792ffcb76007b40bd4c8161dedc81fcd2fcd953b3ec438d1ebbeb409755b4a4af713f6568c672d12227a8155f07f67aa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
184B

MD5
2eca2c46957c9c6d9e73aeb14326c459

SHA1
85320780cecebab4f4c8a50df7f55c5a8fe5363e

SHA256
bbdb9625c4cbda48e092746094c3dccb3bf1b2d921691a848425f4e265bf7a07

SHA512
66c7335c474a85b57ab0541dbb1e26a7f8f95e8bdddcc3dfae89baf5ac07697b16f715365f6feb94153796a11e780596a6139379c05cc910282053f989d9d2dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
eee5cada593f9830397b81804fde8ca9

SHA1
e9fd37ca9ac05af1782ff074fd19f85ba50015d5

SHA256
68a5975ff389c22663a085024e60952e940bf14746b06b5515bb42f8e5b6e63b

SHA512
312009e2673e659fa1ca4fe8594271da7d6d3dc6657c9a120307943cff5a5bf33a0cac5f492a42012d17b522eb7f4cb3b384911c2a1b35f770c9d343431b04dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
46f0de9b281a2e0a7486502de859c061

SHA1
25d4ecbac866f757bcd1d108a191ba29de024829

SHA256
70269155f6ba781915c1393bd38f85e3c8957442d92417dd9b87e9111af6a0d6

SHA512
980327b205a5087700bfa35dbedf17609a1ca7646df09bc42e8b937ab21ef885f33b8d26fba17c6eaeaf0a5c0a001612cb48d731629f923c04d20e076419fae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
d71aa5032102f5eed15be04759389f98

SHA1
6ff12f9775d9ae4f84c83fb307af1f59461fabdd

SHA256
19f56d562edb8c4a38869322149c380e55e040175d8b758b258d6a6e074eba26

SHA512
edbcecae59dbba2b3510f566ba40a83c711eb8ac46e5b22e288596c6a9fdf688da5355e8307b11c7a4257d3c7b3a93e805c2a6f7a96932ef82b210a63b959b48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
0aa3c196b789892051435f76ac1d9eb0

SHA1
8d3935cb2369530fb2ff7a0e314fcc82ab956d12

SHA256
0d85374c988acf6be94b9b6b37b88b173661639b435118de9eb8e68a3e11cfd3

SHA512
8278e0106a8daf3cc48cc00ed70f2981da67c46e89d043a08097d960352a3f91634b5b18e39d4a4116ee997b1ce140870013876820df90a8954161a9b73db1b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
464B

MD5
67ac9a480257c30e96e34cc63d350361

SHA1
446f71396a309715b515ca5e4e5a4fdd9dc6b282

SHA256
e6cfc31ec907de9979ebd6c9619022d4e7251b7733aaf5d0cefb551d16e72bca

SHA512
98e0f3d2ce62cae29bd778e380778a8911f20bc23655046a489975f8928d3de7276893445850184ef035adf6fbe9c2c5fe60ab501a65c81572955d0e9b728859

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
902B

MD5
c554b26558a99bddbd84a37e00397826

SHA1
29a980808ef3a0d767380e494e1111f13ce78f36

SHA256
8a939d38d95be6ee79393ea0e3f903b1fa4ba6ba9864de200c250e33c1a4aa51

SHA512
0356b631fa1faba6f0683cbe7fab135539ec9a7ad49967d8fb25880e187b6f6dcb47727a15982315f373cc4088e7232b3df8c1d280c71bc4d4ed233b20f71b55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
18KB

MD5
00aae01d54ec8133836122729153a365

SHA1
c0acb0821bfcf9e0922eb5b1a74e983e2a7e6906

SHA256
b6961308c16cc9bb5295ca3915c13ead500434c366b13b50beae2dff410b577a

SHA512
2931e01120d1535c2f3bcd32b74347ea65c98c742e585eb4f746ae16460cc4cb7fc2d18a44672f982275e844a374c6871cbc06ec539db1d1cd1762b47699a53d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
ae0b1d20ca717755402327f771d01059

SHA1
1262c590e09c32f5032fb7d64a037a32a96b8953

SHA256
fd91bc8a0942e9cc8c33ce79caaf6fb58398d4549aa00ce959bd0928f7c6dc59

SHA512
61bb75f7408943a8cafcdf4e9e5e3fc432ee034bce05606ea18934a14e515e5f758a0924f02902c4a98b99f1143a54422b633cf12574cf7e073d35c2a8cd5204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
02f41537c0de14c12da1d2e9408197e0

SHA1
e081fca063c1c702560dcb93c3bc97cec3aee7d6

SHA256
683b408b86262230705579d585dcb58b0584c6325af5f9503cd8aa04a135b874

SHA512
ea0d4e136615fe3f64fcb2c27c0df1e77d14341a9aeed3929fb6eee7fde6a447158115ae45f057d03b2d6b8c507a7d7c2e492c65a1f8819072acac1ffac8a03b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
56KB

MD5
d67f5833e6404399ea62133f4251caa9

SHA1
4ef5c35eae881e4eb828ace1f1014e39de6cd31e

SHA256
088bd2cf6931f402e9b669da0ce4db9510629bdaab507f10f321f6db0c7fb0b0

SHA512
1204d0419a240f92f036b34f14ce28d73a202afd0c56064af30b483a895ca0314413eb84cde0b12c5577dd464fe52942a60ac0daf5bd7a72c64fe6582aaa33a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
f43a2d74f6580e7b57768a8a6027359b

SHA1
1e6882a85682cd1dc2d73e336e70a4e944db8fff

SHA256
b8c45aad8bacec2a32b7e768fb7e4292b6bf2530f21aeaaa64dcb803362c0eea

SHA512
d83587c288a258ef2c791babaaf37f18629ebd85ea37dab0e1d43990c11a3f0ea8a8f40a884a20aedc136c49938fb9c6fbfe7f0d6c021ef33b20b80407b3f91e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
21128cf093a7bca49d7731b7cc6a1f8e

SHA1
f59c259ec790567e09f2c9aba92b609fc05e9012

SHA256
fbdca4035215f4c267ff259dc6488ac0c95cc5c4bbd6397665b67e07b6e2bea0

SHA512
effab244eb7c97acd684203b275bb1d6b2448b5b5f72e19e67555a41738819e0a4800aaa82159811f293cad867fd4d51df146477b70ead1d0873524fe5eb43bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
56KB

MD5
7c131e90533607d9e1154fafeba5c874

SHA1
ea4c5bb360712b317a8ffd1e22cd97ae041d53e6

SHA256
4500df3c54b35d0e1970acc8e9722c6dc30f8988bf8e48d5a8c84012105483c1

SHA512
51335ded6f895aaf1a824503ad1c617808dc297890ddf9ed679dd92c2a91cb339237f8495083316c363dc585e0727b9cacb2b1b8d8faed4952643497d46bb9b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
b69f5649ac0a0b58e7a5ac2cefacba08

SHA1
3c1d05ce9e954d08ad3a01678344ef323b8b11c4

SHA256
ba80ea4b3d43e6ec2ef4450228b18395f7f4e1a75aa4ac12ed339fd78307b872

SHA512
afafdb230882a90c376530bedabb9e460290a995683ee8e784c0d256c9f3847fbbc9cc8d4950564e8b3ba899d979d3ee14fde604d2fede81794364e1eac1321b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
8967e400a58bee27111a4cb87a59cc54

SHA1
79f8f02aa44b5f0b075ba1df9baaeecf4985dabb

SHA256
cfdac218a78655618a22139c943887368991f37f340b485777329b2afa275190

SHA512
84b7a6e8a5e19ed31dda8daf3d8c33d249dc7462a3ee7fb6c0161919f88c1876a3fb532444ee36290b6b1c4c1fe2a620159b672f1d5b6dacce97270a2d58fc3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe582611.TMP

Filesize
392B

MD5
f51adf8d5fd7006724b03872926e0c07

SHA1
fa77a95fc329152bbc5feef5a7d4572e5228f22a

SHA256
306ccb8cae9dfa9de58a1fa875b8ec59227596cf4b57c7586f40ee7a3f28e75f

SHA512
dce99b934656500db5054406f8a8e70cff6592be02c2856bca7ed9b040017e242e4e06ca3545194a9a475301824f662dd126d6325c200f6529e54789d4128d39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Filesize
264KB

MD5
21254f7cec9bbf16f78284bfbe7effe6

SHA1
fa4eb27f80beec1b2bcbd4508905dae1e8d81007

SHA256
b9adb45c75b8b1faa4034165691ca731a9127ff931d998aff4d10e110fe29e5a

SHA512
958eb1403e691ea52f71ac7362aa792a3ba23eeb0e210eecdcd2bb7fa16657c87276b9a3d1c9d8366d6ef6fabc27d5c68bdabcd28e25fad350446fee406796ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
23KB

MD5
84b5f1bc195a6222f206b17e996603b1

SHA1
0977d729289199370a82df58e2a5979e9231dec4

SHA256
8c103258f8f41d60bb852ca9c6da03f32db9dde9b8c5a2a5e688e776619d6a98

SHA512
453ef62fa26666512bb257c5c9971ba0b87d47412a8b7256b62a61c2328141442c55f2f0183c7acfabea02285fb0dd8611dccce75635a3074857d0a6cf2a3072

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
23KB

MD5
3cc9b5ec5ece21fcf0d950c599d9401d

SHA1
ed8365131a650c57cc52a2b5f132b3ea21556e1d

SHA256
096e325dc6be5a882da01b689311fe53637ae96f67d91520e06e96a2377043df

SHA512
82f95e45f3751a89d96000487aee5ff0136ac7b6bd4666e21b46e2d12b70ded03af51ff6366d9ea33922b14d9840d29b9f8b987319fdc079d477a8800efea936

Download Submit
C:\Users\Admin\Downloads\Anap.a.exe

Filesize
16KB

MD5
0231c3a7d92ead1bad77819d5bda939d

SHA1
683523ae4b60ac43d62cac5dad05fd8b5b8b8ae0

SHA256
da1798c0a49b991fbda674f02007b0a3be4703e2b07ee540539db7e5bf983278

SHA512
e34af2a1bd8f17ddc994671db37b29728e933e62eded7aff93ab0194a813103cad9dba522388f9f67ba839196fb6ed54ce87e1bebcfd98957feb40b726a7e0c6

Download Submit
C:\Users\Admin\Downloads\Anap.a.exe:Zone.Identifier

Filesize
227B

MD5
bfc913e3cb521829879fae06de04146b

SHA1
19d7212b1a132f09b92d416f636877c4e83f7657

SHA256
af5196588c8c8d0f05aed74991b14a0184bf3105626de85074b2a7419e987a65

SHA512
a42cd06aa52893d3bad88ec5e346a524a3636cafe03cf96843149f122b9f0f9e5d114e4c4e6f59dccdfe98373766a1a36f14e160bcd3fca7b6f094740cf8dbf7

Download Submit