9321f161ad77d7aceacdfac498ee2f65dd2ef6dce819908bb44c424d406e9bb5

Analysis

max time kernel
164s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
12-03-2022 07:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9321f161ad77d7aceacdfac498ee2f65dd2ef6dce819908bb44c424d406e9bb5.exe
Size

552KB
MD5

d38579402cd392fcf267654b9f18f663
SHA1

c85f52559ffa3ba902a164f85a9c770d6b49da98
SHA256

9321f161ad77d7aceacdfac498ee2f65dd2ef6dce819908bb44c424d406e9bb5
SHA512

294add7ec0d57e57578a2b2eb06d492d69fde0e6a68d9c22ea66df7198d4f13925e063d83c9d70c6cc9674945177f73cb4676b326f13e96f06a09e59a3e1497a

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

4728 msedge.exe
4728 msedge.exe
632 msedge.exe
632 msedge.exe
3380 msedge.exe
3380 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3380 msedge.exe
3380 msedge.exe
3380 msedge.exe
3380 msedge.exe
3380 msedge.exe
3380 msedge.exe
3380 msedge.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msedge.exe

pid process

3380 msedge.exe
3380 msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

pid	process
4728	msedge.exe
4728	msedge.exe
632	msedge.exe
632	msedge.exe
3380	msedge.exe
3380	msedge.exe

pid	process
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe

pid	process
3380	msedge.exe
3380	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9321f161ad77d7aceacdfac498ee2f65dd2ef6dce819908bb44c424d406e9bb5.exemsedge.exemsedge.exe

description	pid	process	target process
PID 1320 wrote to memory of 4340	1320	9321f161ad77d7aceacdfac498ee2f65dd2ef6dce819908bb44c424d406e9bb5.exe	msedge.exe
PID 1320 wrote to memory of 4340	1320	9321f161ad77d7aceacdfac498ee2f65dd2ef6dce819908bb44c424d406e9bb5.exe	msedge.exe
PID 4340 wrote to memory of 2400	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2400	4340	msedge.exe	msedge.exe
PID 1320 wrote to memory of 3380	1320	9321f161ad77d7aceacdfac498ee2f65dd2ef6dce819908bb44c424d406e9bb5.exe	msedge.exe
PID 1320 wrote to memory of 3380	1320	9321f161ad77d7aceacdfac498ee2f65dd2ef6dce819908bb44c424d406e9bb5.exe	msedge.exe
PID 3380 wrote to memory of 2168	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 2168	3380	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4108	4340	msedge.exe	msedge.exe
PID 3380 wrote to memory of 572	3380	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\9321f161ad77d7aceacdfac498ee2f65dd2ef6dce819908bb44c424d406e9bb5.exe
"C:\Users\Admin\AppData\Local\Temp\9321f161ad77d7aceacdfac498ee2f65dd2ef6dce819908bb44c424d406e9bb5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=9321f161ad77d7aceacdfac498ee2f65dd2ef6dce819908bb44c424d406e9bb5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
- Suspicious use of WriteProcessMemory
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff83b7546f8,0x7ff83b754708,0x7ff83b754718
3⤵
PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2348,11965915645302762790,9626822255198848647,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2360 /prefetch:2
3⤵
PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2348,11965915645302762790,9626822255198848647,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2676 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=9321f161ad77d7aceacdfac498ee2f65dd2ef6dce819908bb44c424d406e9bb5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff83b7546f8,0x7ff83b754708,0x7ff83b754718
3⤵
PID:2168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2344,6284318391849714556,15114862649839353213,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2348 /prefetch:2
3⤵
PID:572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2344,6284318391849714556,15114862649839353213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2656 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2344,6284318391849714556,15114862649839353213,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3180 /prefetch:8
3⤵
PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2344,6284318391849714556,15114862649839353213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:1
3⤵
PID:3044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2344,6284318391849714556,15114862649839353213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
3⤵
PID:3888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2344,6284318391849714556,15114862649839353213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4412 /prefetch:1
3⤵
PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2344,6284318391849714556,15114862649839353213,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5168 /prefetch:8
3⤵
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2344,6284318391849714556,15114862649839353213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
3⤵
PID:1812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2344,6284318391849714556,15114862649839353213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
3⤵
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2344,6284318391849714556,15114862649839353213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
3⤵
PID:2444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2344,6284318391849714556,15114862649839353213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
3⤵
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2344,6284318391849714556,15114862649839353213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6988 /prefetch:8
3⤵
PID:2600

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
3⤵
PID:4324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:4064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5
48688eaeffde1c7101b1bdc72a72b9a3

SHA1
c086a6b8524aedae9bfd2863067a75088b7a1972

SHA256
6383d0e79eb153ccf1004b3b65da09989d1d5fe62ae1935a3c42ca5102a7d9af

SHA512
f778710d5fc3a7a9657b1fd7c69d7e1e325376217eb86578c85155547804f2c9efb60cf786f0ccf0dc7a6ce169fbbe913c8b662f155213139f1e2701ddc800c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5
48688eaeffde1c7101b1bdc72a72b9a3

SHA1
c086a6b8524aedae9bfd2863067a75088b7a1972

SHA256
6383d0e79eb153ccf1004b3b65da09989d1d5fe62ae1935a3c42ca5102a7d9af

SHA512
f778710d5fc3a7a9657b1fd7c69d7e1e325376217eb86578c85155547804f2c9efb60cf786f0ccf0dc7a6ce169fbbe913c8b662f155213139f1e2701ddc800c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5
48688eaeffde1c7101b1bdc72a72b9a3

SHA1
c086a6b8524aedae9bfd2863067a75088b7a1972

SHA256
6383d0e79eb153ccf1004b3b65da09989d1d5fe62ae1935a3c42ca5102a7d9af

SHA512
f778710d5fc3a7a9657b1fd7c69d7e1e325376217eb86578c85155547804f2c9efb60cf786f0ccf0dc7a6ce169fbbe913c8b662f155213139f1e2701ddc800c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5
48688eaeffde1c7101b1bdc72a72b9a3

SHA1
c086a6b8524aedae9bfd2863067a75088b7a1972

SHA256
6383d0e79eb153ccf1004b3b65da09989d1d5fe62ae1935a3c42ca5102a7d9af

SHA512
f778710d5fc3a7a9657b1fd7c69d7e1e325376217eb86578c85155547804f2c9efb60cf786f0ccf0dc7a6ce169fbbe913c8b662f155213139f1e2701ddc800c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5
8f2b526f8b06d1befe13ac9df5f196d0

SHA1
5312747fc37ddad74957388f3aab556cffb08c3e

SHA256
9dbb8343e2da49863a8abfe10867dccfd9956ef8af848ab3aca54d9cd17a5845

SHA512
2ed4a83537a583825d77b43f8d6428c02e598e8b54cc1c66f0280acbcdbe76729718274b518cd68906c266cc1565b82fb7445aee62a063c0f2a273ca0cb5a01f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5
8f2b526f8b06d1befe13ac9df5f196d0

SHA1
5312747fc37ddad74957388f3aab556cffb08c3e

SHA256
9dbb8343e2da49863a8abfe10867dccfd9956ef8af848ab3aca54d9cd17a5845

SHA512
2ed4a83537a583825d77b43f8d6428c02e598e8b54cc1c66f0280acbcdbe76729718274b518cd68906c266cc1565b82fb7445aee62a063c0f2a273ca0cb5a01f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5
8f2b526f8b06d1befe13ac9df5f196d0

SHA1
5312747fc37ddad74957388f3aab556cffb08c3e

SHA256
9dbb8343e2da49863a8abfe10867dccfd9956ef8af848ab3aca54d9cd17a5845

SHA512
2ed4a83537a583825d77b43f8d6428c02e598e8b54cc1c66f0280acbcdbe76729718274b518cd68906c266cc1565b82fb7445aee62a063c0f2a273ca0cb5a01f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5
b0a06ada5916074351d7c37ec5b6effd

SHA1
b8cc1c3578f1f07a35aa866485089307680f832c

SHA256
5762d8fd4f5286249eb3bfc1c9582cdef89d9416a3bf6612c12151a753ab554c

SHA512
bc0eb9f03dc24281256c573a846a6791b469a510f5ddd91c18159a60d0cd54afc30294e4e7868b7daa261fb903425f47620fa709623eb304ed2ebb1a4d386785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings

MD5
f222079e71469c4d129b335b7c91355e

SHA1
0056c3003874efef229a5875742559c8c59887dc

SHA256
e713c1b13a849d759ebaa6256773f4f1d6dfc0c6a4247edaa726e0206ecacb00

SHA512
e5a49275e056b6628709cf6509a5f33f8d1d1e93125eaa6ec1c7f51be589fd3d8ea7a59b9639db586d76a994ad3dc452c7826e4ac0c8c689dd67ff90e33f0b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

MD5
6698422bea0359f6d385a4d059c47301

SHA1
b1107d1f8cc1ef600531ed87cea1c41b7be474f6

SHA256
2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

SHA512
d0cdb3fa21e03f950dbe732832e0939a4c57edc3b82adb7a556ebd3a81d219431a440357654dfea94d415ba00fd7dcbd76f49287d85978d12c224cbfa8c1ad8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris

MD5
623c281e6bd3c6bd478e7d7f17bf17e7

SHA1
3a48545aa35338288b586110e7ab7e71b32226e3

SHA256
e347bfde057c81daf17f57c7866493b0c299ddcd37cc3a5f38a0e88b8d7197c4

SHA512
9c5a2f34e5fcd981bcb73195c778751e49b4bc6d0e05d13fd793b10b8c1ffdb7cf878d8f7846a6f372b5a382e0c7b8b547b6d242d1bdee632c8daae2af505410

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_637826696321915703

MD5
a75ad0a84de13b12d2409b557a59da6a

SHA1
600a827c051c31d9d46b614acaecfb4826e93809

SHA256
89fc98c7f823ce429f8941b769b5929d7ef75fa92b8660fe5871749da8f5321a

SHA512
1187095d0c9d74119d1995c9dd623e0f0cb8210dcdccea636567e4f062c4e9708b72556ad9df476ebf814df386ef1ff49b0a94297195434217ae0bb209afb4b9

Download Submit
\??\pipe\LOCAL\crashpad_3380_KXOQMXKTYQEFYLTI

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_4340_FZDYKEJYDELVVZTI

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4108-141-0x00007FF858950000-0x00007FF858951000-memory.dmp

Filesize
4KB

Download