b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7

Analysis

max time kernel
152s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe
Size

24KB
MD5

551b14c92726248a9181b39b0052fe20
SHA1

df8797ab399a5f951940e01e951e405d8bce3878
SHA256

b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7
SHA512

021a9548923ed6897daffdb80c483a9c9cead67b7c4fd82dfe16c9243497df41f11b5ae78e4e2e78bc611649b3211ab436e6f544986255147a5033eeb5046519
SSDEEP

192:NMwcvY7gE9Juk0/f9UGdcjCjI/kKteDK0sQJEGO:SwwEJ9JukKfyBmkHeDK0sQ2GO

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4f867d42-b3df-4132-8161-c3f503ceaffe.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221021113602.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
5036	msedge.exe
5036	msedge.exe
372	msedge.exe
372	msedge.exe
4732	identity_helper.exe
4732	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
372	msedge.exe
372	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2864	b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 4456	2864	b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe	83
PID 2864 wrote to memory of 4456	2864	b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe	83
PID 2864 wrote to memory of 4456	2864	b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe	83
PID 2864 wrote to memory of 408	2864	b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe	85
PID 2864 wrote to memory of 408	2864	b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe	85
PID 2864 wrote to memory of 408	2864	b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe	85
PID 4760 wrote to memory of 372	4760	explorer.exe	88
PID 4760 wrote to memory of 372	4760	explorer.exe	88
PID 444 wrote to memory of 2044	444	explorer.exe	87
PID 444 wrote to memory of 2044	444	explorer.exe	87
PID 372 wrote to memory of 5044	372	msedge.exe	93
PID 372 wrote to memory of 5044	372	msedge.exe	93
PID 2044 wrote to memory of 3784	2044	msedge.exe	92
PID 2044 wrote to memory of 3784	2044	msedge.exe	92
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 2044 wrote to memory of 812	2044	msedge.exe	96
PID 372 wrote to memory of 1096	372	msedge.exe	97
PID 372 wrote to memory of 1096	372	msedge.exe	97
PID 372 wrote to memory of 1096	372	msedge.exe	97
PID 372 wrote to memory of 1096	372	msedge.exe	97
PID 372 wrote to memory of 1096	372	msedge.exe	97
PID 372 wrote to memory of 1096	372	msedge.exe	97
PID 372 wrote to memory of 1096	372	msedge.exe	97
PID 372 wrote to memory of 1096	372	msedge.exe	97
PID 372 wrote to memory of 1096	372	msedge.exe	97
PID 372 wrote to memory of 1096	372	msedge.exe	97
PID 372 wrote to memory of 1096	372	msedge.exe	97
PID 372 wrote to memory of 1096	372	msedge.exe	97
PID 372 wrote to memory of 1096	372	msedge.exe	97
PID 372 wrote to memory of 1096	372	msedge.exe	97
PID 372 wrote to memory of 1096	372	msedge.exe	97
PID 372 wrote to memory of 1096	372	msedge.exe	97
PID 372 wrote to memory of 1096	372	msedge.exe	97
PID 372 wrote to memory of 1096	372	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe
"C:\Users\Admin\AppData\Local\Temp\b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe "http://www.netgy.com/cpm/10102/10194.jsp?s=11054&dm=2"
  2⤵
  PID:4456
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe "http://u.772268.com/gg/1026.html"
  2⤵
  PID:408

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.netgy.com/cpm/10102/10194.jsp?s=11054&dm=2
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8a51f46f8,0x7ff8a51f4708,0x7ff8a51f4718
    3⤵
    PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5929422532699735250,8758523310640194666,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,5929422532699735250,8758523310640194666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1020

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://u.772268.com/gg/1026.html
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a51f46f8,0x7ff8a51f4708,0x7ff8a51f4718
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11183314703417925512,11446716652089445323,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
    3⤵
    PID:1096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,11183314703417925512,11446716652089445323,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,11183314703417925512,11446716652089445323,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2476 /prefetch:8
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11183314703417925512,11446716652089445323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11183314703417925512,11446716652089445323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11183314703417925512,11446716652089445323,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11183314703417925512,11446716652089445323,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1976 /prefetch:1
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11183314703417925512,11446716652089445323,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2164,11183314703417925512,11446716652089445323,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6740 /prefetch:8
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11183314703417925512,11446716652089445323,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:1
    3⤵
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11183314703417925512,11446716652089445323,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
    3⤵
    PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,11183314703417925512,11446716652089445323,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
    3⤵
    PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:3084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff754cb5460,0x7ff754cb5470,0x7ff754cb5480
      4⤵
      PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,11183314703417925512,11446716652089445323,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Filesize
471B

MD5
7273d2930f2bfd75fd0b30c1161e3368

SHA1
e3fdac8001c01ad8bc341d85157b975dd191242e

SHA256
828ae145e65a50f2edd94772b03047d901f821cfb7d05bf5fd4a554925f3db65

SHA512
d8b6d61bf8df4dc008606208f35aa46fb1e444216a2e5c27908f721f0fca2f2d5a8df59317ecca95d8f2b33d347a8b03883f910b649c8f14cf68b6d3252407b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Filesize
442B

MD5
0102ca4010df4ba475f7e9893ac51b17

SHA1
251e4622496f2f86ff371aa50bf82cde9aa9a22b

SHA256
c29d19fecb09493221c770acbb62b7ccbc1e43466b275172191a7c5e0fc7c084

SHA512
3d0042ae9eb565058a501562e7f9ad5ef7ac89ed9366862fb698236043582c55e98d7deb59c745573fb27b9c1f64fc67d2688fa2c87214c75dd75ee289634d30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
8cc378a40142f7ed93e5d103a6125340

SHA1
033c4638fc20308f0f8b0f4169e00e62ecd6a60f

SHA256
d469fe1ee12f7262de0a0fd213897544646a1cd4b3b3c7b6d32faf225f4f11ac

SHA512
c2794d7ae217d70e94224b27f99f6a149c4f35825ee910d571dedb42a98b8d2306ef2a997c943727319e2748f5ea11db270f59d5563feb7f3d2e59b9227f78e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
d21c41ae2fad1ab98e952519802718e8

SHA1
0f16ea622195c4b0617e4f06e0b974d6181f1931

SHA256
f65bfe2ff66fc1e4af0313b9a022a459aec3dca4396fa1971fcf4c2108417507

SHA512
fd755f05c5b7657c4b351c69635f69a3a00422811bf61eb168caa6e2aaf787e8691d12d4797813f87015af0b382f85e142f96fe4468854134982b56497ece7e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
8cc378a40142f7ed93e5d103a6125340

SHA1
033c4638fc20308f0f8b0f4169e00e62ecd6a60f

SHA256
d469fe1ee12f7262de0a0fd213897544646a1cd4b3b3c7b6d32faf225f4f11ac

SHA512
c2794d7ae217d70e94224b27f99f6a149c4f35825ee910d571dedb42a98b8d2306ef2a997c943727319e2748f5ea11db270f59d5563feb7f3d2e59b9227f78e5

Download Submit