ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5

Analysis

max time kernel
148s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 13:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
Size

176KB
MD5

da322a471ad1833c168ceb738a781b29
SHA1

8ab09c58f7b301ccf2d679f1c415b2bde3e22a25
SHA256

ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5
SHA512

9e9a9616788cb16e3b011889e77e24d2f6f976ebe9925a8fde50c9b68207ba26b6a3052dac862a8bb068117e35e5bdf82d5123461c48c019169b718671c96f2b
SSDEEP

3072:MlRn2s7yyhnlhxi80WgYgD6KGaD48/xFw4k6Kr8SbEX:K7yyp/el7z

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\Y:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\Z:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\J:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\L:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\N:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\S:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\K:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\O:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\P:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\R:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\B:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\E:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\F:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\H:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\V:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\W:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\I:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\Q:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\U:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\X:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\A:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\G:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
File opened (read-only)	\??\M:	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4716	msedge.exe
4716	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3352	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
Token: SeCreatePagefilePrivilege	3352	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3352	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
3352	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 4016	3352	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe	81
PID 3352 wrote to memory of 4016	3352	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe	81
PID 3352 wrote to memory of 988	3352	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe	82
PID 3352 wrote to memory of 988	3352	ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe	82
PID 4016 wrote to memory of 4560	4016	msedge.exe	84
PID 4016 wrote to memory of 4560	4016	msedge.exe	84
PID 988 wrote to memory of 2856	988	msedge.exe	83
PID 988 wrote to memory of 2856	988	msedge.exe	83
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 4016 wrote to memory of 4396	4016	msedge.exe	87
PID 988 wrote to memory of 4008	988	msedge.exe	88
PID 988 wrote to memory of 4008	988	msedge.exe	88
PID 988 wrote to memory of 4008	988	msedge.exe	88
PID 988 wrote to memory of 4008	988	msedge.exe	88
PID 988 wrote to memory of 4008	988	msedge.exe	88
PID 988 wrote to memory of 4008	988	msedge.exe	88
PID 988 wrote to memory of 4008	988	msedge.exe	88
PID 988 wrote to memory of 4008	988	msedge.exe	88
PID 988 wrote to memory of 4008	988	msedge.exe	88
PID 988 wrote to memory of 4008	988	msedge.exe	88
PID 988 wrote to memory of 4008	988	msedge.exe	88
PID 988 wrote to memory of 4008	988	msedge.exe	88
PID 988 wrote to memory of 4008	988	msedge.exe	88
PID 988 wrote to memory of 4008	988	msedge.exe	88
PID 988 wrote to memory of 4008	988	msedge.exe	88
PID 988 wrote to memory of 4008	988	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe
"C:\Users\Admin\AppData\Local\Temp\ad75e159d457c87bfab91ac01a80c7dec051c1b27b10109fc024f4b0444cafd5.exe"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://zamzamcyber.blogspot.com/
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd4,0xfc,0x100,0xe0,0x104,0x7ffd78d446f8,0x7ffd78d44708,0x7ffd78d44718
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,11812793936424388136,5192400553957613819,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
    3⤵
    PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,11812793936424388136,5192400553957613819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,11812793936424388136,5192400553957613819,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2512 /prefetch:8
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11812793936424388136,5192400553957613819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
    3⤵
    PID:2176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11812793936424388136,5192400553957613819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11812793936424388136,5192400553957613819,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
    3⤵
    PID:1496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2160,11812793936424388136,5192400553957613819,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5456 /prefetch:8
    3⤵
    PID:1664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11812793936424388136,5192400553957613819,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:2140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11812793936424388136,5192400553957613819,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
    3⤵
    PID:308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11812793936424388136,5192400553957613819,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
    3⤵
    PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.facebook.com/profile.php?id=100002541393938
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd78d446f8,0x7ffd78d44708,0x7ffd78d44718
    3⤵
    PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,7460417211514669405,16631315162853013300,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,7460417211514669405,16631315162853013300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
720a883e30b6a23527b5fa16bde55748

SHA1
9a861ec1a7c4977747a4c19a160253308e3bb895

SHA256
a557052c8609bec0817e5a8998dfbd7a363e96734e1d5655a3d224489caa154c

SHA512
206a15b7b30363840f9ae63b74f948195e3c951a6ff15518bd82845fe3e3142021e7716151f409fff953bd51721b72ca0097ebaa28239348ca5ee28bc1a575cc

Download Submit