e6c1a4c13470ef2b82a4f1c6a356716503341ee86845f4a045858ddebb1f5921

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2023, 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6c1a4c13470ef2b82a4f1c6a356716503341ee86845f4a045858ddebb1f5921.exe
Size

1.6MB
MD5

c4ce97ea0e5f20d174769e2d3ec1e57e
SHA1

da353a2aee507e6213a2d3f79e596e59f28b3efb
SHA256

e6c1a4c13470ef2b82a4f1c6a356716503341ee86845f4a045858ddebb1f5921
SHA512

fdc549ad19d84c9a5e59502a06d6c6ef0195c2688b8df2e46e0d5b3888bbfd22c62affba3fc1c5af62f08c4065a2f8f0daef8a43854c5ea25be45e972973daf5
SSDEEP

24576:v1tqdnuoct39hSck7xKUgvW6po1exWtfjJWMvpHt/W0yoG3uPH:vCUoM4ckHY6kxQfjJLvpRxPH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
228	e6c1a4c13470ef2b82a4f1c6a356716503341ee86845f4a045858ddebb1f5921.exe
228	e6c1a4c13470ef2b82a4f1c6a356716503341ee86845f4a045858ddebb1f5921.exe
228	e6c1a4c13470ef2b82a4f1c6a356716503341ee86845f4a045858ddebb1f5921.exe
228	e6c1a4c13470ef2b82a4f1c6a356716503341ee86845f4a045858ddebb1f5921.exe
1712	msedge.exe
1712	msedge.exe
2612	msedge.exe
2612	msedge.exe
1268	msedge.exe
1268	msedge.exe
768	identity_helper.exe
768	identity_helper.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
228	e6c1a4c13470ef2b82a4f1c6a356716503341ee86845f4a045858ddebb1f5921.exe
228	e6c1a4c13470ef2b82a4f1c6a356716503341ee86845f4a045858ddebb1f5921.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 1868	228	e6c1a4c13470ef2b82a4f1c6a356716503341ee86845f4a045858ddebb1f5921.exe	91
PID 228 wrote to memory of 1868	228	e6c1a4c13470ef2b82a4f1c6a356716503341ee86845f4a045858ddebb1f5921.exe	91
PID 1868 wrote to memory of 3020	1868	msedge.exe	92
PID 1868 wrote to memory of 3020	1868	msedge.exe	92
PID 228 wrote to memory of 1268	228	e6c1a4c13470ef2b82a4f1c6a356716503341ee86845f4a045858ddebb1f5921.exe	93
PID 228 wrote to memory of 1268	228	e6c1a4c13470ef2b82a4f1c6a356716503341ee86845f4a045858ddebb1f5921.exe	93
PID 1268 wrote to memory of 4408	1268	msedge.exe	94
PID 1268 wrote to memory of 4408	1268	msedge.exe	94
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1268 wrote to memory of 2728	1268	msedge.exe	95
PID 1868 wrote to memory of 888	1868	msedge.exe	96
PID 1868 wrote to memory of 888	1868	msedge.exe	96
PID 1868 wrote to memory of 888	1868	msedge.exe	96
PID 1868 wrote to memory of 888	1868	msedge.exe	96
PID 1868 wrote to memory of 888	1868	msedge.exe	96
PID 1868 wrote to memory of 888	1868	msedge.exe	96
PID 1868 wrote to memory of 888	1868	msedge.exe	96
PID 1868 wrote to memory of 888	1868	msedge.exe	96
PID 1868 wrote to memory of 888	1868	msedge.exe	96
PID 1868 wrote to memory of 888	1868	msedge.exe	96
PID 1868 wrote to memory of 888	1868	msedge.exe	96
PID 1868 wrote to memory of 888	1868	msedge.exe	96
PID 1868 wrote to memory of 888	1868	msedge.exe	96
PID 1868 wrote to memory of 888	1868	msedge.exe	96
PID 1868 wrote to memory of 888	1868	msedge.exe	96
PID 1868 wrote to memory of 888	1868	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\e6c1a4c13470ef2b82a4f1c6a356716503341ee86845f4a045858ddebb1f5921.exe
"C:\Users\Admin\AppData\Local\Temp\e6c1a4c13470ef2b82a4f1c6a356716503341ee86845f4a045858ddebb1f5921.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://kolostudio.fun/2022/10/kolo%e4%ba%91%e5%ae%89%e5%85%a8%e8%ae%a1%e5%88%92%e9%9a%90%e7%a7%81%e7%94%b3%e6%98%8e/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffebbf946f8,0x7ffebbf94708,0x7ffebbf94718
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13048591788484061770,9133053278553574955,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
    3⤵
    PID:888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,13048591788484061770,9133053278553574955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.kolostudio.fun/2022/11/kolomina-anti-virus%e8%bd%af%e4%bb%b6%e8%87%aa%e5%8a%a8%e6%9b%b4%e6%96%b0%e6%9c%8d%e5%8a%a1%e9%9a%90%e7%a7%81%e6%94%bf%e7%ad%96/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffebbf946f8,0x7ffebbf94708,0x7ffebbf94718
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15584659960247627643,3370610261649704412,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,15584659960247627643,3370610261649704412,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
    3⤵
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,15584659960247627643,3370610261649704412,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15584659960247627643,3370610261649704412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:2796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15584659960247627643,3370610261649704412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:1452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15584659960247627643,3370610261649704412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4360 /prefetch:1
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,15584659960247627643,3370610261649704412,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
    3⤵
    PID:3032
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,15584659960247627643,3370610261649704412,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15584659960247627643,3370610261649704412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15584659960247627643,3370610261649704412,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15584659960247627643,3370610261649704412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4420 /prefetch:1
    3⤵
    PID:456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15584659960247627643,3370610261649704412,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15584659960247627643,3370610261649704412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15584659960247627643,3370610261649704412,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2376 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a87c8dba0154bb9bef5be9c239bf17

SHA1
1c653df4130926b5a1dcab0b111066c006ac82ab

SHA256
5071c9de822e09f2182f66ab806551c02f87e20d160a4923ca1d9763194f2cb5

SHA512
bb4f876fc8a88e480d2d82062b003d2769b75a6cb1a960173bd6b34925a27b1189402677d9124b6445ded6edc3a07ff0e314b71150684e96bc6614185c2e2f49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
25929fbd22abf5305c557939071ad7a2

SHA1
aeaa1cb1c0b06fc6d38c927032918886a2fca93a

SHA256
9dc054ca873d6f23bedfead5244b237579599b1e95c6eba2ab3bb978f1e951d1

SHA512
adfe88377e0b560b56edbad144d16d690a1b7644774933c1bcabb501a6b24ee1c0ba8b937731c3f7f87edc1b49f42cb759e6f088eeef408b9b312324329a7312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
557B

MD5
4a5e6f5687470521dfc865942e0cedc8

SHA1
bbfc9e1c15eb0aa5b6e3236c2c7b7b6563266eca

SHA256
82d08276da8782b7061f0d98e1de02d8fb1d160340611da43fabe888b3804daf

SHA512
061c3975778158112b3ec1600f889989899bec03771ff14d8624aad10b1a779693e6460a0b5442f30796f3ecb62e64b52943f34d7ee22cea4bbca73912168e7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a486bf0b8634b99b888859f932184fdb

SHA1
cf8495f915b30a703598e63f5bee4e7e07ced961

SHA256
3a6ed79b929047f5f9a8b48dd37164640a7a8f969dd5a1228957710fc797df4b

SHA512
4cfd649ccde7d45a78ada4546dbf9a2fd138a06f3dd6791713b036b8b818f6642c376bb9a4e62d6e0f57fba7861603de0544c34f9c33281abea903f114a1754b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
54ecf91ca8a7259142bc2f49c35d9b36

SHA1
a40fbdde832d5a5f5329b34057ecc541a4c8ca86

SHA256
8b8e3af65615787c9837266aa95467e689e01fa1aba03264605378d1a80c72e3

SHA512
2a570c812f621906b5f36dddc9d6005151db9ab2a30c2502401a24cf78c5cab2361fcf2cd185b037edf117395cd3cf2ba012d48340c45ed1af9001b65ed35033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3a748249c8b0e04e77ad0d6723e564ff

SHA1
5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729

SHA256
f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed

SHA512
53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
0f184cd19184da3ff6c6efc59b6f52ce

SHA1
bbda5eaccd20f434e7735710fcfe4c2bf44c6c16

SHA256
f560a9dce8d96c3f05325bbac27e6691755ff86080c0f06f6cde5c1722fe7f98

SHA512
14b3a7ff5ea76f047ba570b127e40bfba4aeb20859a851794145694559788a1c7c41bd67e3cb1bb3c6b53dcf29c34fd1b40668eeb1d7ee31b48d22f5f2aca313

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
0f184cd19184da3ff6c6efc59b6f52ce

SHA1
bbda5eaccd20f434e7735710fcfe4c2bf44c6c16

SHA256
f560a9dce8d96c3f05325bbac27e6691755ff86080c0f06f6cde5c1722fe7f98

SHA512
14b3a7ff5ea76f047ba570b127e40bfba4aeb20859a851794145694559788a1c7c41bd67e3cb1bb3c6b53dcf29c34fd1b40668eeb1d7ee31b48d22f5f2aca313

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7c140e7a0ce24ab0d65c982178962687

SHA1
d6de51b202f8eca022dae98f91eeddb6f87c7f3b

SHA256
35e7df421dcba28ce6885afdd4ca80b6d5cc26ad27c9241413364602d0531cfc

SHA512
1c645131122865c17591bb4654de8815610b825b5e1272fb640c37cf47e36557c24e55ddd33a62826aa6ef1c04643d8d632787e2813d885f964e004ed9012b69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
85c775ac9f10bc15cc74146ef2200108

SHA1
43be793adf176aca53024abbf14541e12cca2948

SHA256
c899f11372545363d45a3ea94eec628ddf6092aac39ee6ee17424732ceb5a233

SHA512
c6ab18032524991cf034d48755fe4aa7ac07425911c8e68a6abf72f082e4772f917fc9fcdd3c2382b45bcfe1423a1b82bae6f0117d07160f9dec40331137dd45

Download Submit