bc5fb25fa401e86ce6f6a91d594c5f4fa19829ae5a08a4c725fd48df9fcceb91

Analysis

max time kernel
146s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc9cf39adb79c76d1f5f35915391bfdd.exe
Size

276KB
MD5

cc9cf39adb79c76d1f5f35915391bfdd
SHA1

8f244cfee950b846a0a915d396cd5b7fbcd8d691
SHA256

bc5fb25fa401e86ce6f6a91d594c5f4fa19829ae5a08a4c725fd48df9fcceb91
SHA512

26b98c9ede7d2989e1998d3e3cedc8f78f91854d5b9cfea6e11030f5f3d425c0c7abf5c9e341d8922bb2cd361d805b9b72a70141b0e1ce5d48505518ebccc276
SSDEEP

6144:XZABbWqsE/Ao+mv8Qv0LVmwq4FU0fNoy69zCfRbvys3G8QZ:pANwRo+mv8QD4+0V16xOZ9E

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	cc9cf39adb79c76d1f5f35915391bfdd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
17	iplogger.org
20	iplogger.org

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe	cc9cf39adb79c76d1f5f35915391bfdd.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat	cc9cf39adb79c76d1f5f35915391bfdd.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.exe	cc9cf39adb79c76d1f5f35915391bfdd.exe
File created	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.ini	cc9cf39adb79c76d1f5f35915391bfdd.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Toner-Recover.exe	cc9cf39adb79c76d1f5f35915391bfdd.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj.reg	cc9cf39adb79c76d1f5f35915391bfdd.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj2.reg	cc9cf39adb79c76d1f5f35915391bfdd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Runs .reg file with regedit 2 IoCs

pid	Process
4384	regedit.exe
3440	regedit.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
336	msedge.exe
336	msedge.exe
1996	msedge.exe
1996	msedge.exe
3396	identity_helper.exe
3396	identity_helper.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 1532	4732	cc9cf39adb79c76d1f5f35915391bfdd.exe	88
PID 4732 wrote to memory of 1532	4732	cc9cf39adb79c76d1f5f35915391bfdd.exe	88
PID 4732 wrote to memory of 1532	4732	cc9cf39adb79c76d1f5f35915391bfdd.exe	88
PID 1532 wrote to memory of 4968	1532	cmd.exe	90
PID 1532 wrote to memory of 4968	1532	cmd.exe	90
PID 1532 wrote to memory of 4968	1532	cmd.exe	90
PID 2000 wrote to memory of 1996	2000	explorer.exe	92
PID 2000 wrote to memory of 1996	2000	explorer.exe	92
PID 1996 wrote to memory of 4404	1996	msedge.exe	95
PID 1996 wrote to memory of 4404	1996	msedge.exe	95
PID 1532 wrote to memory of 4384	1532	cmd.exe	97
PID 1532 wrote to memory of 4384	1532	cmd.exe	97
PID 1532 wrote to memory of 4384	1532	cmd.exe	97
PID 1532 wrote to memory of 3440	1532	cmd.exe	98
PID 1532 wrote to memory of 3440	1532	cmd.exe	98
PID 1532 wrote to memory of 3440	1532	cmd.exe	98
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 5088	1996	msedge.exe	99
PID 1996 wrote to memory of 336	1996	msedge.exe	100
PID 1996 wrote to memory of 336	1996	msedge.exe	100
PID 1996 wrote to memory of 1040	1996	msedge.exe	101
PID 1996 wrote to memory of 1040	1996	msedge.exe	101
PID 1996 wrote to memory of 1040	1996	msedge.exe	101
PID 1996 wrote to memory of 1040	1996	msedge.exe	101
PID 1996 wrote to memory of 1040	1996	msedge.exe	101
PID 1996 wrote to memory of 1040	1996	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\cc9cf39adb79c76d1f5f35915391bfdd.exe
"C:\Users\Admin\AppData\Local\Temp\cc9cf39adb79c76d1f5f35915391bfdd.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\explorer.exe
    explorer https://iplogger.org/2z2qb6
    3⤵
    PID:4968
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s adj.reg
    3⤵
    - Runs .reg file with regedit
    PID:4384
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s adj2.reg
    3⤵
    - Runs .reg file with regedit
    PID:3440

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/2z2qb6
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd8ca46f8,0x7fffd8ca4708,0x7fffd8ca4718
    3⤵
    PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,11866946878697375994,12403596579767124508,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
    3⤵
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,11866946878697375994,12403596579767124508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,11866946878697375994,12403596579767124508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
    3⤵
    PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,11866946878697375994,12403596579767124508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,11866946878697375994,12403596579767124508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,11866946878697375994,12403596579767124508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,11866946878697375994,12403596579767124508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,11866946878697375994,12403596579767124508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,11866946878697375994,12403596579767124508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
    3⤵
    PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,11866946878697375994,12403596579767124508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3600 /prefetch:8
    3⤵
    PID:1828
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,11866946878697375994,12403596579767124508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3600 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,11866946878697375994,12403596579767124508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,11866946878697375994,12403596579767124508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,11866946878697375994,12403596579767124508,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3008 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj.reg

Filesize
143B

MD5
d47d2f19c6485d61826df03b0b6efd7d

SHA1
a3285ea2c8072a5c9b7b2ff0e255343baab2d81e

SHA256
f702cbfc518787caec26189a065e1dfd92c62597d8cd22c58e889151e45a635f

SHA512
17fa33c12395da633deb03181bf383e56cb3f40ef0f2fcc4802d0f46829dbce0e65528f4b6b5dfdd88d28aa40502df8a826894ff21a12e18558cd0cc4fe7bf94

Download Submit
C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj2.reg

Filesize
114B

MD5
81b371bfb7d48f53e6dce6a3b05f76ba

SHA1
a073408555dfd110183313e2b1d41c3a8dfdd4ee

SHA256
0fd594d185676181e86c3fb81be116069acb86b6c5839a73b9d5fb197924fd94

SHA512
34bf59556bf238e0d15d6f934c8caf28c3313bbadad984370e1f912d2a1e4a1ce6b3e06f7bc5af01df28a2e321b43bfc100f61330c89ec4270dbb4120e5764cc

Download Submit
C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat

Filesize
77B

MD5
7b56202dcc8e327bd43d512dd600bf3b

SHA1
c2b949792b0fa4236eb31f7e7a67484a62bb2419

SHA256
368c4e6b9a76e9d3490e8ad292e66d61e097af7dd414710879227cd38ce96015

SHA512
4448fefbb473d8b161ebd0485d2690def8078ebac3debba962d36b2ed73fefa3cb126d3cacecd82091c35d95af380566bd67b5eef316594bf3602f4fa70a6bf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
198KB

MD5
06d38d9bf028710762491328778f9db6

SHA1
83e1b6cbaad5ca5f6dc63453da324f8df28de193

SHA256
91558d69c027808e375e11c80166dc6ba245fbcfce715c9588decc55b4a33dad

SHA512
b197e5f92add72688396a07246ee9842a3b0de36508aa57f0254531cb109c77d0392e00ea28e006f9fbab1b8fee9b333998946de47ca7526b631e8c810780781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
ae8d5686052711adb8290edd9e14a6c8

SHA1
76fcc43e4861091a223f7f204a100b70f2157d0b

SHA256
ade8ae80e066b18148adf89433f93405b9bdeade822c1cf3f89372e4ae4b4657

SHA512
c9e3e393ee6736fb137208fa21770ab3fb9d803d680f43814c8b8dc269eafc66e3a4ec49883d5ec355fa9130e6bee0a37870a38c8a1e26e37f81c43f92bcab4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
885B

MD5
39f4c3a92a43aa92e571ac07ac1fbded

SHA1
118f968294d1ae80e547fb2655d7a2ace07708a1

SHA256
553f2fa7006868d2fed1a0b7664c68c4b2700e3cef8ac2d5f554085074a1b682

SHA512
3568a3f912d83598ccd3d6d8e9bdee8d50d41a21b375a1b85b2314eeaa649bd4e52aaa0f2c637bb7c1ff53f62f711fa3560e7e08360276ccff8e939a0241ec1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a0e62bbbd4ff66f3d679fe6da3c8e0a5

SHA1
6a8b0206e8a666cdb0d65ee2cccde13138a6ed40

SHA256
2b3a4e453d3ce23f41627b02cd68f7fc257951ef1e3facdec1462728acda2d16

SHA512
620442078e76c7216d81edab3f9536c296ed15cf2ab1cff04d6b4cb5b8f5c17b89d51e540c72fd6e35cc503326adaef9f04ab66d9a77bd17c5bc4e6491530345

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ecd5e2e00f050cf467593ff9d686e9df

SHA1
e9a8165e2f2efcab43f2e44dc5c374b1346e847f

SHA256
20071879ebf198461c0334ea59f108f07f01f95d2f67030e318ec26f9512e822

SHA512
bfc76c77b30251860e6e7e288c539e776e2ed4ef3243d96c6adae576a8c0ef3ef770fe5ccf8bc33c176fd7671e9af91d4a241f32d18d1a9a074d66bc2aba8fd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2836c8f347c1df17c82e202b91da593b

SHA1
d835bfc3a4d9ab419fbef4b6afedaf4816907f5b

SHA256
55f35b13915e9f43c2777851969be13f906a248b51d054530f5e780291f64aa9

SHA512
e98979887bdeaf2860a9fb77ea47d2f46c2ddc764af490829042468fda324165afe409068e150c4a851c6f116bba8f194ec555ef24ca565fd697a03ed89cbe39

Download Submit
memory/4732-28-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download