00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc.exe
Size

36.0MB
MD5

f205864b3fd0679e60b2076f84890f86
SHA1

3cbcaf69c4a8ad3d1e8e2a94076ee93f5c7a08fb
SHA256

00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc
SHA512

c0a045b7b1f79e5a6bfc1a9633f81a33f707f03ae7ae664652f06b23a9a0d1a6896b7837e60eb930b5f8cd33389fff5773f6097c8925c31bcb923a36ac4f1a25
SSDEEP

393216:inAqMInoJITfRwF6+YPlC6PIwt4jNQTXh7ywYzTcDxvVRzzWdtMPD9Z:in6iTfRwFOxostywY3cDxvVNyaPZZ

Score

6^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 587228.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	Process
3464	msedge.exe
3464	msedge.exe
3604	msedge.exe
3604	msedge.exe
2268	identity_helper.exe
2268	identity_helper.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of FindShellTrayWindow 59 IoCs

Processes:

msedge.exe

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc.exemsedge.exe

description	pid	Process	procid_target
PID 2832 wrote to memory of 3604	2832	00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc.exe	96
PID 2832 wrote to memory of 3604	2832	00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc.exe	96
PID 3604 wrote to memory of 1296	3604	msedge.exe	97
PID 3604 wrote to memory of 1296	3604	msedge.exe	97
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3464	3604	msedge.exe	99
PID 3604 wrote to memory of 3464	3604	msedge.exe	99
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc.exe
"C:\Users\Admin\AppData\Local\Temp\00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=7.0.9&gui=true
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffef55646f8,0x7ffef5564708,0x7ffef5564718
    3⤵
    PID:1296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
    3⤵
    PID:3596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
    3⤵
    PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5004 /prefetch:8
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5580 /prefetch:8
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
    3⤵
    PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6196 /prefetch:8
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6196 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
    3⤵
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
    3⤵
    PID:5256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5012 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
76119bd2a5e4b9f16624ec49d4cc4e64

SHA1
63666acffab38135a6f89eb61814f42d94fd9ba2

SHA256
2b4bd21dedae677b85b19da413f9c9b9a3d568ccfa7da4036085c3650eb2150e

SHA512
9021c3ece24294d3d3a5ee041870953684a906421227c83f349660c93d9bad46af02c8c4ab45cb35a0a80421a7e614f1a01af86293706f01860c7adb338c5c5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1002B

MD5
13494cfe9e61d1f7063baa0da4b75569

SHA1
b1e929123bd5983478b694ede05356c6735be8ce

SHA256
ad4a3e49fc860cc5f266274949d4fbf920fdeb8313d5eee0c1cc0be2eb131294

SHA512
4e5f0754c652b119573ee09fa9c88a01f2dd9ecdc7499e4b772d22af2604fbb9bfa1a40c702bca870240db8b3a56ed1aa61b9a69ef318567a0bb2b7a3fffa7fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5879807dfb801f46b807132117e3d5c6

SHA1
8ba984c2d7565fe3ea92b43f883ca7db22d32cd8

SHA256
b41fd40392c6d4850b6e2f3a11e79c58d881d2d2931256c2a65a1fd68bbf3d68

SHA512
f4903bbb741a3dd13a11c2d3c7071476c2b1a2657d2a34bb89e31840212f873a862876bd8941caa75ffb1988a6b6f351e8343f13b7af199a8d78ec815f23ee81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b6544b2e35941524958a6b994f909461

SHA1
fd1d96c0ac0dec6ddd9f38538b2adf9ceecbac3b

SHA256
fd97fc9598bdbd429ca8f6fc0eae3ecc833f54eb10708d9171b7bcbafab9a8ae

SHA512
d8a482c8bc0af45945e2dc8e3d0b9c80a4f3047eb6d9514757d81f5f16bd32c7450490cf9d147f4e734ea6ce1297554ea757f474aa82a35310ca994b0ae095c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
e3970a75570696a504a80374bbb1a82a

SHA1
d04e2ebaf848b515fd41f1f9379fefa97c543df2

SHA256
784f8fb8ffb919053b2054e49926e9d0a8cd78fdd8ceeddece63c3f3fd11c3f7

SHA512
df561b4eef681b3f38958aa48ce540524f96680f93bb3a6a1be15e817f051904e3479da7549b9b4ec5870832032509f65db21db7e5e4c86547d4099a9dbecbd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
584db365e03276b141ab2603d2de1877

SHA1
1e73a9d58446c60230bcc6b9be44cb0daa6edbe2

SHA256
21488b4003ada576a8dcacddc076ccd252900e9e7ee8f70106ef22f1d393fb0c

SHA512
18e99766380c4406b6c166cba8504f31ab96cdfc89ce988cb6ac2af6212baab6a357ebd96dcf512973a7eb148f4c0ce4c26138b11d6dd6645137b395addfb54b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58751b.TMP

Filesize
537B

MD5
9d3a2c8be5873ef05ea81aa4e9375319

SHA1
702b234fe0151e4b4122681bb94f51a03808ee57

SHA256
8ea43b5f22cffda98fb97c84b04dd84f7af205b733ec9d663706033807659421

SHA512
6381e217edd75b1c8a7838bbeccf60f3b8a48783ea1c34a64695358276fc5840aced55b38f5af00a317fa2e920c09c236618f5a0cb544f96d90b94dc6ae435af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
79914edaae0624f71d3526e99d337b05

SHA1
a341fb7a1daeb6b968f7707b2611c64d7e32eceb

SHA256
6ab0cdf867994963bd789f7d4effa8ec533e4c2e173e4fc3aededc664eb67421

SHA512
5b4029ef345753d14635364e4945978851c1402cad3e4c40e83dd3296a67693762c061f7d730f261126bd7b0a8b0bfe82463405405ae2be7128cfa4f3c9da3cd

Download Submit
\??\pipe\LOCAL\crashpad_3604_QEDWZRWWKQDSWPAG

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit