4d209619925ca94810fd9857abfa17fa6b3a654cecfa577639f97b5ff9b47df5

Analysis

max time kernel
138s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2024 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LisectAVT_2403002B_367.exe
Size

1.8MB
MD5

adef7e3b82490d4040cb08d3eedf0ab1
SHA1

c887190ce74ffa37dd66ec6a2545cdc0a10f7838
SHA256

4d209619925ca94810fd9857abfa17fa6b3a654cecfa577639f97b5ff9b47df5
SHA512

f96361823273ce48e0a3fdf4522a9f033420648fc1711574d9b8090ba72e46a008f2247458eaa978efdd6badd278d71060bec111717a35534b8e4f226f4e5cac
SSDEEP

24576:ihTBxwv3XyAnG4gj7o8StpOWkAAB3UpEiUsdpwq2DfMh1XByXl3/1MKVPORHajeo:Ww6A7MkplUIkfc1X4lNMKGHaje

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
380	msedge.exe
380	msedge.exe
3940	msedge.exe
3940	msedge.exe
4972	identity_helper.exe
4972	identity_helper.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3940 msedge.exe
3940 msedge.exe
3940 msedge.exe
3940 msedge.exe
3940 msedge.exe
3940 msedge.exe
3940 msedge.exe
3940 msedge.exe
3940 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

LisectAVT_2403002B_367.exemsedge.exe

description	pid	process	target process
PID 464 wrote to memory of 3940	464	LisectAVT_2403002B_367.exe	msedge.exe
PID 464 wrote to memory of 3940	464	LisectAVT_2403002B_367.exe	msedge.exe
PID 3940 wrote to memory of 456	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 456	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 4344	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 380	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 380	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 3780	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 3780	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 3780	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 3780	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 3780	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 3780	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 3780	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 3780	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 3780	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 3780	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 3780	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 3780	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 3780	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 3780	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 3780	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 3780	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 3780	3940	msedge.exe	msedge.exe
PID 3940 wrote to memory of 3780	3940	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002B_367.exe
"C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002B_367.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=LisectAVT_2403002B_367.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ff8291c46f8,0x7ff8291c4708,0x7ff8291c4718
3⤵
PID:456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2542622273521318631,8767472898393689564,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
3⤵
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,2542622273521318631,8767472898393689564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,2542622273521318631,8767472898393689564,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
3⤵
PID:3780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2542622273521318631,8767472898393689564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
3⤵
PID:2624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2542622273521318631,8767472898393689564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
3⤵
PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2542622273521318631,8767472898393689564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
3⤵
PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,2542622273521318631,8767472898393689564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
3⤵
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,2542622273521318631,8767472898393689564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2542622273521318631,8767472898393689564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
3⤵
PID:1020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2542622273521318631,8767472898393689564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
3⤵
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2542622273521318631,8767472898393689564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
3⤵
PID:952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2542622273521318631,8767472898393689564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
3⤵
PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2542622273521318631,8767472898393689564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
3⤵
PID:3776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2542622273521318631,8767472898393689564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
3⤵
PID:3984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2542622273521318631,8767472898393689564,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5276 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=LisectAVT_2403002B_367.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8291c46f8,0x7ff8291c4708,0x7ff8291c4718
3⤵
PID:1912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
7232ae7030730f973a798bf724f17e9f

SHA1
dee689fe42d83fb7beb9c3f0dd295c258a9ba063

SHA256
95a710233fd4744c4b22efc697cf1b4850d50615e38cd28b3c6b6cfe2310c670

SHA512
f5c3c49fecedae5c251a72c28a62119c5e0c954931fac744e682c5cc7ac448145e36090636a2e405b0c4e8ee9bcfacd80475d3697d3f30bf9fbb16f8c077f115

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6cc5130204a5e6c2c4e9119c187c0a56

SHA1
353cb2da3133b03ba5f0539988cba69e0927113b

SHA256
ca6444f5c3c5cde2e54a2b37f3378535d1616a26d459a52529159bfe935a0e26

SHA512
ea3e598e0d9a932e682f1821314f088b75b36c377bbb48c1c8d1a0b2df1d99ed55b8d5a464da2917a677e5307292eb1db5c5b3d779fbd70bea6abcfe94afbc54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a6caa519d7df1f82fd112096f172e6a9

SHA1
58c13e523c93c521541f380f35559551706e4f5c

SHA256
1b02971f939c9184b2bd6a4d1844a7ec1c2bfffdacda5c095bf63c181d2ee912

SHA512
1e14b300399c476ec407c003cebb96bcc7737185573234e5eec8393dd8958558d0b528fdf54f0f3a94643da556dfb8c39a41024f7f4af6b3b8b28c951b10997b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bdf1be15b1d546a9c3862d93ee721cad

SHA1
4ce9252c1b9c414250173d9e2477b9e85462ef75

SHA256
35b8d03ba730a43de9e3d77242885d3a4f0de2be035b210640457d488550a565

SHA512
a6d9c930f459ead1303240466e12d3a4b09c60146aba98c80a3f10838ba808d83a9418965399088fb3de1fb7ef9b9019905dc1486bd7163d2414c13f721cafd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
369B

MD5
b0e085a31ae52f66eb026f76c5c1f781

SHA1
6fb4636bcd2edd7bdd1340e8c2fc9e41d320977d

SHA256
b1c504b774889e042e343f7a1d34ce9f735dee0c16ae345f217c631d38455f80

SHA512
9a30f84c3cd20f8197cbe5cfa9779ebde5b313fa8b39adba991e6ddff51c31062fbec60a680609baf72e5b777d8d185a05f2e3fb19a7fcc56b28f57bdd056ec1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5850bb.TMP

Filesize
369B

MD5
2ddebda30341ebc7adc631acec89d0ad

SHA1
8603feceb5ba28394e59c0e3a701bba853076e93

SHA256
394eac5b3b2f597a5f4b5d0a883d4eaac5749e7e882e7e3371a028237120ea13

SHA512
0f5ed2ecd674eca4847db19d32b4fce9ac401606072412d0bb698f407fbad1a5107fcaf0cce4ba98b3d1b71b8e7b3797f312e85039f3cb78b7577f9cc77f4ea9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5c4a5dd270ec23496847ba25b484a920

SHA1
3c21f2729893dd8e25a8fb14112f8a09ecfac118

SHA256
7b8ec9cddfa92036c91fbb7a32a82e551ba222fd09dd466c3dcaa5a555017fbe

SHA512
d2ac40cf8a3ef76ad711340150685a0337043dbf103405a24cfef48ccf21499c90b74b600b49b4b0d89fa7e6584f29f5defc39035243fe849370960d9e6c3974

Download Submit
\??\pipe\LOCAL\crashpad_3940_WJTHDBDDHKXXERLT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit