d6a77d0fb0a019c3d627edf98c0a5f87902ed89990a894906917c2a381877259

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2024 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lisect_AVT_24003_G1A_62.exe
Size

1.5MB
MD5

7978fa8a70028f74f0b94fb3cd2d813a
SHA1

df380466b6539f9735c8c36705e3ac6aeecc7a1e
SHA256

d6a77d0fb0a019c3d627edf98c0a5f87902ed89990a894906917c2a381877259
SHA512

1b5e91fd28bca4288a94ac9c06f450880b7431c68d25555060c2c229c6969c4e97fefd5b9afa7e8eab61dd784fb105120deb8b65eac7605c49f9178a583785e8
SSDEEP

24576:xwWDbJiCga5jJ2+r/qXYpu+2worQlYfsZfto4H9qquY+fhlqI:9DbUIsZSwwoH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3964	msedge.exe
3964	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
4132	identity_helper.exe
4132	identity_helper.exe
5432	msedge.exe
5432	msedge.exe
5432	msedge.exe
5432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

2164 msedge.exe
2164 msedge.exe
2164 msedge.exe
2164 msedge.exe
2164 msedge.exe
2164 msedge.exe
2164 msedge.exe
2164 msedge.exe
2164 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Lisect_AVT_24003_G1A_62.exemsedge.exe

description	pid	process	target process
PID 4616 wrote to memory of 2164	4616	Lisect_AVT_24003_G1A_62.exe	msedge.exe
PID 4616 wrote to memory of 2164	4616	Lisect_AVT_24003_G1A_62.exe	msedge.exe
PID 2164 wrote to memory of 1572	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 1572	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 2324	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 3964	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 3964	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 4768	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 4768	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 4768	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 4768	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 4768	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 4768	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 4768	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 4768	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 4768	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 4768	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 4768	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 4768	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 4768	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 4768	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 4768	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 4768	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 4768	2164	msedge.exe	msedge.exe
PID 2164 wrote to memory of 4768	2164	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\Lisect_AVT_24003_G1A_62.exe
"C:\Users\Admin\AppData\Local\Temp\Lisect_AVT_24003_G1A_62.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=Lisect_AVT_24003_G1A_62.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa922446f8,0x7ffa92244708,0x7ffa92244718
3⤵
PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,8218867266332528693,16032193663979002062,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
3⤵
PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,8218867266332528693,16032193663979002062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,8218867266332528693,16032193663979002062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
3⤵
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8218867266332528693,16032193663979002062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
3⤵
PID:1820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8218867266332528693,16032193663979002062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
3⤵
PID:2516

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8218867266332528693,16032193663979002062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
3⤵
PID:2144

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8218867266332528693,16032193663979002062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8218867266332528693,16032193663979002062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
3⤵
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8218867266332528693,16032193663979002062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
3⤵
PID:4720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8218867266332528693,16032193663979002062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
3⤵
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8218867266332528693,16032193663979002062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
3⤵
PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8218867266332528693,16032193663979002062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
3⤵
PID:2708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8218867266332528693,16032193663979002062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
3⤵
PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8218867266332528693,16032193663979002062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
3⤵
PID:1096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,8218867266332528693,16032193663979002062,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2316 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=Lisect_AVT_24003_G1A_62.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa922446f8,0x7ffa92244708,0x7ffa92244718
3⤵
PID:3788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
315d9296317e484ddac9d58df6ab130d

SHA1
86e362e3c47c5523e4093d1a76b6a2483e03e33d

SHA256
e91fc6ff39c21bfc1de9a03269aec8ab56332abfb38935e93394f8a4cc700152

SHA512
50d36f21d4fe2dbf42cb7699e032172a98a3ced864fd74e7006180ada6e9581f95e8548523f8ead5d345007916dfdcbc312cb4920c0d56b965a7ca36dfc743ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
0a8ea5dae27f141be6436c1a828dc840

SHA1
d69f06ab302b56ead0af142ad60f5ca8acb4f42b

SHA256
24c8b87b69cc0aeee6ce898bce60dbdca51dfa690e7e0720b58a87b9a16e52e2

SHA512
289759ab1f9636c6147526f3419bff7941f77bdc327ba621c5ddbf334afab9723983ff9ce59fb85c3636d63fa402a50becaa9c232c04afc825509652ce2074e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f88a43df75e4202639071d9e8c889fa3

SHA1
9768e0defd67094a9a4e3ccbf5cb1573978fee6c

SHA256
a0c53f9ef9e5a2525b4e8b6f3a8f3f8fa78afa1d3dc7d62f4ec590593858ff7f

SHA512
3557f9cacb16beee979879d7dfc7b4763c8f43d652332f2283596b452b4d887af0fc547e4c2ea6424451dcb27dbe0637ad6ba1f38f6ab053b70b0d0318a2ff31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f49e0c3c987578e6a2fe35b7ffc897c2

SHA1
9a94293e4e5f3ef209e6069e174762358cdba330

SHA256
7e8728daeb231d86c73e40e29b306c2c04ba7e0765220499e559bd445c7b3941

SHA512
2741291cab075a67828e50529c2a9f0a2ffd83ab61ed6fc2e3117215bbd64d08d42fd037709342c9bc7f47e107bed1b0ed65df8998b7d673b0dcddc1ac6dc14d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dce67c65ae0586370534a27cdd4279a4

SHA1
3b2c0f350b3eabb7842a8d4554c974313da8b19a

SHA256
df2898b452fc04297d43a36666f4ebcc94b29f93df12be8a1e38a46948398bec

SHA512
4b54819dbfd0fb62f02e7536129a37178e83a22ac1d8581262c842584237a32ae68105ca4418fd4d56e8f0d4eebde8727af3f8d1481c94b08596588b47555d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
369B

MD5
5df2d3b23a95b906846fa49c059d22df

SHA1
d3149a964cdc3ae6eddf5ab65373356ae9bb218e

SHA256
1aa6d525c1f8d33df9c55ddaf2c773a3715f2b29889724b6446b4cc4af661d3e

SHA512
ecdc8a80327f32b93726567a108568e5ab2fb7326840e8ca067862d5629c89cfc6e0d4e2cc27902a30d3df29a7fea4dbac0f72081ff4ca958d41f6a0dbed7710

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
4473f115d3f03985579a7a0aeaa2e1b4

SHA1
1137451df7a09db16d37386893a335e791800059

SHA256
07e7ad79c21c466cfbadbbde471606c8c35ca56bce4388f0998ee56fc91e77fb

SHA512
e573c3ee1fef3def8b0680933967576c3871af7b18b47c3c60e0bb58653a723fb2a4a305b48f2028e5e8fc1c9e0385388811580e7317c0a4a19c46e694968b92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fa4e.TMP

Filesize
203B

MD5
f8fca161ff1604a1b50b2a8b8be1378c

SHA1
1a42dbffae4610666874fdcef3226171697851e6

SHA256
03c6f5c3af7363b660a7809e48e392ea14dbe616ddac4b3b0064add3b8082b9f

SHA512
8fb1215a46bff7811f28bc44031ee5c259f6bf8eeb08fce88aec34a8911243e6250ae35364dad0af09c741430a4ccd1432014a3d03fef290cea871b2e2a06ee4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
33161a118dfda089c1e22905ce40b99f

SHA1
80c39cce45159d6c964ffb05c8e13b1418694222

SHA256
7059c1c746e88b33e071e2083b136c6962c1fbb88aaaf47110ba53f20451d0a9

SHA512
229fa2560fef0261ccd78b76773234dc7e79becc6878dfa9c4db90c178ec89d052f3d46211fa7eb771429e6f8ff43aa46ceef67c4d3ad8262f0883737dbc6fc7

Download Submit
\??\pipe\LOCAL\crashpad_2164_GTIJVGYHPCHCOITX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit