9c7c57c4de010e15d30c61f85921ad3535d53fc9430266dde90514cd04a2fe10

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2024 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Elsify v2.exe
Size

253KB
MD5

9e95e8f56cb6f3d1cdc6ccb08a76c912
SHA1

151a1f3272d55f1dcbeef162b7f70d04025bc098
SHA256

595fd61801d2ea5739d688e2b22a83f2917bc532fe82c02734972ccc159497a8
SHA512

026f1f2e86b684a069eca4626a7ff209bcd8017cd9e47bc96c6d13dab5e2811e3ab830211495971ce29e9884b17d0e0928e4b68692dd12ee5ef0ace5145d7907
SSDEEP

3072:MguAgTsGLYEZl70PsLko1Gs2T/0oim/JbRZzlZ2pqqJhBbC:M5twsLko1Gs2T/pPlZ2wqJhB

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

9 pastebin.com
8 pastebin.com
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

74 api.ipify.org
72 api.ipify.org
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
9	pastebin.com
8	pastebin.com

flow	ioc
74	api.ipify.org
72	api.ipify.org

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{91E221DD-D9DB-47D7-9440-ACB7661B7EB7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3524	msedge.exe
3524	msedge.exe
1700	msedge.exe
1700	msedge.exe
4768	msedge.exe
4768	msedge.exe
1352	identity_helper.exe
1352	identity_helper.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

1700 msedge.exe
1700 msedge.exe
1700 msedge.exe
1700 msedge.exe
1700 msedge.exe
1700 msedge.exe
1700 msedge.exe
1700 msedge.exe
1700 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Elsify v2.exemsedge.exe

description	pid	process	target process
PID 4076 wrote to memory of 1700	4076	Elsify v2.exe	msedge.exe
PID 4076 wrote to memory of 1700	4076	Elsify v2.exe	msedge.exe
PID 1700 wrote to memory of 3264	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 3264	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 4672	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 3524	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 3524	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 5064	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 5064	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 5064	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 5064	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 5064	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 5064	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 5064	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 5064	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 5064	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 5064	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 5064	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 5064	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 5064	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 5064	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 5064	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 5064	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 5064	1700	msedge.exe	msedge.exe
PID 1700 wrote to memory of 5064	1700	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\Elsify v2.exe
"C:\Users\Admin\AppData\Local\Temp\Elsify v2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://direct-link.net/26814/valorant-skin-changer
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff599746f8,0x7fff59974708,0x7fff59974718
3⤵
PID:3264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,5155297138646375541,6538473426734798509,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
3⤵
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,5155297138646375541,6538473426734798509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,5155297138646375541,6538473426734798509,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
3⤵
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5155297138646375541,6538473426734798509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
3⤵
PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5155297138646375541,6538473426734798509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
3⤵
PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5155297138646375541,6538473426734798509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
3⤵
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5155297138646375541,6538473426734798509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
3⤵
PID:2632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2008,5155297138646375541,6538473426734798509,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5444 /prefetch:8
3⤵
PID:2092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2008,5155297138646375541,6538473426734798509,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5452 /prefetch:8
3⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5155297138646375541,6538473426734798509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
3⤵
PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,5155297138646375541,6538473426734798509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 /prefetch:8
3⤵
PID:3560

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,5155297138646375541,6538473426734798509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5155297138646375541,6538473426734798509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
3⤵
PID:400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5155297138646375541,6538473426734798509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
3⤵
PID:1304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5155297138646375541,6538473426734798509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
3⤵
PID:3460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,5155297138646375541,6538473426734798509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
3⤵
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,5155297138646375541,6538473426734798509,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5172 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
65f96832333f58134ce5c4320c93ed19

SHA1
19b6ef4637ef5f6993c29694012817c26fe804b4

SHA256
58025a81c4a00822e83e3de04c8dbfe0056175db0d67b89f24dadf0faf517285

SHA512
4ccda031db70ff8f307cf6c34a314cf69d27e42c252b4c8a001a6726c8c5acbe41543a21c6744517b2367674e48e714143a7a3640b1dc2ef1e06758c091e0986

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a9776eb97f488de1bdf14d6cdc4a934a

SHA1
6c4018fb6ef0e162402845da1e67bb1b4a3df1b7

SHA256
b4c6c19604f4bd118a742128f4d2bf5b5bce64e4ac02d95e3e54d6192d631140

SHA512
8fd7c44692ad252e5ccba701b96598047e178b3b75e165ee7af80d0c385db01fe6584fd52aaac14283e519e9826fd58ba7a936b21d64236ac7291d9689ab8616

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8d71deb4b178632d0abb12f7779a3d13

SHA1
3188ef43d7e7651f77de9ff18d9dd4dd025eee02

SHA256
c8ec2404496a8e8aed3c2389b5ca7d85a6e3a4d9de0657d23455469b6757ddd7

SHA512
ccc29eaea86dc63605cac82e7894728681cb30727d3bde7bc0a5af38e581dfcdfe7f964e9e935ffdd7316bc4c4a22f0a03ffa621318acc564ef886fc91d43d1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
868e9c1ec1b052f5d1e89746d58b118e

SHA1
a4e2945568fd1678b9ee22e91c61a76a683e968d

SHA256
3830751d868a36eaca516b2983eeb4efcd2b1cbca8503da7f2ef90c5065fb67b

SHA512
de5d4671efaf5bc2e6eeb286af652be63717bbedf3dbbbb4d6f87251a1e6e4668abf6bf0cf27e19e3c71e25d8de7b6869925e6f9d38948c744d8929b22b50ddd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
830bb3465cb76a9497ea52bc910e0eff

SHA1
103151a523c8a686b4214be60abd131b644b753c

SHA256
db6b2c5879dec71d3f65681b3f6d2414e322ad7941791311e45009e628b75898

SHA512
59a09738ca2ad57e934d0811a27be8b2da1a451e14e9a289e5699dfd6dd40ba3ae82da136d9c054be6a259e6d73c38143f9a88134f21d1108f358800e22c5689

Download Submit
\??\pipe\LOCAL\crashpad_1700_MBZWDKHBMKEBTYWU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4076-0-0x00007FFF5E08B000-0x00007FFF5E08C000-memory.dmp

Filesize
4KB

Download