skuld | hxxps://cdn[.]discordapp[.]com/attachments/1295127442817683547/1295127519028183191/test[.]exe?ex=670d84fe&is=670c337e&hm=0d595559eb02957c997413fdc1a25ae6c5f17c105473114dae648534ffbe7610&

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1295127442817683547/1295127519028183191/test.exe?ex=670d84fe&is=670c337e&hm=0d595559eb02957c997413fdc1a25ae6c5f17c105473114dae648534ffbe7610&

Score

10^/10

skuld discovery stealer upx

Malware Config

Extracted

Family

skuld

https://discord.com/api/webhooks/1284545435142459497/sZJdu71WF2vnQDFx5DbTlbAwGrlYn3vAhSJnEzrtKI0BnkbaxRVHjY9XeJFuMGr-racb

Signatures

Skuld stealer
An info stealer written in Go lang.
stealer skuld
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

test.exetest.exe

pid process

1728 test.exe
4088 test.exe

pid	process
1728	test.exe
4088	test.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\Unconfirmed 852491.crdownload	upx
behavioral1/memory/1728-72-0x0000000000D10000-0x0000000001C4B000-memory.dmp	upx
behavioral1/memory/1728-76-0x0000000000D10000-0x0000000001C4B000-memory.dmp	upx
behavioral1/memory/4088-77-0x0000000000D10000-0x0000000001C4B000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 852491.crdownload:SmartScreen msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 852491.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
4264	msedge.exe
4264	msedge.exe
1232	msedge.exe
1232	msedge.exe
3708	identity_helper.exe
3708	identity_helper.exe
3340	msedge.exe
3340	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4264 msedge.exe
4264 msedge.exe
4264 msedge.exe
4264 msedge.exe
4264 msedge.exe
4264 msedge.exe
4264 msedge.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

test.exetest.exe

description pid process

Token: SeDebugPrivilege 1728 test.exe
Token: SeDebugPrivilege 4088 test.exe

description	pid	process
Token: SeDebugPrivilege	1728	test.exe
Token: SeDebugPrivilege	4088	test.exe

Suspicious use of FindShellTrayWindow 45 IoCs

Processes:

msedge.exe

pid	process
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

msedge.exe

pid	process
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4264 wrote to memory of 2732	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 2732	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 3048	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 1232	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 1232	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4944	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4944	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4944	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4944	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4944	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4944	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4944	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4944	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4944	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4944	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4944	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4944	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4944	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4944	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4944	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4944	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4944	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4944	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4944	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4944	4264	msedge.exe	msedge.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

720 attrib.exe

pid	process
720	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1295127442817683547/1295127519028183191/test.exe?ex=670d84fe&is=670c337e&hm=0d595559eb02957c997413fdc1a25ae6c5f17c105473114dae648534ffbe7610&
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff764a46f8,0x7fff764a4708,0x7fff764a4718
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1468,8416480286047893389,4350797322363362204,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1468,8416480286047893389,4350797322363362204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1468,8416480286047893389,4350797322363362204,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,8416480286047893389,4350797322363362204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,8416480286047893389,4350797322363362204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1468,8416480286047893389,4350797322363362204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1468,8416480286047893389,4350797322363362204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1468,8416480286047893389,4350797322363362204,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,8416480286047893389,4350797322363362204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1468,8416480286047893389,4350797322363362204,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1468,8416480286047893389,4350797322363362204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3340
- C:\Users\Admin\Downloads\test.exe
  "C:\Users\Admin\Downloads\test.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1728
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\Downloads\test.exe
    3⤵
    - Views/modifies file attributes
    PID:720
- C:\Users\Admin\Downloads\test.exe
  "C:\Users\Admin\Downloads\test.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,8416480286047893389,4350797322363362204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,8416480286047893389,4350797322363362204,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,8416480286047893389,4350797322363362204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,8416480286047893389,4350797322363362204,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2432 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1468,8416480286047893389,4350797322363362204,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5244 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1392

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ad7ee39cc42d7640b8f97321ce6b29af

SHA1
a9965ccb6a853c6c3d79f99a93f43b7bb524fe6d

SHA256
3d9ea127d6f7091046e96c7f80d6a5abad837864eff7d69142e27ed290697c5a

SHA512
6e58d968b120883fb678730b4e889cc3bb139b9133f31e260f5846850955df19d3fea96383346995a31953ab2ed79a932dec9a6cfe0775d0209a8461450cc1d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d538e9906df98895050a6d62c26fa5ca

SHA1
e66f937ae26645df56d8c34d9a271b2bdad835d7

SHA256
6c3f8bfda832def6ee7632bb6ce75e1e8f33b4fcad364742c3f3c4fda2eb705e

SHA512
b9ad76fe69a599728fa0ab6d7da92af2342597628d0ae3b4072d971250a994eefa88da4861a28674dc78c68962360c2f3e2327edfacb977072bed039559edd38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8d010dccfa559598ffa595109051340e

SHA1
4db86f20dea939213caaf65dac51d3b3f801489a

SHA256
24dc75a2a971d5a1214d4cdacdf901a81594d007c310f781c7399517df4f657d

SHA512
dc57661ddac5a9c898713b9609dacb6a0c904e6f7d52d9d039d3b1f0f2b1aa465093cbe5a31d0badb6b8ca51cae2c7bebd6ac965d9b3e407d5f92d089b509901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bcc3685c80b3ce2053a5e97629018344

SHA1
52fc87df4d0d2e4c02b90950933377a885a7880d

SHA256
080152f93e79db7c218f66a1d32f2f50661f7736c6a01494a161364abe4aeb91

SHA512
9aed06f72c2302f9fb04b089238d36840e79b69f55b064368982b9a06aa8d4464faa4f0f56a1b8033124246766ae328016a968107b25252764f785c19c4e4016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5cea750b4d5f77cb3eadc75277e303ff

SHA1
6e87aa534810d6f8410b85accf997211424a2a98

SHA256
4087e7cdc27ec8065cf334ce394f975e6116b4af6b62261a7ecb89529b8e9b3b

SHA512
ccb8881acdc8104774f1798372ced89b4a4cf61fb94186e18adccd92f7c9b4bec2d6411ebb369822dd9dc6e1bcc9957ff2ac7ed1fca605a51c9a58da3d2c9d27

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 852491.crdownload

Filesize
7.5MB

MD5
024120394dfc3e9add0c44cfdf071ab6

SHA1
3efc01703b833342a8f9432a7f32ed4ffb8319fc

SHA256
034c5b494dd9bb03a1d0bf56e6ac78893268aa56384fdcc9b5126813637afdc8

SHA512
efbc70e48cab6f8796dbba79a9a332e21094eeb9c700c76939060dce874976ce34fdff4cfc60e23a9e52e78131ee194a6ac96b5842181dc930cc8b7793269dea

Download Submit
\??\pipe\LOCAL\crashpad_4264_RRBSNWMGRMSDUCBC

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1728-72-0x0000000000D10000-0x0000000001C4B000-memory.dmp

Filesize
15.2MB

Download
memory/1728-76-0x0000000000D10000-0x0000000001C4B000-memory.dmp

Filesize
15.2MB

Download
memory/4088-77-0x0000000000D10000-0x0000000001C4B000-memory.dmp

Filesize
15.2MB

Download