818d6ad42f3e392fd415226c37ff05575fa913df3bc9493ea70837afffb9a2ac

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2024 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

agentesla/0cb8eb139ca9874d3cf55541e6c7c8bf2810e0891454f4714e9f93d7fcc2131c.exe
Size

234KB
MD5

e4077c91084df7d8b51e7a01a89ac653
SHA1

610f88b0cd9ebbf509167a06b483d1520cc7ead7
SHA256

0cb8eb139ca9874d3cf55541e6c7c8bf2810e0891454f4714e9f93d7fcc2131c
SHA512

37c7d97b6a00ff3d51a4e098f73835e1478484eff28ef4c6fc3c415a50a190c66e4490304c5b71354c0072203753c7054a7af89579d4b1869d735515626373b9
SSDEEP

1536:i9Tyzlxf7vj1TD7b87c5Qmb8XCuCqyW/kqqJHkn4Byq5Xbgc9XmJI3wZ2/eK:AKrf7vj1TPbccVbXWxunyq5rgSmJIv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

0cb8eb139ca9874d3cf55541e6c7c8bf2810e0891454f4714e9f93d7fcc2131c.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0cb8eb139ca9874d3cf55541e6c7c8bf2810e0891454f4714e9f93d7fcc2131c.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2064	msedge.exe
2064	msedge.exe
1816	msedge.exe
1816	msedge.exe
4528	identity_helper.exe
4528	identity_helper.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

1816 msedge.exe
1816 msedge.exe
1816 msedge.exe
1816 msedge.exe
1816 msedge.exe
1816 msedge.exe
1816 msedge.exe
1816 msedge.exe
1816 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0cb8eb139ca9874d3cf55541e6c7c8bf2810e0891454f4714e9f93d7fcc2131c.exemsedge.exe

description	pid	process	target process
PID 3936 wrote to memory of 1816	3936	0cb8eb139ca9874d3cf55541e6c7c8bf2810e0891454f4714e9f93d7fcc2131c.exe	msedge.exe
PID 3936 wrote to memory of 1816	3936	0cb8eb139ca9874d3cf55541e6c7c8bf2810e0891454f4714e9f93d7fcc2131c.exe	msedge.exe
PID 1816 wrote to memory of 2280	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2280	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2760	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2064	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 2064	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 3372	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 3372	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 3372	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 3372	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 3372	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 3372	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 3372	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 3372	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 3372	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 3372	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 3372	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 3372	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 3372	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 3372	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 3372	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 3372	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 3372	1816	msedge.exe	msedge.exe
PID 1816 wrote to memory of 3372	1816	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\agentesla\0cb8eb139ca9874d3cf55541e6c7c8bf2810e0891454f4714e9f93d7fcc2131c.exe
"C:\Users\Admin\AppData\Local\Temp\agentesla\0cb8eb139ca9874d3cf55541e6c7c8bf2810e0891454f4714e9f93d7fcc2131c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0cb8eb139ca9874d3cf55541e6c7c8bf2810e0891454f4714e9f93d7fcc2131c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfa7546f8,0x7ffdfa754708,0x7ffdfa754718
3⤵
PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,15902735690073241619,1739077162637053927,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
3⤵
PID:2760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,15902735690073241619,1739077162637053927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,15902735690073241619,1739077162637053927,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
3⤵
PID:3372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15902735690073241619,1739077162637053927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
3⤵
PID:4228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15902735690073241619,1739077162637053927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
3⤵
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15902735690073241619,1739077162637053927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
3⤵
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,15902735690073241619,1739077162637053927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
3⤵
PID:3172

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,15902735690073241619,1739077162637053927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15902735690073241619,1739077162637053927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
3⤵
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15902735690073241619,1739077162637053927,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
3⤵
PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15902735690073241619,1739077162637053927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:1
3⤵
PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15902735690073241619,1739077162637053927,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
3⤵
PID:2980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15902735690073241619,1739077162637053927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
3⤵
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15902735690073241619,1739077162637053927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
3⤵
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,15902735690073241619,1739077162637053927,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0cb8eb139ca9874d3cf55541e6c7c8bf2810e0891454f4714e9f93d7fcc2131c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
PID:752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfa7546f8,0x7ffdfa754708,0x7ffdfa754718
3⤵
PID:2220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\426c14da-6e10-46c2-a641-3524a69bb83d.tmp

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
fbe9972a7905c9a21c353137151a3488

SHA1
1d7c3fb3aa67c57f697ae8fb9402fd309789b999

SHA256
02845fbce4f739566fcb0ba7d6c97b158733feee921daa3ee59109981c5fbd84

SHA512
e9324ef7dbeff5c74fa8ebef5a48e0209dca07c7782211742d1c9421e16b360a12a67e83536fd588e29ec10dd94f215dc8d83ff90d4443b85871121399e11c58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e39d203184b7d808666b83bb9e573ff

SHA1
e1247b4e154c57d31f246fc2c2de93ba00740f3e

SHA256
f44b10d81dcaaa337d098956eebd1ec01173281f9b73b43dec35675ae7afece2

SHA512
fa0b4ea0aa7948dc8121ed2de7cb945e1f1b12560a7f319c95422b2f6e83996ed99592ce87fbd5e05edd905d2bb997f09e6bd55af2aa4143465dcf971a7f794a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3e83632590eda26f249625d846451113

SHA1
205e539dc2c3ed75d3af0314e914c6325725dff7

SHA256
9b9f893d0a7c7f6796be9a9305e0be39fb457bab751a5ef9ce2e52cb1a15da03

SHA512
ebecfa86820dacab7f96c2408cdae9a4c5dc5889fd221af1be57c3654ca972ecdde3f06d13a7cf884606c455d2a79f395e4a52da71c2d65030e4cb13a1ae5560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7346462d0120ecad2bff1269de586e6a

SHA1
92a78ad27990d84e071fccfb48d981fbbf731a73

SHA256
1cf6a726c28ccf5a6f73f436be2a4d70d434d3ed5c1cb281fb06771ffbbd2232

SHA512
bd7a352a2976be30267a5f216f1b979bde88128664be0434bd809723269d498ad12cd38fc4983132c10b7bd0929171478e3257eb633ac09dedbf4f6197e67a1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
f55095bb0f89058cea1a7d3f5111b86b

SHA1
d9da9ab4c04f4f967c000f3f47392eca076c08d0

SHA256
556d6b80de97d1d59ff27bba42211146f24611bbc7da905388e8afa40bd8dddb

SHA512
fdd78accd0edb410472145240198f52963b6d5e362cfccfdedd63b78d6dc2ad9e8292229611d9b035d6cfc652b66583bd2cccce7101b6b59f6a37840dcf8335e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f482.TMP

Filesize
371B

MD5
95a4d93535001e2e4f50f4f05985a35b

SHA1
ba8127eacf0c35e3f0b85db71824a39b27d8ddaa

SHA256
44582a4e92a17c05438a6a0ab831b687e948b7ecc6a574b5feb5766586371c1a

SHA512
88cd623a72a7baa7e68c1291f5c71529302e7a0ed5cf2d9cc40bb7db41217a27ed1e2cdf0cf9577222ca974506790a267726752d7bc1fc3c6c5a388e9b6a8e02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
61e30c3f1b8208096bd95a4e5ed3bcfe

SHA1
819f82f2cb804d23db3036ae45d735ab301a77b1

SHA256
80a147dae2b5bc5f61ca7b544c9ebb12c1aebf1e8fa3e8ac564526eff22e91d3

SHA512
28d786b36afe77b24ecda4e7077409e4814f49419f950d808e611faff5012bd4ed6b38473bee4df47ae39d18bcd78be4284bf192e3e65de0f63e3727b70710e1

Download Submit
\??\pipe\LOCAL\crashpad_1816_YGCXFNMEZEYDOTDS

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit