a2971bc379a09844bf838fdfc79165e50e851eab7ef965529da712f57c989b78

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

370000.MSBuild.exe
Size

69KB
MD5

d147a5fa86d3f82fde1cfefe7c133cdd
SHA1

0d202133fa8724f0ebb95788bfaf0002b8ae1d28
SHA256

a2971bc379a09844bf838fdfc79165e50e851eab7ef965529da712f57c989b78
SHA512

feddc30eafce60f42f307b5825d6c7ee47672a24c712346a4cde265e49fc53a39aeba8e27ca85757ee4ffe1bca186a46684e9db899ead0ca61113c78732c44a8
SSDEEP

1536:AuUbUfRckg00KuGUYFE7s0v/s5w/b5OnGlBl4zwTrPlTGix:AukUfRckMKuGUYFErAwb5Tl8MTdRx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

370000.MSBuild.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	370000.MSBuild.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	Process
1724	msedge.exe
1724	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
3652	identity_helper.exe
3652	identity_helper.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid	Process
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	Process
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

370000.MSBuild.exemsedge.exe

description	pid	Process	procid_target
PID 1052 wrote to memory of 2836	1052	370000.MSBuild.exe	91
PID 1052 wrote to memory of 2836	1052	370000.MSBuild.exe	91
PID 2836 wrote to memory of 1564	2836	msedge.exe	92
PID 2836 wrote to memory of 1564	2836	msedge.exe	92
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 3744	2836	msedge.exe	94
PID 2836 wrote to memory of 1724	2836	msedge.exe	95
PID 2836 wrote to memory of 1724	2836	msedge.exe	95
PID 2836 wrote to memory of 4696	2836	msedge.exe	96
PID 2836 wrote to memory of 4696	2836	msedge.exe	96
PID 2836 wrote to memory of 4696	2836	msedge.exe	96
PID 2836 wrote to memory of 4696	2836	msedge.exe	96
PID 2836 wrote to memory of 4696	2836	msedge.exe	96
PID 2836 wrote to memory of 4696	2836	msedge.exe	96
PID 2836 wrote to memory of 4696	2836	msedge.exe	96
PID 2836 wrote to memory of 4696	2836	msedge.exe	96
PID 2836 wrote to memory of 4696	2836	msedge.exe	96
PID 2836 wrote to memory of 4696	2836	msedge.exe	96
PID 2836 wrote to memory of 4696	2836	msedge.exe	96
PID 2836 wrote to memory of 4696	2836	msedge.exe	96
PID 2836 wrote to memory of 4696	2836	msedge.exe	96
PID 2836 wrote to memory of 4696	2836	msedge.exe	96
PID 2836 wrote to memory of 4696	2836	msedge.exe	96
PID 2836 wrote to memory of 4696	2836	msedge.exe	96
PID 2836 wrote to memory of 4696	2836	msedge.exe	96
PID 2836 wrote to memory of 4696	2836	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\370000.MSBuild.exe
"C:\Users\Admin\AppData\Local\Temp\370000.MSBuild.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=370000.MSBuild.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdded046f8,0x7ffdded04708,0x7ffdded04718
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6994841087917201108,9651064977068168831,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
    3⤵
    PID:3744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,6994841087917201108,9651064977068168831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,6994841087917201108,9651064977068168831,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6994841087917201108,9651064977068168831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6994841087917201108,9651064977068168831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:1792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6994841087917201108,9651064977068168831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:1
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6994841087917201108,9651064977068168831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6994841087917201108,9651064977068168831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6994841087917201108,9651064977068168831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6994841087917201108,9651064977068168831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
    3⤵
    PID:400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6994841087917201108,9651064977068168831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2360 /prefetch:1
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6994841087917201108,9651064977068168831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6994841087917201108,9651064977068168831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
    3⤵
    PID:2956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6994841087917201108,9651064977068168831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6994841087917201108,9651064977068168831,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1956 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=370000.MSBuild.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdded046f8,0x7ffdded04708,0x7ffdded04718
    3⤵
    PID:3148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
697017fd3b8e24120cd5400b4f5f9437

SHA1
0b2932a43dcff6ce79e166a95021c271344eae6f

SHA256
2f877c7072a6b74a1b652461c1037a14a28181927dc1b19b69b02b8234d5c7e4

SHA512
d533d27076498986aaf63d949ad20ae4c0072ddda4605380d739e98629291196ab0cef32631f57d6ec82df0a5c1a24fa7270bb1fe4ce77d891c543792a29bfc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
02423f077f11ce8c0c44004684af05a9

SHA1
de38ed417aacccc2f505c1c064f24665d0cffc78

SHA256
2164136a8719523b5b1ab39ec685c355ca0033062c660000baaa17246311f223

SHA512
202b40de2b893cfbeeb3ff7194a095c1df267a1ad965706d940d70a3a76f5ce125c926d0aa2bea54a97d523284918453180cf53019187fee2f9f3cf6474ee52e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6c51b35b1acbb3883911b2410991a61b

SHA1
4a41b7fa5fc464047e3c1dbe0d40b7cff39e8c2a

SHA256
fdf6e79b662bf17ed059f4ea89023d5d7e522949ef9699410b0735bc6c944ee4

SHA512
9616ce4ad4950533ded46525127c27463f33182516f027276d11f2b408861f1c3d43f8f7ed2fd78da581ee147440d016f295517faa192cc6227b8033fdd36038

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
da44be9390ff3482d17119f7c2b63da9

SHA1
da7d83296f32586d264c25c28e16b6ad8cd4183c

SHA256
372f746495cf1216a1e2605c6afa656b9db066e6378d41d099ecf0128f200047

SHA512
a15addbc78800d8c7330e014e5e354b355cfbd803f4beda316db29fc34cab363f80120d809de2ce328397cfdbb35431fa52197a0739d106c6a8c564b02c548bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
d845fc135c0e888fe1d31312ae6025d2

SHA1
b6e7c7b6df0e85b3ef4219393563b328e3ef4960

SHA256
f8904c1610005588763291b8a9f7910488f942a69cc353c3b009691925d23d9f

SHA512
ed79360168b378f8d7758e3b02d7ee52a7183221488079ce270b9f7d704e353d47bf8e71ecb0bfe58193c2cf18da11652fed6180e80364991cb02af05a9b6821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fd7a.TMP

Filesize
371B

MD5
2ce5bfac12e67142d278b615acc9e4c3

SHA1
45b7d2d87ce2da12d499004a2f33b9168264d0d5

SHA256
9584c03a0828e75deb6b96bb0d2dddeefc8a97b3cf7ff2e8ca74fa2e90a97ac4

SHA512
624fff22a42ca0bd869d895789c716b59cfb827bfb850c56e5bdeccc4d64aac3e7d9be7545802a1d476504b476b6ef4af789606e686027fed622f0f16b4fb3eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4f4a866be80332fef2e7584042d4717f

SHA1
9392c03eae262c0ff4ceac54d2d800894e53c58b

SHA256
8c4949374fda1a7fb8a1576f02a3eb8d54474d2e9c959e74c45dc3835fe571b8

SHA512
806c0e26dbe65982fb578062cbb165daca6a0107ca2917260abb40de1fc16f3c74390015a701c2e54eb6041aebc5568b9310e69c8d385448dc4254fa083adce1

Download Submit
\??\pipe\LOCAL\crashpad_2836_XPHEIHAWAFMMUYQB

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit