8bab507be711cc80053f3e7eb5443c14c4ce3a9fffc87c28a67d4e778c971362

Analysis

max time kernel
120s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-11-2024 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8bab507be711cc80053f3e7eb5443c14c4ce3a9fffc87c28a67d4e778c971362N.exe
Size

112KB
MD5

03c24d4d007370d5a8963583c3f6d270
SHA1

b19d183ebb332a857dc2f2188232a1e724e62e27
SHA256

8bab507be711cc80053f3e7eb5443c14c4ce3a9fffc87c28a67d4e778c971362
SHA512

646ee2e3c7fd36d4709ae3edf99d71bc8015f8074c336ffc57f322cb089b34622c3bf4a7f4460d920d0226ed13de8a93dbb43c228d23bbadf2452c9ea3accb11
SSDEEP

1536:2clSIN36Xm8czNDW6c3OBBgqJuYy6s6gs4pb3ARUbsoEDdpy0pdjevEXeY:HNqXGzo6c+PgvMwRsU7EDjyGdqsXb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

8bab507be711cc80053f3e7eb5443c14c4ce3a9fffc87c28a67d4e778c971362N.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8bab507be711cc80053f3e7eb5443c14c4ce3a9fffc87c28a67d4e778c971362N.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

892 msedge.exe
892 msedge.exe
2464 msedge.exe
2464 msedge.exe
2640 identity_helper.exe
2640 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

2464 msedge.exe
2464 msedge.exe
2464 msedge.exe
2464 msedge.exe
2464 msedge.exe
2464 msedge.exe
2464 msedge.exe
2464 msedge.exe
2464 msedge.exe

pid	process
892	msedge.exe
892	msedge.exe
2464	msedge.exe
2464	msedge.exe
2640	identity_helper.exe
2640	identity_helper.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8bab507be711cc80053f3e7eb5443c14c4ce3a9fffc87c28a67d4e778c971362N.exemsedge.exe

description	pid	process	target process
PID 4220 wrote to memory of 2464	4220	8bab507be711cc80053f3e7eb5443c14c4ce3a9fffc87c28a67d4e778c971362N.exe	msedge.exe
PID 4220 wrote to memory of 2464	4220	8bab507be711cc80053f3e7eb5443c14c4ce3a9fffc87c28a67d4e778c971362N.exe	msedge.exe
PID 2464 wrote to memory of 3700	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3700	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 1772	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 892	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 892	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3096	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3096	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3096	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3096	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3096	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3096	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3096	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3096	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3096	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3096	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3096	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3096	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3096	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3096	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3096	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3096	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3096	2464	msedge.exe	msedge.exe
PID 2464 wrote to memory of 3096	2464	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\8bab507be711cc80053f3e7eb5443c14c4ce3a9fffc87c28a67d4e778c971362N.exe
"C:\Users\Admin\AppData\Local\Temp\8bab507be711cc80053f3e7eb5443c14c4ce3a9fffc87c28a67d4e778c971362N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=8bab507be711cc80053f3e7eb5443c14c4ce3a9fffc87c28a67d4e778c971362N.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe167c46f8,0x7ffe167c4708,0x7ffe167c4718
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,10160536227407769748,7983211192968432965,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
    3⤵
    PID:1772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,10160536227407769748,7983211192968432965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,10160536227407769748,7983211192968432965,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
    3⤵
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10160536227407769748,7983211192968432965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10160536227407769748,7983211192968432965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:3944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10160536227407769748,7983211192968432965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2328 /prefetch:1
    3⤵
    PID:2620
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,10160536227407769748,7983211192968432965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,10160536227407769748,7983211192968432965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10160536227407769748,7983211192968432965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10160536227407769748,7983211192968432965,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10160536227407769748,7983211192968432965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
    3⤵
    PID:956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10160536227407769748,7983211192968432965,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
    3⤵
    PID:624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10160536227407769748,7983211192968432965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10160536227407769748,7983211192968432965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
    3⤵
    PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=8bab507be711cc80053f3e7eb5443c14c4ce3a9fffc87c28a67d4e778c971362N.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe167c46f8,0x7ffe167c4708,0x7ffe167c4718
    3⤵
    PID:2560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
e1e6efb4b2537e10a9d75327146e1349

SHA1
f13681f527bc1ec48dc7df9e146806d9e5f6e7b3

SHA256
c79759d139e42c658acde4106029f3d99cd8a7bff586761b5a8ad1ca0038fc08

SHA512
1a3a65ac62d6301f2c9d9b010523e59e7936383642020b8257643b764d75160a7f41005dfa78e74c529ef6f2973073581d4c2fefd44a80513fa20ffa82be6cfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
91b999c2ebf628e3940ebfaa827026c4

SHA1
8a21fc15fc36b4eaaf1daae1fd8ff644bb49081a

SHA256
259fa7a5f0bc8d5e270c55c413cc9bb3e6aab92315c904cee30e83ba0ba33419

SHA512
f6afcf64574c34a76fe394f9cc0962e30a1bcdaa79e6ac025c47d0a5cc2540a03313e5645ac5dd1d11af6c38ac8f35825a2af69d3ed7c9d344d376fb482d9192

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
714c39c5c71e943aeb1fded7c3d3b39f

SHA1
bf2291df64f9d3b25ab276c8d5bcff5bb3ff8dea

SHA256
8770e31cbc0d2cb65f1316a4f4376d30e4bcedc6965c6de85959a6cc7dc0b260

SHA512
2a59bbe8491f94e30246e589959904830302f0f76d439e4683bdd4bc76050866b4f83d0b7ec657fb1b93f5337ef2e3597230137b09bf3bd219cfa38e8f9c3447

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cfdfe75a5350fd44a1c0bd9c293e9059

SHA1
9c9d3efcc58ed4be0892d9d798a8b7a8d16723c9

SHA256
3a8cc0b9965170a37e59d1743f2fc22f3c457035783e6d8e16a5c17b0a1f8b26

SHA512
280231adad502a3327c00dda00633355f0c9e53bb326c45329a073a3784806d010ceb0afba8c4081959161fbe3df68db6cdd113ec703dfaf451f2f68dcb6df6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
367B

MD5
fc143320fcce5a9a38dc4ddb4838ac19

SHA1
0f5301c054ee0cc8dde6a17513cefa35877e7b12

SHA256
971fd3ee3e421ba997b1e4abe8f3637b236ac08f243ac9d5a22ad929fc68da91

SHA512
0bfd6f04d1ed97177eb706020043cb00d54767588b8e98fdd0cca96fabefa8ff9d72a7d14a7baacf9b2b84f34e4d638a8ef0481286e23a5fc316fe7c4b353f02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5825e2.TMP

Filesize
369B

MD5
608c29f16350bcdd38a872deea9c85e6

SHA1
365c858619a8fd5c6cf659984e77a6d2af312448

SHA256
5b9db89d225c6dd89737281696fae86ecc40ce98f2d998bebaf2d8139d3813f9

SHA512
11fa07b11f07a995b4373a3c6984d777ab95fd0d4be360999fdc4eb7bdccd6ca69b7bea74c38e289dd303cdf0263184065086696e45a5ba0c4ffced22a01953c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e0af60cacc39e63ab90e1446e75ca1f1

SHA1
b542e351078d55a920264247c102661f1948f992

SHA256
e73cd4f690b7fd0fb0735c85bacce8870b6a52d4957dd78bf748c63ab540f032

SHA512
33252ade2c55bc73f1fa9f858e746726ed4f6827b5bf3c076e11277173e2d64ba838327516217b19f4cedb2fa81c0f836e33a6095989f8e5b684a735f61eb10b

Download Submit
\??\pipe\LOCAL\crashpad_2464_IDHWAGFPFXPELSER

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit