214bdcc5ac1c310aad7ea04300292cce0059ba916639ab5c7e5e98df70486822

Analysis

max time kernel
120s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-11-2024 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

214bdcc5ac1c310aad7ea04300292cce0059ba916639ab5c7e5e98df70486822.exe
Size

112KB
MD5

eeaad20f2c2f86d9500514c779db38ab
SHA1

2bb247e66820c46e8d665b7ffdf7c56382027249
SHA256

214bdcc5ac1c310aad7ea04300292cce0059ba916639ab5c7e5e98df70486822
SHA512

f198ec17657cad187ef852d0b30462dcdb8f9dab74f192ca82149341432dce2fb44b58ff095ace636b7f2580495af36c3b239b01c3e272b9065e9a880909bace
SSDEEP

1536:2clSIN36Xm8czNDW6c3OBBgqJuYy6s6gs4pb3ARUbsoEDdpy0pdjevEXeYV:HNqXGzo6c+PgvMwRsU7EDjyGdqsXbV

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

214bdcc5ac1c310aad7ea04300292cce0059ba916639ab5c7e5e98df70486822.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	214bdcc5ac1c310aad7ea04300292cce0059ba916639ab5c7e5e98df70486822.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

2312 msedge.exe
2312 msedge.exe
2392 msedge.exe
2392 msedge.exe
2368 identity_helper.exe
2368 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

2392 msedge.exe
2392 msedge.exe
2392 msedge.exe
2392 msedge.exe
2392 msedge.exe
2392 msedge.exe
2392 msedge.exe
2392 msedge.exe
2392 msedge.exe

pid	process
2312	msedge.exe
2312	msedge.exe
2392	msedge.exe
2392	msedge.exe
2368	identity_helper.exe
2368	identity_helper.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

214bdcc5ac1c310aad7ea04300292cce0059ba916639ab5c7e5e98df70486822.exemsedge.exe

description	pid	process	target process
PID 4788 wrote to memory of 2392	4788	214bdcc5ac1c310aad7ea04300292cce0059ba916639ab5c7e5e98df70486822.exe	msedge.exe
PID 4788 wrote to memory of 2392	4788	214bdcc5ac1c310aad7ea04300292cce0059ba916639ab5c7e5e98df70486822.exe	msedge.exe
PID 2392 wrote to memory of 2824	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 2824	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 3016	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 2312	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 2312	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 1000	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 1000	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 1000	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 1000	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 1000	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 1000	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 1000	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 1000	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 1000	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 1000	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 1000	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 1000	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 1000	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 1000	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 1000	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 1000	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 1000	2392	msedge.exe	msedge.exe
PID 2392 wrote to memory of 1000	2392	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\214bdcc5ac1c310aad7ea04300292cce0059ba916639ab5c7e5e98df70486822.exe
"C:\Users\Admin\AppData\Local\Temp\214bdcc5ac1c310aad7ea04300292cce0059ba916639ab5c7e5e98df70486822.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=214bdcc5ac1c310aad7ea04300292cce0059ba916639ab5c7e5e98df70486822.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff65f846f8,0x7fff65f84708,0x7fff65f84718
    3⤵
    PID:2824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13813583583477281551,13336330123733878819,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,13813583583477281551,13336330123733878819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,13813583583477281551,13336330123733878819,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
    3⤵
    PID:1000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13813583583477281551,13336330123733878819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:3600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13813583583477281551,13336330123733878819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13813583583477281551,13336330123733878819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
    3⤵
    PID:60
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13813583583477281551,13336330123733878819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
    3⤵
    PID:1528
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13813583583477281551,13336330123733878819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13813583583477281551,13336330123733878819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
    3⤵
    PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13813583583477281551,13336330123733878819,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
    3⤵
    PID:2216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13813583583477281551,13336330123733878819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
    3⤵
    PID:452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13813583583477281551,13336330123733878819,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
    3⤵
    PID:1916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13813583583477281551,13336330123733878819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
    3⤵
    PID:2884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13813583583477281551,13336330123733878819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
    3⤵
    PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=214bdcc5ac1c310aad7ea04300292cce0059ba916639ab5c7e5e98df70486822.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff65f846f8,0x7fff65f84708,0x7fff65f84718
    3⤵
    PID:2416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
44eaa2a14f4feb36977950c3b1ca3a61

SHA1
15df630029fd17d1f0aef3272f1bdefaaa78a8d7

SHA256
27e4dffdd52bb790105fa94516274cedc2aa1c2652897b65fa3a541827cc45dc

SHA512
34ce2473cab601df53f2e69560215935dbd73f9ec60acc802dcdf2bd683c02cd682a6cd8da1d96fc6d7e53329d3e96bb6058c50c500a6ffc5e9f6ddbbe2dd2da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ddd6d68bfc292aa7141796b066ab8342

SHA1
057c38917253a1c14f864287e02deda11b6bf9e1

SHA256
a8cb3d9ef8daa871f1ce4ba5c13d85235b875126e3ee2f15f578f08ac7629dad

SHA512
6abeca495aeac7ffd517b66edcf21f0f4e566eb7309e249e18d7b1e904151b5ec9444a89c2ae2fdb494e4ea0e32539e94e08a3f6e8bfc398eae78914f9fcda01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e750a2b6ed1c1ce3432be9aa0192a4be

SHA1
be8e5ca4730af51418cd1356d9dd665bd0029654

SHA256
d94fa94579fa17ff350ec8c59ea368b1e24c52c29bfc72313659587a4584b5fe

SHA512
94833835a1afed1e98c51b61517895b2ac8c27811dc210b39d431c3452732c77e7deba9c4f38667f1a0d02b15c93315a78cc33a42e972bafb69464e565693ffd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ad8a65f92ed86fe0087de332087b7f14

SHA1
c2c769d4cb3dea041b4fbddbc85eb75440bfbf29

SHA256
3ab556e25cdf7060cc0b15f2ced2490818faf7d729f7cc4ce953ec8ad423dd72

SHA512
b49d19877d8214938f63b5289482ec940c84e1703bc537d395ec2fce5a55970cff549951e7a23c541c407aa3d8b673098ca44d6b39c65553213231d6afc8db63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
34bff9dc0427736ed43d7793db19d032

SHA1
a2ebc94d8c59258b95bb667447ce4f12305c2079

SHA256
a06796fa9f7e30a32d20b30e90b7629ded2719de145343cdaf58318a59a2c9d4

SHA512
86b88a5e435b024b5377e28fb9ccf792508094305d6cf59842ac3377eb5b3d6545d78bba40f9338b313977e8f268996e76b6b7646d0b03a432a0829a938f05e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e32c.TMP

Filesize
371B

MD5
6b8e3d1a9795aff21d1e372ebcc0ab50

SHA1
e5f5899606bcacc48c53ac3fc633e4b79ed1115d

SHA256
a47e23a100b1a0cca17d18ae3f9f344976b2a7ab9b5ed2983e67522416c32d2b

SHA512
b59a5b94527c6bd950c3fff093da4ea50fff6e544f7e20c68b83d9bf87473dcd766fe3527a05e18b9994264858361e22addfe02a7f09c9fa48b019677f7b8498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3ab01c8f3f6bb454849d652a9c7d4a15

SHA1
cae5203a2621a8fcd4f8686ea2341d1ea1a0e14e

SHA256
a37ae416253266ad1291343a0fb38fa50f0535675ff630347862f0c6ff027200

SHA512
ee09ca438a7990800bcec0d5a2611dc148acab6ec6bbaa8c573af4dcc2c8603f49287f0ebf3e738dad031efb4cee2e00b41d5e35fa635ef6c68a6897bab048f2

Download Submit
\??\pipe\LOCAL\crashpad_2392_FBXJKJUQOLBGGFQO

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit