691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee

Analysis

max time kernel
116s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee.exe
Size

202KB
MD5

e40eb9e0a8631f33c59c75d58a13d848
SHA1

341fa043a97386227b145ac81711bce2481c2d7a
SHA256

691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee
SHA512

91a8c80a03446174dccc9309ba6865ae090e87c365af73fded4d3507bf81b00f81839e32db69eefef7a6a05d244b94209bf5db3a61353312eb8e1add6a6f6ca7
SSDEEP

3072:DzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIHF8JS04/B4tD77heYN1uadhNJ:DLV6Bta6dtJmakIM588PhhekEWNJ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

3868 msedge.exe
3868 msedge.exe
4080 msedge.exe
4080 msedge.exe
1160 identity_helper.exe
1160 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

4080 msedge.exe
4080 msedge.exe
4080 msedge.exe
4080 msedge.exe
4080 msedge.exe
4080 msedge.exe
4080 msedge.exe
4080 msedge.exe
4080 msedge.exe

pid	process
3868	msedge.exe
3868	msedge.exe
4080	msedge.exe
4080	msedge.exe
1160	identity_helper.exe
1160	identity_helper.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee.exemsedge.exe

description	pid	process	target process
PID 984 wrote to memory of 4080	984	691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee.exe	msedge.exe
PID 984 wrote to memory of 4080	984	691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee.exe	msedge.exe
PID 4080 wrote to memory of 3128	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 3128	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2948	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 3868	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 3868	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2196	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2196	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2196	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2196	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2196	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2196	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2196	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2196	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2196	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2196	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2196	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2196	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2196	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2196	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2196	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2196	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2196	4080	msedge.exe	msedge.exe
PID 4080 wrote to memory of 2196	4080	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee.exe
"C:\Users\Admin\AppData\Local\Temp\691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xfc,0x108,0x7ffb25cc46f8,0x7ffb25cc4708,0x7ffb25cc4718
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:2948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
    3⤵
    PID:1976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
    3⤵
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
    3⤵
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
    3⤵
    PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb25cc46f8,0x7ffb25cc4708,0x7ffb25cc4718
    3⤵
    PID:4044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
21483d8890edb81f97f707a7bb6d6923

SHA1
74455d18d8ddf8b9d9adf187a06b1d3a9193e1ff

SHA256
e2967298017af538fb1b3f9db0275fdd3a2bd18ac5471b8a5748f9ccbb3b0e59

SHA512
cc6fdffa73a79b3b6cc379eebd7db0c19a91494cbf10678ff30ef31412475a1afab4688e6a4d932d1ad02211fcaced8d2d9c2c47be078d00605ca7b9b43bda3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
08eeed58ef1f680bf41e7c07aa9f555e

SHA1
c6b0532638cf1ad0c0d1c75f15a677d09daa9639

SHA256
65c8bcf99c8c309ebe5911c8e8b5480efe753de88909cbb5c3a23155dd874516

SHA512
570a6188948fb70d4b3685f303c0ecd0db3a988cfe6fd26f90ffe16554af5e5b1c6bce5f356cd75696e9f1b019a9858f54f71dda6a12f57470dd309ee1d07d32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
beb54f16cbdbdf67e8b3e49b814bca89

SHA1
34094bfbe8b6bf87e0f45d8780db63b2983aa645

SHA256
3d385947ce094e96637a2c339dfd6a627ed3e86107e4352e9b9052de1db22384

SHA512
35ce9475b91187059f6c6d6898ad12dd954c984f448a7ce62e20225571764007a1b7d13a8c8876f145c1e5caaf3e49922882f21b2e74fda36180bf3a111b3c99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c9b9d536d836de6ef0c40e139311b5ab

SHA1
5bef3193ce222fee1bbc386e116fa050c8f9c6f3

SHA256
5abbfd39ea46e60580e96ea4caf87c9d4c4f99b613a3de86660124eb981f198b

SHA512
cc2274af1be9d162abcb024bd5cac1037d65caea5d061394702308450ca825a726041f5be922b20ed4176fe1ecfc85e396fe7dcebb28652fb52e46e82faf31e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
2cc2a89d19aab726c6866ee9565ac4b9

SHA1
f31703af972814d91da4146e49970226e346343e

SHA256
0e92881958c2d2fab7c3d3ac9c0af030d2ced088260996b263aa6f3a2647eab5

SHA512
0eb8f1f308f8db4ddb7e0d9681a8cdbbee770d125fa6c2d438f7a67e8ac5214ca5e057f9c3d4cd2d8dc64124c12d13c7cf5a324fdb3b111199602fe5a8ff5c93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586be4.TMP

Filesize
371B

MD5
d33a281d254b1e3a4903c9b9232617e4

SHA1
a4c2d82a5219f88c64d6890b2ad7079f2a67fb0b

SHA256
1db74860c874574d5ad64fab54b7d94eecfab3e1bd67b0abef22a85430e5083f

SHA512
1ed4e879ef99a7821f948cef230c44a723a9b98fafcbe0dc05d3b731b352d8cac2e070d97f3fb8c883129f2d8e63bf4e87760bc36ebb9766438bdef6fd06cc0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ba3cc5fc-bdf2-4487-8110-7f13ae997bdb.tmp

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
08dc5b40b705ee070706205a530301ad

SHA1
03b6e6ab43dc5b2c001451d30b36df2a7d9b18ad

SHA256
8eac4d3e9a305d1983e2b894208450f3160b7815a222d5461e92bcc98c387ca3

SHA512
c7c10a19a93d0f3a3e2b8df46d8b767802c492bd670a18958a13f999dfd3ac879c63b04d9b85b51930860cacd7973b1243e4aa4050a1ac2fb25e538673d1cce0

Download Submit
\??\pipe\LOCAL\crashpad_4080_JJXJNBRGPUBLLUZU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit