6bba081474e42a3ce8713a0619664e069ba15e271d28cc134009af3f53c7bdd1

Resubmissions

21-11-2024 23:47

241121-3tapdaznbs 8

21-11-2024 23:21

241121-3cam2swrek 3

21-11-2024 21:39

241121-1hkn4axrfy 10

Analysis

max time kernel
1153s
max time network
1156s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
21-11-2024 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EXM_Premium_Tweaking_Utility_1.0_Cracked.html
Size

469B
MD5

8c1a6acb0cf4efaea77c25de80dad5d6
SHA1

28a858f732ce50193e5c24b3c26f8ac59957f078
SHA256

6bba081474e42a3ce8713a0619664e069ba15e271d28cc134009af3f53c7bdd1
SHA512

84ef0ba97c9a4f7a48016905a816b5cd83ad4e862eb20cac2b8e82ef42ecdc54f40aa485ae8fccf6b96bbb0ec890ffac0fbb0bf8289389d6b77ca2469d29c7bd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
2820	msedge.exe
2820	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
1464	identity_helper.exe
1464	identity_helper.exe
4988	msedge.exe
4988	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3648 wrote to memory of 4276	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4276	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4776	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 2820	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 2820	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4944	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4944	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4944	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4944	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4944	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4944	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4944	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4944	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4944	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4944	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4944	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4944	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4944	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4944	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4944	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4944	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4944	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4944	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4944	3648	msedge.exe	msedge.exe
PID 3648 wrote to memory of 4944	3648	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\EXM_Premium_Tweaking_Utility_1.0_Cracked.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb99b93cb8,0x7ffb99b93cc8,0x7ffb99b93cd8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,500460407889669687,6727311611556846086,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,500460407889669687,6727311611556846086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,500460407889669687,6727311611556846086,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,500460407889669687,6727311611556846086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,500460407889669687,6727311611556846086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,500460407889669687,6727311611556846086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,500460407889669687,6727311611556846086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,500460407889669687,6727311611556846086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,500460407889669687,6727311611556846086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,500460407889669687,6727311611556846086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,500460407889669687,6727311611556846086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,500460407889669687,6727311611556846086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,500460407889669687,6727311611556846086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,500460407889669687,6727311611556846086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,500460407889669687,6727311611556846086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,500460407889669687,6727311611556846086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,500460407889669687,6727311611556846086,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0a1774f8079fe496e694f35dfdcf8bc

SHA1
da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

SHA256
c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

SHA512
60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e11c77d0fa99af6b1b282a22dcb1cf4a

SHA1
2593a41a6a63143d837700d01aa27b1817d17a4d

SHA256
d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

SHA512
c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
82972f81acaf7764653ec2d97aca607a

SHA1
07b03d5a46740b78ee78554794cc5de915766e64

SHA256
870b6d5902dd180ea0b41e9b465f4d6566244ba0a53b28c048cadb4daad59dcb

SHA512
507db040468f976972aa4c2eafadf2777a2f70bb1043ea6d852ea720c4cb60b09d3f32de14e84f67c8092b15cdcf165cfcaa47c6715b56d98c33c43ad1fe079e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
8e5408f3d1d49c0edaf80a2c06e2881b

SHA1
aa8dcf285c679f02c1f6a4b6656de7e68648ce64

SHA256
825fe1e3c7428af3d82add89b40cb947bb613a01f3cc21a99ff4f866d1ba2c90

SHA512
74fef3061090be98e837fd3353ec2b61de4bd7cbcc71fe71afe93b0aaa9f8186316646eab0455c6289d9b99f1b1532c9d90fab98b09ffd41989a50007819b19a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f22c9e434a76d3251897a9a7009099a9

SHA1
2a99e86868be7e414570ecb3ab0bbd21276bc170

SHA256
bb6c3e47aba42babe45fa04659d5e6031da67eeeebd1bf1df86715af750e17f4

SHA512
430e66b832fbe34d3472f00e8210a25c06533f6eab62011aef40add53a118d41a5f5bef37ba02ba609f299a1ce1864d14279b7145c94885798305c9acb2fdda6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2d61b5f5342666d44916e64ef347cb92

SHA1
f02a3722f1ff8bff74ea5f215dd168f0e8a55869

SHA256
892f7bb16eb0f5c5784a02a59600edaad801dc3b4dd08262c2b47003972177a3

SHA512
0fb67f82801da69bebe41ce0e00a4194dbf75657fee3600b623f97d2437d56069491c481f650bfbb00a3734397992ea811cc57728159a490fdf7fa8225b263e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
29274d4e3f526d751eacb58776248e7b

SHA1
67ad0b91938243d9ee50d2fd58904d1e8efa8b90

SHA256
89ac1458571ca441e3455b6aacb5bd2772801460b2cdf504c27a35c2027af7dc

SHA512
a3c30fdbd527a0b53e543f3b2c6d05b63599a5570a89d3cbeec3416fb6e815299eb849faf9f85d2043945b1070c46fcd3ee139724e9c8e298bdff98ba08d0eb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9194f895d2faa43883677ef33606ed02

SHA1
5afc9a7a554529c7b8764f90f9dc764503e6977b

SHA256
321237e875679946a1478e6ec12799daadbb42145a4623ef9bcdd40c0a35b218

SHA512
9c0e92ae7d73432ba9f209cd014eb6686d890ba35f35655a1a35de541fa0ba0d7b199cd2e8b60c8bd300e98b7eea6ecc2e4696a93d4e49fc74bfd1cb4ef66030

Download Submit
\??\pipe\LOCAL\crashpad_3648_HJOFOJPQKQBFUAWX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit