hxxps://s3[.]timeweb[.]cloud/bf45b87a-docusign-document-fileshare/docusign/Docusign[.]htm#accounting@kopikas[.]com

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
21-11-2024 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://s3.timeweb.cloud/bf45b87a-docusign-document-fileshare/docusign/Docusign.htm#[email protected]

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

NTFS ADS 3 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\download:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\download (1):Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\download (2):Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
2364	msedge.exe
2364	msedge.exe
2176	msedge.exe
2176	msedge.exe
4416	msedge.exe
4416	msedge.exe
3184	identity_helper.exe
3184	identity_helper.exe
3976	msedge.exe
3976	msedge.exe
4760	msedge.exe
4760	msedge.exe
3100	msedge.exe
3100	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

msedge.exe

pid	process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of FindShellTrayWindow 49 IoCs

Processes:

msedge.exe

pid	process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2176 wrote to memory of 5012	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5012	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 5008	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 2364	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 2364	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 3076	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 3076	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 3076	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 3076	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 3076	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 3076	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 3076	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 3076	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 3076	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 3076	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 3076	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 3076	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 3076	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 3076	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 3076	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 3076	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 3076	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 3076	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 3076	2176	msedge.exe	msedge.exe
PID 2176 wrote to memory of 3076	2176	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://s3.timeweb.cloud/bf45b87a-docusign-document-fileshare/docusign/Docusign.htm#[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffde3d33cb8,0x7ffde3d33cc8,0x7ffde3d33cd8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,9902606174462241530,7795702045572160629,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,9902606174462241530,7795702045572160629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,9902606174462241530,7795702045572160629,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9902606174462241530,7795702045572160629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9902606174462241530,7795702045572160629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,9902606174462241530,7795702045572160629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,9902606174462241530,7795702045572160629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9902606174462241530,7795702045572160629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9902606174462241530,7795702045572160629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1876,9902606174462241530,7795702045572160629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9902606174462241530,7795702045572160629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9902606174462241530,7795702045572160629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9902606174462241530,7795702045572160629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9902606174462241530,7795702045572160629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1876,9902606174462241530,7795702045572160629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9902606174462241530,7795702045572160629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9902606174462241530,7795702045572160629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9902606174462241530,7795702045572160629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,9902606174462241530,7795702045572160629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1876,9902606174462241530,7795702045572160629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,9902606174462241530,7795702045572160629,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1184 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
003b92b33b2eb97e6c1a0929121829b8

SHA1
6f18e96c7a2e07fb5a80acb3c9916748fd48827a

SHA256
8001f251d5932a62bfe17b0ba3686ce255ecf9adb95a06ecb954faa096be3e54

SHA512
18005c6c07475e6dd1ec310fe511353381cf0f15d086cf20dc6ed8825c872944185c767f80306e56fec9380804933aa37a8f12c720398b4b3b42cb216b41cf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
051a939f60dced99602add88b5b71f58

SHA1
a71acd61be911ff6ff7e5a9e5965597c8c7c0765

SHA256
2cff121889a0a77f49cdc4564bdd1320cf588c9dcd36012dbc3669cf73015d10

SHA512
a9c72ed43b895089a9e036aba6da96213fedd2f05f0a69ae8d1fa07851ac8263e58af86c7103ce4b4f9cfe92f9c9d0a46085c066a54ce825ef53505fdb988d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
86a01913b4f58a7e9dacc9261fc60927

SHA1
aa7c130bcef0c00aa1bbcca2e4b6d8d621328ac9

SHA256
01978a6c663495b2524d6024f93fe5ba5400c698d2d5ba4c0c383c24f5c2bfff

SHA512
5c30d72a17286f8739018bb787ef181e5ff71aa60ae2f26bd9235efaf57d34c654114d8eb5ddb42d0a73edde5f757786609b1fe6611e4d6bc551ba83d77c6e6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
536B

MD5
1da7895c0755178f0500766509223eaa

SHA1
b770d61e26abec6d648e134bb19113d26ff0a72f

SHA256
2b0c3744a560ce3e27d65263642ac8d6e8ca464b0f3df845c1d5c7feb02f975f

SHA512
ec563050e1ee49795c9807734040e8b2db1a6b7112fd54c631e7c7a97354c55ba2e7733fb48cfb188b56cbf4c13786fefffcbc8e78ed70fb7b701bf6a2dbad66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9d99f50a641cfd12c1ce27acf46475ae

SHA1
2f6a4e6357591a404edd20e847e6a293fa41e8b5

SHA256
327e72b1afee4b6682dfcf44a7fb83129cdb545038ac0bd603135bf8ebacc099

SHA512
d1b6479277186280d20a1ec11e7f45f6b307b84b5b3bf36b99528f05e86b21302d65e49013c2bdff3a43485b0d826a839563ecf3659a86cc591a845633cd503c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98d6e14fc959831ba1268eecccddabb7

SHA1
e8a026beb0b1647a48c44d13d45063fb58e52be4

SHA256
03b4996aa78acc6020405fa6d9301c2ddf074c7bf13b28211df54a45fb8bd841

SHA512
e208aae101ad4ca2c4effbcdc4ddd5f40c680e4c0d3c74752904818031714810e6e484cdae67c7e7e14be6749807da3c56a6af0ff3353f2607a858c6c936258b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ad157a1db0723d663103dfaa07f042f3

SHA1
1695b2391be8ec4486193fa36e5edcbafcf714fe

SHA256
3a771a530ab5a53a33bdc2afeeb89418ef245c62edbda8b23e44772455b3e0a2

SHA512
8ccad64db2e345ec4a05ea4aee28ed5b86fc8dc324babc5ac6f444b35adbdef29b1065ddbaa660394a136eaa5bbe96defa918f839999c855c724434a9cb15f77

Download Submit
\??\pipe\LOCAL\crashpad_2176_LUJWJDEOGCAVCCNF

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit