netsupport | hxxps://www[.]4sync[.]com/web/directDownload/6033ncGL/Xnj9cMHB[.]e4e6ccc0289f9d9ebbf4ffc177a6b242

Analysis

max time kernel
51s
max time network
55s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
19-02-2025 10:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.4sync.com/web/directDownload/6033ncGL/Xnj9cMHB.e4e6ccc0289f9d9ebbf4ffc177a6b242

Score

10^/10

netsupport discovery execution persistence rat

Malware Config

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport
Netsupport family
netsupport

Blocklisted process makes network request 2 IoCs

flow	pid	Process
19	1084	WScript.exe
20	1084	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\ProgramData\\w9wlrhg\\client32.exe"	WScript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\scan_doc_000_320.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
2076	msedge.exe
2076	msedge.exe
3980	msedge.exe
3980	msedge.exe
1664	identity_helper.exe
1664	identity_helper.exe
2792	msedge.exe
2792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 4924	2076	msedge.exe	77
PID 2076 wrote to memory of 4924	2076	msedge.exe	77
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 884	2076	msedge.exe	78
PID 2076 wrote to memory of 1744	2076	msedge.exe	79
PID 2076 wrote to memory of 1744	2076	msedge.exe	79
PID 2076 wrote to memory of 776	2076	msedge.exe	80
PID 2076 wrote to memory of 776	2076	msedge.exe	80
PID 2076 wrote to memory of 776	2076	msedge.exe	80
PID 2076 wrote to memory of 776	2076	msedge.exe	80
PID 2076 wrote to memory of 776	2076	msedge.exe	80
PID 2076 wrote to memory of 776	2076	msedge.exe	80
PID 2076 wrote to memory of 776	2076	msedge.exe	80
PID 2076 wrote to memory of 776	2076	msedge.exe	80
PID 2076 wrote to memory of 776	2076	msedge.exe	80
PID 2076 wrote to memory of 776	2076	msedge.exe	80
PID 2076 wrote to memory of 776	2076	msedge.exe	80
PID 2076 wrote to memory of 776	2076	msedge.exe	80
PID 2076 wrote to memory of 776	2076	msedge.exe	80
PID 2076 wrote to memory of 776	2076	msedge.exe	80
PID 2076 wrote to memory of 776	2076	msedge.exe	80
PID 2076 wrote to memory of 776	2076	msedge.exe	80
PID 2076 wrote to memory of 776	2076	msedge.exe	80
PID 2076 wrote to memory of 776	2076	msedge.exe	80
PID 2076 wrote to memory of 776	2076	msedge.exe	80
PID 2076 wrote to memory of 776	2076	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.4sync.com/web/directDownload/6033ncGL/Xnj9cMHB.e4e6ccc0289f9d9ebbf4ffc177a6b242
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb38b43cb8,0x7ffb38b43cc8,0x7ffb38b43cd8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,141629280020892309,10945019957771643741,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,141629280020892309,10945019957771643741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,141629280020892309,10945019957771643741,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,141629280020892309,10945019957771643741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,141629280020892309,10945019957771643741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,141629280020892309,10945019957771643741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1884,141629280020892309,10945019957771643741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,141629280020892309,10945019957771643741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,141629280020892309,10945019957771643741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,141629280020892309,10945019957771643741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,141629280020892309,10945019957771643741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,141629280020892309,10945019957771643741,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,141629280020892309,10945019957771643741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,141629280020892309,10945019957771643741,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:2588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2600

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4800

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_scan_doc_000_320.zip\scan_doc_000_320.js"
1⤵
- Blocklisted process makes network request
- Adds Run key to start application
PID:1084
- C:\ProgramData\w9wlrhg\client32.exe
  "C:\ProgramData\w9wlrhg\client32.exe"
  2⤵
  PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\w9wlrhg.zip

Filesize
2.5MB

MD5
0b3ae8e77296377d45d8cfef9e6472da

SHA1
60e3e53d445ff65fc2d2a7b0564fbace4442db76

SHA256
4eef722c0579731531122938e35ff52a380bf03199bfdfe9dca82b68b5316d96

SHA512
84683fb11060121293adfae7a4d4b12815b0b704e8bc9cc4f4e0c97e153b66ebbe45bc4d8e641d95e1d2309b55b6cd0e07cb46a84b71ad16fc7e9d3502162614

Download Submit
C:\ProgramData\w9wlrhg\HTCTL32.DLL

Filesize
306KB

MD5
3eed18b47412d3f91a394ae880b56ed2

SHA1
1b521a3ed4a577a33cce78eee627ae02445694ab

SHA256
13a17f2ad9288aac8941d895251604beb9524fa3c65c781197841ee15480a13f

SHA512
835f35af4fd241caa8b6a639626b8762db8525ccceb43afe8fffc24dffad76ca10852a5a8e9fc114bfbf7d1dc1950130a67037fc09b63a74374517a1f5448990

Download Submit
C:\ProgramData\w9wlrhg\MSVCR100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\ProgramData\w9wlrhg\NSM.LIC

Filesize
262B

MD5
b9956282a0fed076ed083892e498ac69

SHA1
d14a665438385203283030a189ff6c5e7c4bf518

SHA256
fcc6afd664a8045bd61c398be3c37a97536a199a48d277e11977f93868ae1acc

SHA512
7daa09113c0e8a36c91cc6d657c65851a20dff6b60ac3d2f40c5737c12c1613c553955f84d131ba2139959973fef9fc616ca5e968cb16c25acf2d4739eed87eb

Download Submit
C:\ProgramData\w9wlrhg\PCICHEK.DLL

Filesize
27KB

MD5
e311935a26ee920d5b7176cfa469253c

SHA1
eda6c815a02c4c91c9aacd819dc06e32ececf8f0

SHA256
0038ab626624fa2df9f65dd5e310b1206a9cd4d8ab7e65fb091cc25f13ebd34e

SHA512
48164e8841cfc91f4cbf4d3291d4f359518d081d9079a7995378f970e4085b534f4bafc15b83f4824cc79b5a1e54457b879963589b1acbcfe727a03eb3dffd1c

Download Submit
C:\ProgramData\w9wlrhg\PCICL32.dll

Filesize
3.3MB

MD5
77b3988cbae5a2550caec42cc5e8ec35

SHA1
5fa1eeb60e881bfd82eb7c3d9e911587982aaa38

SHA256
650382fe6596c8dc0c1739713c2076d4ddff32d5c177210b1241550bb8148cfd

SHA512
480f3abef7b799bd604ba9825e2b8cf681e7850373761c579ef181607980d5159c225fb486996e3088f39662f873743d25b52368045d3ae5bd8d45e44d1e8bec

Download Submit
C:\ProgramData\w9wlrhg\client32.exe

Filesize
117KB

MD5
1c19c2e97c5e6b30de69ee684e6e5589

SHA1
5734ef7f9e4dba0639c98881e00f03eea35a62ee

SHA256
312a0e4db34a40cb95ba1fac8bf87deb45d0c5f048d38ac65eb060273b07df67

SHA512
ab7240b81be04f1bced47701a5791bbeedcba6037ee936327478c304aa1ce5ae75856ca7f568f909f847e27db2a6b9c08db7cc1057a18fab14a39a5854f15cba

Download Submit
C:\ProgramData\w9wlrhg\client32.ini

Filesize
732B

MD5
d77c51ea81963ee93a78aa91112c656a

SHA1
a0becd865a1f98a652d51ff01c69f5da4772da69

SHA256
8fd748ce5016fc856e0ff3a582d05be78c8695a32467699f52a83fbf8e9a0428

SHA512
0467d084f2f25a07532399c0a0b8803fd55d32ec662ad72c97805817676ccb4ef936e290aca032741ff73ce8f40a1217bc70e32042649dfba7159c1515f99302

Download Submit
C:\ProgramData\w9wlrhg\pcicapi.dll

Filesize
44KB

MD5
9daa86d91a18131d5caf49d14fb8b6f2

SHA1
6b2f7ceb6157909e114a2b05a48a1a2606b5caf1

SHA256
1716640cce74322f7ee3e3e02b75cd53b91686f66e389d606dab01bd9f88c557

SHA512
9a98e0d9e2dda8aefa54bddb3c7b71501d638dff68863939de6caa117b0e7bf15e581a75419ef8a0da3f1c56a19f1b0f4c86d65f8581773ab88ff5764b9bb3aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aceef780c08301cd5b23ae05d0987aca

SHA1
d7dacb2528c70e3340a836da7666fcffd6f2a17b

SHA256
257d92d753dd7de9a01fb0c77c63f8c3ed01ea6d7c14d8c5e1fb2db50e0077aa

SHA512
95943d8b8db3450627559344429cb82c09fa2a61b35721f400a26378bafdb1d3243d52c7eecd3c2c355373de7f48d0bf290987e7064d80b9fa689f17475ae729

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e826770e88318fe8f2db3f380cc22916

SHA1
d4ebc1b80456022971bcbe046fbc95b821592eca

SHA256
39b58b21a085a32ab8c05a900f7865051b785bc0cf2b499a1cc8e26adc34165a

SHA512
c8f2f24e216db852c957bea9d5d3961b15d7274b02e72534ae496bbae0149c682155a6a24a0b74bdbda62374050e71e897d8010aeefd4c13d1290327b30708b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
345KB

MD5
0b0b19c1714ea46eb2163418a2dc5151

SHA1
b49d64b82bf3944b2d6ae49d02786192b7348c10

SHA256
ecb42c626d45a67238124c29431ab4d865881879a3621e7278357c95f1e16736

SHA512
373f1aed3b46a1bbc7a7706ba57c5b3cb38433c47a19c0cdba387719a1ab6e0b635ed0db511160ec5826b1be2b26d7000928a1850e66acaa3f36fd2e370a5dfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fc83014bb03af2a49413d12ea0bd7abb

SHA1
9b8b46b193d33716d9192084d7c197a357295c16

SHA256
48158100fadbc0e067c016860f629d73236fc902b6b53f857d46c048193d62b7

SHA512
4bf1bdc492d24eb46bba82b477b6d573103bcff2b7614870616b763030286a55de291d37dc51adcf1c0fa2293f052bc09e5ebc4fd649f8886d8829c67b8546bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5300e30423d2db2e6f7349ce8531fb9a

SHA1
b12e326fafd374908aa7014ee5b01f147a93dd4c

SHA256
451fd7b6d24ef966811113d5aa8bb142e746aa801c09a107d1d9bef5f0beac7b

SHA512
495cab3c629a98e3e33c2661f3b7bfba7aebb3dcf783f1b820ef5b693cd862baab3f55971d535122878b09a55a07b0622ec873f984a24327a3a17c09e09c982e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
02f39614cc87a8832acd263a58144fcd

SHA1
199ff9ce4d674b617ba52762803941031e25553f

SHA256
c1a81f2d593149c42b401e19d8d608c84fa18c9175d8c8fece1bc33384b010ea

SHA512
d5f39bed3e368162b4d8cc2c5dc9bd378442a1cab3ea81e5c0d1ad70cb1be3003661ecbe8177d63f317ffa2aedb14cb78680a3ac484667589c0d66dfb9bae9ba

Download Submit
C:\Users\Admin\Downloads\scan_doc_000_320.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit