hxxps://pub-5e34bcda437b499399d6abc116886480[.]r2[.]dev/indexR[.]html

Resubmissions

25-08-2023 14:05

230825-reav2seb7x 10

25-08-2023 14:00

230825-ra8araeb4z 10

25-08-2023 13:55

230825-q75qfsea9s 10

Analysis

max time kernel
301s
max time network
292s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2023 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pub-5e34bcda437b499399d6abc116886480.r2.dev/indexR.html

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
5020	msedge.exe
5020	msedge.exe
392	msedge.exe
392	msedge.exe
5064	identity_helper.exe
5064	identity_helper.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

392 msedge.exe
392 msedge.exe
392 msedge.exe
392 msedge.exe
392 msedge.exe
392 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 392 wrote to memory of 4088	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 4088	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 1420	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 5020	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 5020	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 4308	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 4308	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 4308	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 4308	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 4308	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 4308	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 4308	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 4308	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 4308	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 4308	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 4308	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 4308	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 4308	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 4308	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 4308	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 4308	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 4308	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 4308	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 4308	392	msedge.exe	msedge.exe
PID 392 wrote to memory of 4308	392	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pub-5e34bcda437b499399d6abc116886480.r2.dev/indexR.html
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdef2246f8,0x7ffdef224708,0x7ffdef224718
2⤵
PID:4088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,8279028663406729805,3362103591766379685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,8279028663406729805,3362103591766379685,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
2⤵
PID:1420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,8279028663406729805,3362103591766379685,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
2⤵
PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8279028663406729805,3362103591766379685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
2⤵
PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8279028663406729805,3362103591766379685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
2⤵
PID:3712

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,8279028663406729805,3362103591766379685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
2⤵
PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,8279028663406729805,3362103591766379685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8279028663406729805,3362103591766379685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
2⤵
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8279028663406729805,3362103591766379685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
2⤵
PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8279028663406729805,3362103591766379685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
2⤵
PID:2496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8279028663406729805,3362103591766379685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
2⤵
PID:3004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2120,8279028663406729805,3362103591766379685,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5332 /prefetch:8
2⤵
PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,8279028663406729805,3362103591766379685,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5296 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:816

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x150 0x2f8
1⤵
PID:964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a7ad9bb1054aa03e39b3554833d0c3ec

SHA1
cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9

SHA256
0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189

SHA512
d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
7914f1bd48aa8a833f8f8398e4151406

SHA1
9f49e79c3b14a5f30a521d168a81d8bcb9281706

SHA256
84a0c9829eabea9d0eb4f37ed71e32d22b0f9a16ac4e8eda4e3a3ea67a796f67

SHA512
f38da1048250ef177dec95532ba447f1accb1b2c1dd246530f1e066b247ecafa652858e6db1580b3f2a747e8f2c959cdb0d14ae5ec9e10bf27ff57a106df8fcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
691B

MD5
3e234f0dde88f19ea97c0d7ce96dd734

SHA1
767026da65b05b68c19060ef5a88898a687f4758

SHA256
1ea902868fe1c654d0f1e9da74807ad96960ee74af06545d066dc783bed32cfd

SHA512
62b749e93fb9e71413a6addd5fe2ad58195fab7269d0eb718cfa699b3de9f10bfb65e1315b53536ac8d0ecdea3317352263ab903aadeeea29e53b8da4a2e65a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
26ad883f8ae94834b7343bcd7527f41a

SHA1
d3d4fe5e60ed46131829dfdfd88baa821a87872a

SHA256
d910675ad2b1d04b7156dccb3e5727237c7fa1263d05f6d2e2006dbc2ee3729d

SHA512
fa99f1636af9dda35f1ef7be57a5de1fccd8f25c20c8f0bb294c1aa911ff7a554aa89ae6c60920578fab652c1e1abffee7a25077e3542d8178b504be565d4475

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
48fef4b3c0415242a415471cad41b1b1

SHA1
a9847b503c3a51243daa2d6cae3cc19a46278dc8

SHA256
ff79f23a3fd526a27322292e61243b19e68ce4903d24abe908de97243e5252b6

SHA512
998c8499e217179e6157cd35e6cf0de900668c64fdd9b50a4c6caaa33d403c3c43d539c68b1f43856b17140dbd2b25ebf42334cff0eb83c3ecc04b099e66d373

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
b64f53f9c3828a70dbe3c3860286351f

SHA1
1f9cc2ed74dcbfd45b15b83d0a339d28aa14acae

SHA256
f9e5a9ddd7b3f8d35365924f12d7503f2ba5d2f4ab87e48c6bd84fe231c0e73e

SHA512
c48fb8b0857dad37c9f7c09cd356933c9b449b63e9643feb9f0790442f90a24fb29c89f2e077042877e53eb614305c468762213c8e296dc3fd3ea1838fa3f52b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
129af3d0340574673f75bc9a57b9964f

SHA1
4b9ecbb43786ee403afaa011a6864f2a52aa5821

SHA256
2c17d3e1c9642d9f41d4f505e949b52439c9ca8a83352726a972b5875c4603a2

SHA512
74370a016cc5bfe64297a8fd49f6e80c5d20b0bb3a16f9cc1822439df9a49fe005ae9dccbdf281fe2a4e87d6e863b4b3d4e9a5c9c40ee115ee7c76977b1b95dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
fe5eacca13cfe98162215a7ab3edb4dc

SHA1
e16d00cb217705f235b5e2ab9742b1c4c2ea7e72

SHA256
ee4cafcfec6b42ee3571c5de1bc76b0ce7c945c4627f607ef41f5cf21eda5351

SHA512
27251f6c9bfabaa8477bdca73d745f70dd8ce253acf8f883625721d73b0ace2ab0f4cbcd602d053d992cf2629dfd8242c8f00950fdabf6bbf21211bb32c39edd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
e62cc4051e1f8eaa0abda5d730a2496b

SHA1
d15346e40b196bc313cbfe5ac96b3c90b83345be

SHA256
ffb5b740b8777d010f0d32a120092084c3cd32eaceb937188d698ddc22df2fcb

SHA512
3e8f6d89c7c153177b2149d86cd8602ceafedf66f5335a86b19dfa46fc38c47f6ff9a272c3b71b4464a5921ebdf2461fba25692ca916b9715bac520bf1e81a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
3aeeaf75a5f0fd510c78666a9bf392ae

SHA1
66c1a56b2dd805afaef863bc7f6c1f41ac075cbf

SHA256
3395567b5a910b2a215a7b350d5e91b40fcca4bc5150a5a249ebc130a28e37cc

SHA512
3407a4f269ee0f06f8bf087f446bc8ec1236a293a0407cac0373c29a6297b6ff289b6d92c46eef00833bcc6dbd7954ed283d8f48595b5a183afc9be385c63cdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
5fd8306c9a82f316cbebbd0c5f92f649

SHA1
8573f65371920e5faaf2ad763cf650718dedfaf6

SHA256
7ca2aaaad413993d750dbe1fc41a18a734c3fd7fad9839ed1facebd8d81a0a67

SHA512
7eae6c17adf68ded0814d46a7c20f90788e0f0c8753411993b5e18dcedbb22a63fed365002e97280b5300a5e5b710cfadd014add188830627a2f91bab5ea8eb3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\LOCAL\crashpad_392_KBBMOSTHJJXWWTKK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit