hxxps://learn[.]microsoft[.]com/en-us/sysinternals/downloads/notmyfault

Analysis

max time kernel
147s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2023, 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://learn.microsoft.com/en-us/sysinternals/downloads/notmyfault

Score

8^/10

microsoft phishing

Malware Config

Signatures

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\myfault.sys	notmyfault.exe
File opened for modification	C:\Windows\system32\drivers\myfault.sys	notmyfault64.exe
File created	C:\Windows\system32\drivers\myfault.sys	notmyfault64.exe
File opened for modification	C:\Windows\SysWOW64\drivers\myfault.sys	notmyfault.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
2112	msedge.exe
2112	msedge.exe
1992	identity_helper.exe
1992	identity_helper.exe
2776	msedge.exe
2776	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5452	notmyfault.exe
5580	notmyfault64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 1324	1036	msedge.exe	85
PID 1036 wrote to memory of 1324	1036	msedge.exe	85
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 3608	1036	msedge.exe	87
PID 1036 wrote to memory of 2112	1036	msedge.exe	88
PID 1036 wrote to memory of 2112	1036	msedge.exe	88
PID 1036 wrote to memory of 708	1036	msedge.exe	89
PID 1036 wrote to memory of 708	1036	msedge.exe	89
PID 1036 wrote to memory of 708	1036	msedge.exe	89
PID 1036 wrote to memory of 708	1036	msedge.exe	89
PID 1036 wrote to memory of 708	1036	msedge.exe	89
PID 1036 wrote to memory of 708	1036	msedge.exe	89
PID 1036 wrote to memory of 708	1036	msedge.exe	89
PID 1036 wrote to memory of 708	1036	msedge.exe	89
PID 1036 wrote to memory of 708	1036	msedge.exe	89
PID 1036 wrote to memory of 708	1036	msedge.exe	89
PID 1036 wrote to memory of 708	1036	msedge.exe	89
PID 1036 wrote to memory of 708	1036	msedge.exe	89
PID 1036 wrote to memory of 708	1036	msedge.exe	89
PID 1036 wrote to memory of 708	1036	msedge.exe	89
PID 1036 wrote to memory of 708	1036	msedge.exe	89
PID 1036 wrote to memory of 708	1036	msedge.exe	89
PID 1036 wrote to memory of 708	1036	msedge.exe	89
PID 1036 wrote to memory of 708	1036	msedge.exe	89
PID 1036 wrote to memory of 708	1036	msedge.exe	89
PID 1036 wrote to memory of 708	1036	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://learn.microsoft.com/en-us/sysinternals/downloads/notmyfault
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedcfb46f8,0x7ffedcfb4708,0x7ffedcfb4718
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11954577093847741002,16818421194377182518,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,11954577093847741002,16818421194377182518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,11954577093847741002,16818421194377182518,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11954577093847741002,16818421194377182518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11954577093847741002,16818421194377182518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11954577093847741002,16818421194377182518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11954577093847741002,16818421194377182518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11954577093847741002,16818421194377182518,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11954577093847741002,16818421194377182518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11954577093847741002,16818421194377182518,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11954577093847741002,16818421194377182518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11954577093847741002,16818421194377182518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2640 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11954577093847741002,16818421194377182518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,11954577093847741002,16818421194377182518,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,11954577093847741002,16818421194377182518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11954577093847741002,16818421194377182518,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5756 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2492

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1560

C:\Users\Admin\AppData\Local\Temp\Temp1_NotMyFault.zip\notmyfault.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_NotMyFault.zip\notmyfault.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of SetWindowsHookEx
PID:5452

C:\Users\Admin\AppData\Local\Temp\Temp1_NotMyFault.zip\notmyfault64.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_NotMyFault.zip\notmyfault64.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of SetWindowsHookEx
PID:5580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\39fc5ca0-2ee7-4445-a988-e6551aef7aaf.tmp

Filesize
12KB

MD5
1af8dee7de1cd05e47c5be052b60d954

SHA1
9700481b9e8da779d3624ee88a844dcb58a85a8c

SHA256
c84d97d11861b7d5cdaf75c76966e70bdea1398095e3891507403b82b7339f63

SHA512
124b274696eb1d517c0490054e541b6114fea9947c396bcae8811c6ac0f694dcb7a4c8286709590e454f7690e926089c008236446cbed3ad5e087d22c9e16915

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
b887dd10f8a5cb71098c7597a376178e

SHA1
1fece6539dd11e54d49c4729a190835567741c75

SHA256
c99c983e25a30005e40f5be87430aa0df8b4cb5522bfb73b1b018bb097f265b1

SHA512
abd9b9b2dc179fea02bd7ae46b4e6216bb4be5499347de875f14e59c3a3c90be2ba8c91d26aa43c995b56d4926ba54b3d8f6d65f828412b27fb8399ece572aaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
520B

MD5
eef634238e05be6fb9b68970b57e6dff

SHA1
95ec770edac30ddfa4484d83d743dc74bea59340

SHA256
4e61fa814e5f9d90e7ba93262650010a515f2118ad035a6edc804f091bf0e318

SHA512
8b546a9f8c408d9612d41deb858e16668c51d68324d9ce5d419367929291d92a81518b4ee9fec79a4c2743ab5d7c9bdf3aa6748685bfb9f0c40cf7830ce4c7d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
713971bd1828a1bfff12fb7b12540273

SHA1
30f5f8454ef196ccd5f9900fa118142da389187d

SHA256
40c70f472016628b223c81685a52b2dd1d8faadae680ac2ee5187c1b36433bf7

SHA512
8d24f368c11c8f929937970ef9e5389726cd3848fe48322fc4c4a64fa9d33835b4a8cbd1aa1c060e3cbfb7477218e88403125542cb308e3dca4bd80881d64547

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f914fec0e1107cfba03ac7f3023f65f3

SHA1
b0621ee26ab36441a0074b7eca3fe2014c24cdf1

SHA256
6d43c63d59065a27e021a8e4a460cd153e022d4eb2b74e6f4cf3e983fcbdfa32

SHA512
a78eb26fc58c96087252c1242fb8b91f0faa844c10ac4c89795f8dd037a3e49247b38ec45dd242874000f3cea892e682d4bb81f72e7f93521988ec02a789cdaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7c356f32e00d88037c0e24cb4d1e0496

SHA1
4d040d419d5d4b5472faed036af3334a917a0171

SHA256
bdcf8d8c2efe6eb88a6c4589c1a296b4e2d61583d3b5d2f67c4ad3aa671c7891

SHA512
549dcd4928e98390a43b6161d47a21a35e6387b51728d156df10e09d681014fae750e721ab307772b84a858b5313a30383f3d9a5482eadf3eee4859c49b57c6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
963a4a88f320c2101a31e0eb93672940

SHA1
c53de22326ca1f2827e8c6645f60b0fbd4a5916e

SHA256
c84cf0094d9e5dfa74d8309c9dced3d93e3d9d53bb17ec3f576a0fdc477e1dd2

SHA512
5b82affe37381a524ad1b0cd12ac43b5da2d0200925865ecd0db518ee92d1e878ffcec71f7aadda23824187aa696f3c01a1df8d817fde6bcd9b3a3a9692e4213

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b4997c59241cc46556816be92ccdb8c4

SHA1
de590d410083c59e4a6d6ca2274a66d97a0b2f42

SHA256
b5ea850a131ac45950e6314249a5ed00c3ea8a3785de02a629c4501f694e173d

SHA512
2edddc921ad6fe9975fe38eedb5022a2af8607845fc3d7f4bf1e9e07ad87d839b37f53edbd3012ef8fade721e16c4ec15d10a6fbd691847b0168924bd65a8874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3a748249c8b0e04e77ad0d6723e564ff

SHA1
5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729

SHA256
f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed

SHA512
53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
16a53176c013e5eeaef572bf6dfb0274

SHA1
e43a06ddae9c734690e2e487079a9449840371e6

SHA256
b5a1ea3f9b57fd4a10452a0f55a17f03381e4273ac6dbfec9a8523d5e03f5feb

SHA512
efb2e03acda4e7bef489778f5a1e8927f3ad0df3ccf96d10c8f86726c4b340372d78db1db0f1e8ffc569bcc2c6a6b245e63d7a3c5601d9b2fea42b99ef5c3306

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
4051f78137c6d35f63ce1b4f6ef7d130

SHA1
07132d468b80b97ce6d68a5a90f9a57498d5070a

SHA256
2fd0484145f3f9fa96833e4b01d6ec5796c7ac2bb83be72def6dc944dc5c63cf

SHA512
c8b0ea6b42d294de08559d510c4557c28852d0efb93c098845f3d8e6e9cdd16cbbb01374c3998843e5edc138656dad07feb89aad278ee57db7f188f118034ec2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
7fc183390d5344e2fe4aa0572b14e6f4

SHA1
0632c645f2581e4857e5268e61b0ccb7c95179a5

SHA256
6e13b05761124d9c970f278ff2f9a3cd2da08e076f47ae10ef54bff14660f6e1

SHA512
f34ff848093aeb22f2815c98cafe695bf2276a5466ed2fb8ee5de0f9a49f0129d2a7af4b9521b15fdf0af966f00b01d0484afb7c45255cea26cf17aa8c3769f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
9a72f5e5781ea3edf51236f446cfe5e9

SHA1
61a1da03d3227b712701a64840c21f4ccdcfe371

SHA256
d33897e295d433d43f2558098f6326e056de6116013e4ffd24255e12e0f256b6

SHA512
4d1b4caba544f52235a194380b81bc2c49576317ad7e1f67adbeac3a037a00656966d60319c8f77059c45ef3c2b71021f893b0715f9b87917c7f46cbbfd3217b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585add.TMP

Filesize
371B

MD5
2166aca98b69937955e1ab1447fec249

SHA1
ab4d4e24eaa01b9e7427daff02aab03f8b7f9f43

SHA256
b94c31df9d070e998ba09967a32dc98d1c8f56073203b5479ec575408cc7b14c

SHA512
01642e209c8b7a4197acabf0447d3d667bfb57f3b74556a89526e1df058079c6f4e319632db35eb28f98530e0f7e7a347f7f7b6fb950b534cb16ed74765e1941

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dba1e960369a0ffbba12d0f7daefc5a1

SHA1
02121cf784ffe5a7edcbee5b144e6339aef99788

SHA256
e9da00704156bc18b5cda1ca235fbc503b5dd0d6304c4c36d2cb8c5b82671c38

SHA512
304a9cd1fe3f707502d253da766daf6b28a2105bbbe2b1253464f6888f30af63aef9dd777f76b841c533b1e429479f6297a298f18a99ce70a9b1acf4f6088761

Download Submit
C:\Users\Admin\Downloads\NotMyFault.zip

Filesize
1.4MB

MD5
3098d0f7a888949089cdfb9351904303

SHA1
ca50aef1aff4b17be449ec7276b01ba728ca7c6f

SHA256
e26db5a12a6e1f83085cc40446a0b8fb6e322b989c46f4cb649a955682c15de4

SHA512
2a0972c2d7854c6b84a1f68dc437f99b7cbb4cd03a46f275c30d5f0c80f6140bceb33cdc29e7ec96e4ff76796e388090b46112e709e6736bb0fe388c64dacff2

Download Submit
C:\Windows\System32\drivers\myfault.sys

Filesize
21KB

MD5
d5adea32410f975ea943521da0f7f31f

SHA1
835896d28dbe897fe11c8605f59588741389c152

SHA256
49c93b06246d47522e1a9cb9b1f5e0513db736bc466983eebfbf4445479d9419

SHA512
5f4814e3de3cfecaf3f4b2a9daea783e8d61a516b2ef3298205fca050a4674bdc5f38c2823b33e8aee24346efcd56a75a92409be9ee2414cc2b178b95322743a

Download Submit