hxxps://envs[.]sh/QOG

Analysis

max time kernel
240s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
11-02-2024 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://envs.sh/QOG

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1296	msedge.exe
1296	msedge.exe
4660	msedge.exe
4660	msedge.exe
2908	identity_helper.exe
2908	identity_helper.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

1296 msedge.exe
1296 msedge.exe
1296 msedge.exe
1296 msedge.exe
1296 msedge.exe
1296 msedge.exe
1296 msedge.exe
1296 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1296 wrote to memory of 3976	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 3976	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4880	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4660	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4660	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4764	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4764	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4764	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4764	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4764	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4764	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4764	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4764	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4764	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4764	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4764	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4764	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4764	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4764	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4764	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4764	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4764	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4764	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4764	1296	msedge.exe	msedge.exe
PID 1296 wrote to memory of 4764	1296	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://envs.sh/QOG
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8355a46f8,0x7ff8355a4708,0x7ff8355a4718
2⤵
PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,8849473687663869898,3738451133087652292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
2⤵
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,8849473687663869898,3738451133087652292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,8849473687663869898,3738451133087652292,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
2⤵
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8849473687663869898,3738451133087652292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2928 /prefetch:1
2⤵
PID:2776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8849473687663869898,3738451133087652292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2936 /prefetch:1
2⤵
PID:1532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8849473687663869898,3738451133087652292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
2⤵
PID:1660

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,8849473687663869898,3738451133087652292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
2⤵
PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,8849473687663869898,3738451133087652292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8849473687663869898,3738451133087652292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
2⤵
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8849473687663869898,3738451133087652292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
2⤵
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8849473687663869898,3738451133087652292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
2⤵
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8849473687663869898,3738451133087652292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
2⤵
PID:548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8849473687663869898,3738451133087652292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
2⤵
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,8849473687663869898,3738451133087652292,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1972 /prefetch:8
2⤵
PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,8849473687663869898,3738451133087652292,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e71d66ce903fcba6050e4b99b624fa7

SHA1
139d274762405b422eab698da8cc85f405922de5

SHA256
53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3

SHA512
17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
e9b21dfa9defae4a33b41d400b307d13

SHA1
81b75e978880442d418d13f91074ea7b28a1600c

SHA256
8ba1fbe574dc0501fbbe4699877ba7ff447d6c9f71e692d9e59cb349bc1e60b9

SHA512
79149e8a7a0291bb6cec58ed6421df716df27f1d3935878b558d44d9f41c6ec96b07f2468561f1a627131cf742e4f4ea5c0b48da8eda610f9d9272fb0dff7b3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
9c48465d79d15e717da9974cc6597215

SHA1
94e4d77c4762344fc0fa796d869a77450f913541

SHA256
6248f402b4e24cfb12f00d0f17ba8cf5b93cf2eff923ddb7581b5884182f2498

SHA512
7d6fba631d3ea4dd0516e40d5b2597d296bd4164698e7f17f3180b35460d47396a67f694efc3c20c8ddc4ec716c490123c73581edbda4f68cacd26ce0438b824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
e19ee3a3dfe948b1bfa26f2462bc894f

SHA1
d23118330263ec786e54b0b980f5d9b9810f98c6

SHA256
69dca75e73eacc860c0c0419151a634a89d1bef01bdff044ff4f482795e6b2fc

SHA512
3c0b33ff5caa8adfa9e0d89f423f28d668a300411053b7523236910f94182bd748659c0d06bab7512a5f9c9f3627a01714a96884c5932f47c88ed63c2de813ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a9e01dce5b9d83a9e4c615e0e08ff9ad

SHA1
1e648ac942c1128daa96864190e28a5eb41d1d0a

SHA256
72ce0961ccd6b0bcf8f1956eb5b8a82855564caf5e77de92ba426a4f8c854338

SHA512
e6af0f2d6b4df1c5e7aeec029ac5f9b369b5d7012e74c6eda1da0d621a4af145beb8188757f736b6bce110678c12bd6d9be32c8f64c23d276d5f80d34d6e7c94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
dffa1991560df41956efeb6f076acdf4

SHA1
efeab57087c355d95e86d4dc6e6c110b9b3b8b7c

SHA256
3bb1274b8080686b728f3f71a791e1614e2366f776a8b5efe742fe4b84aa56ea

SHA512
a074406126b9327d32c0873a91a37a82cdde89d405e3625de54a356f8c966274076e475a181409f144ed1ace05b1f1037969dc361daa2c1b5019da17a50c98cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8eee31d8326b9e92823addcfe60b2cd3

SHA1
dbf1fe63c7780efc82061b75ceaaaa230ce369de

SHA256
35a3e2d6730e8d696bac71e648a5c0464bcdce2051fbfa63c79a3a938574cbd7

SHA512
97c164770a326cb45fc1b09e6885d287bb680e8474c3107f90f47b7e44fb9cb7ffa8a2ab36539beecdf21673087399ed7df96b13fc01adb1cd7f380d60ee212b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ccbc3b2aef912c8066427a981eaa49f2

SHA1
748e331917726b205a0e116e57b23929e9e84d1a

SHA256
ea8567defe246e5a564ae5b899c042b4e0f457081fddea4c8dfbfaff7c5de0f6

SHA512
0944fa9c13107c9b0e5075bf6f6106c6258645ac257b10dc7503c0828c9937c6da360c735fceb74bb997925e6dfa2901b2baead209735b97e4ca428e3d41d718

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
269402fd8b9dd30ee4fc67ff48c4abf4

SHA1
77be870ddbe0761552614c1e49a0548b7554b7eb

SHA256
380b8a40b9acee1f7db9fef1b1a836c67c52d8e8a6216e47532c8144e1eb6843

SHA512
b7df03653ced8b009ef7e37aa583639592d7ca816d22f516f53b4403f2157710224f2f31b294b5dcfbf1bd157873a35f436ee0491be21370bcadb778ceb5ed9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fea214bd403c72753a46a7406769d6d9

SHA1
cba0e08729f6b79d71e5c196ec6be9ac703c96d0

SHA256
7630ed7f70a6760eb32c7ff3676da5b12f5143d8b97d9b488a9c196f76c6dc5f

SHA512
acd756861dde6d9389c5f25136c9bef6b0bc282af1d803471e0f032334f13bb30017f5952407f0056af7ce8891376ee141cab7e8b39f099e9cff18a7a3924145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8a8dd3379b91579436d94e9f73fee95f

SHA1
3a3880451d2b4cd5a7948d6b99e0a1d68029f901

SHA256
17cd1c1238279923c3bba080119ed6e8fee57d8b80d13c2f3ce61f21759351e0

SHA512
e2b2d8eb9dcd8f6bad657f638f149751445f167dadf7caa6663a1d61c0996835ced075ccc9a0716aa9172a5dc62fdaf600f56a1f9ea5bed9dc8af74a120f434d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
235527e222873fb61d646ff9c94a58fa

SHA1
582d6471ed8caad9f8663586d37cf2db995276a1

SHA256
403e74354d7bc391c9e71c2b080b89e26e390511ecd05f742cad2336c1eccb8f

SHA512
656120cbdad633e50998c2229cd076be4c7ff48c930a6eaacc8b932389e997b904f0461f57c844b31781726d330a83c25a2f714cf0bb19bdb422999867f720fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1b1b142e24215f033793d1311e24f6e6

SHA1
74e23cffbf03f3f0c430e6f4481e740c55a48587

SHA256
3dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1

SHA512
a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d00f28bf7e8ede83598f161b820fe561

SHA1
f3cc73bbddd719d430931331d20c76d776a7ea17

SHA256
733dcae1b38d20d92dfc530c9cc9d8822b4e345f2b5d5186598b95dcf978eae5

SHA512
23b87b165b3645af76e2851c0028bc99212ab4c76d19efa352718a168a0677e85d296c057640a29de79a48a09c0e714bd74adf1ac969798d02a05998a770321e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3df3a029781c4a7abf119000c8b79ff0

SHA1
78f64a7827b71a3c855bd365a3dcf24492e5e34c

SHA256
eb8651ec625263dcdc30c5d2d396a64b2b2fbc1c284dd8c42d0328fa93f1ba53

SHA512
6e302d040798ce1474e6b28eacc7e00a05560602b421425890baf32ade2b6872b1ce434f08384fe7430f714e0d58ef21527f6cb7943b0325ad3d9ced5d570cf8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\LOCAL\crashpad_1296_ADHXOIUVBAUZFBJA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit