hxxps://go-link[.]ru/P2YXa

Analysis

max time kernel
1685s
max time network
1693s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
21-02-2024 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://go-link.ru/P2YXa

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2528	msedge.exe
2528	msedge.exe
1044	msedge.exe
1044	msedge.exe
2684	identity_helper.exe
2684	identity_helper.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

1044 msedge.exe
1044 msedge.exe
1044 msedge.exe
1044 msedge.exe
1044 msedge.exe
1044 msedge.exe
1044 msedge.exe

Suspicious use of FindShellTrayWindow 37 IoCs

Processes:

msedge.exenotepad.exe

pid	process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
3992	notepad.exe
3992	notepad.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

msedge.exe

pid	process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1044 wrote to memory of 4388	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4388	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 4676	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 2528	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 2528	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 1104	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 1104	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 1104	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 1104	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 1104	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 1104	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 1104	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 1104	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 1104	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 1104	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 1104	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 1104	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 1104	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 1104	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 1104	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 1104	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 1104	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 1104	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 1104	1044	msedge.exe	msedge.exe
PID 1044 wrote to memory of 1104	1044	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-link.ru/P2YXa
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd21746f8,0x7ffdd2174708,0x7ffdd2174718
2⤵
PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6854351148516441260,13983664636685785817,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
2⤵
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,6854351148516441260,13983664636685785817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,6854351148516441260,13983664636685785817,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
2⤵
PID:1104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6854351148516441260,13983664636685785817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
2⤵
PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6854351148516441260,13983664636685785817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
2⤵
PID:2512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6854351148516441260,13983664636685785817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
2⤵
PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,6854351148516441260,13983664636685785817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4196 /prefetch:8
2⤵
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,6854351148516441260,13983664636685785817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4196 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6854351148516441260,13983664636685785817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
2⤵
PID:680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6854351148516441260,13983664636685785817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
2⤵
PID:3012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6854351148516441260,13983664636685785817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
2⤵
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6854351148516441260,13983664636685785817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
2⤵
PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,6854351148516441260,13983664636685785817,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5728 /prefetch:8
2⤵
PID:4000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,6854351148516441260,13983664636685785817,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5172 /prefetch:8
2⤵
PID:3372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,6854351148516441260,13983664636685785817,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1256 /prefetch:8
2⤵
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6854351148516441260,13983664636685785817,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4764 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3952

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:3992

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
360dd5debf8bf7b89c4d88d29e38446c

SHA1
65afff8c78aeb12c577a523cb77cd58d401b0f82

SHA256
3d9debe659077c04b288107244a22f1b315bcf7495bee75151a9077e71b41eef

SHA512
0ee5b81f0acc82befa24a4438f2ca417ae6fac43fa8c7f264b83b4c792b1bb8d4cecb94c6cbd6facc120dc10d7e4d67e014cdb6b4db83b1a1b60144bb78f7542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
6fbbaffc5a50295d007ab405b0885ab5

SHA1
518e87df81db1dded184c3e4e3f129cca15baba1

SHA256
b9cde79357b550b171f70630fa94754ca2dcd6228b94f311aefe2a7f1ccfc7b6

SHA512
011c69bf56eb40e7ac5d201c1a0542878d9b32495e94d28c2f3b480772aa541bfd492a9959957d71e66f27b3e8b1a3c13b91f4a21756a9b8263281fd509c007b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
456B

MD5
15a395840fd6066bfd5c6fb76020fe0a

SHA1
c19d956f87123222a32d5b858d8fe08b90687a99

SHA256
b4e826334e8b36bbae54f5305a1fe1bf25d2cbfc88db78becc5c4c6f188b0033

SHA512
22c9be6c25328827d8913832b95b610b46e3a0ebb0289e5a59b14f90d1fd55f297960fff0c0034ec70aa25648ae816d0c12fd69afd5d36662e400b76bb47559a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
432B

MD5
d1b9e9ed18c9bc80c0c359d244a09873

SHA1
721e1efd54ea988d3b7067e5591c258f39ab5e1a

SHA256
d33597537e14fc5e2bfe571e071b9846d538a70c9fdb9d44a67f6ff76f0b704b

SHA512
99aa8cd7998111fea5472ce84539bc5cb91689ac09e78bed31e7471def9066c3346144c00ed30cc9af6fe7528bb2233804465201147ec0e138a11da43635e210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
857B

MD5
8d9ddb2e8c70646134e7184175420703

SHA1
fd86bb0451ececff478cf653ac7c6ee0c9f97216

SHA256
4130226554d0f554abc03dce1957344bd63e464319a8af3c8eb7d65993fc710b

SHA512
9d02df9c8f5164476fe0bb1314f1e36644840ad4a9cb03df972cf8f0284cf0c35d74c62455ef4f0621b2ba55f1e2188d6bf3a5945122a33841f8e2af418a96b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
857B

MD5
a23164f719b2d1f16fafdfc305aa7061

SHA1
68b94bea89416c06de6d32ed110cc88e0e6e84b3

SHA256
831538665ff7e164aed987906c7f3374605d9050568058c761e1ddd2459ec321

SHA512
e194564cc7556f34cc204d0d0187b9b2e98071445679bc5a52706d99894c52cc3953ffca9e3378d79361182a2a6167f351e2cf9ea4d0331fc6de8f27e542344a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
dc277421e9e40eef1f9d634bebfda42c

SHA1
121d7c44091306a51a7a385f9c153f26e7b24694

SHA256
eaa7d2b045a22f9fef474661cc8db94075229b91e0273b088f4238cb7edcbeea

SHA512
0a65985a989f7fb4511bcf327fd93bce2189e1ce729da64a36b89df83cc554958c1e4eb8a9d4b81b9472217e384887bdff0843aa7784ae104202cf19d9c0a352

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
5501e433c790055f9f9e0b72c0c38a20

SHA1
6cf8c0b2c2e7c9617d856652deaabfe9bfea7b1f

SHA256
9722c5d764f2a1872de5e968fac5d4251629ffeb99dc4fa96fdd695f2651f950

SHA512
1fea52a2112d3b0d907d0a48377ed6e38431340c122ffa9e0827b2af32ae1da234f60d53a976830a9b21d12b148549c452fdf5ee1da39bc7afeb5e7bf81edaa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
4ff9c60662c47ef1ab038a292f9c65ce

SHA1
fbc163812e14aed997445f39eadfdb9e1865acc9

SHA256
b440923c2840f155f20cb189a0ecdb3498dd9d2100a561d89d964d25e616fbf2

SHA512
3ccf52472e14544c79e44469cf0882f6f4f32d8ca6226aaf7dd972f5b5d830b2b164a4af315ba87c1506f665f95b51220bbf7ed4d004e94f13916f0bb4bf834f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
e07ec2fd29f4da56d210926790bfe43a

SHA1
52854adf23c39ed12d291be2405f618d71baf224

SHA256
6677c93099a3fe986152e14306b1776721985345c75003739967af39c82a3955

SHA512
572f8a1f019ceb2e538447de7380c0861ad1112bbf73adbc06dca3ab82ba61608f9007d122982f78768e89b8b0152b1c87ccaf390acbd95d8f58f3b6dfceeca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
01956718c5c271e35a72ba26ee83c843

SHA1
5dd90c1b40b4533c04d8c09a3d70e778b440dbd0

SHA256
4f0c24b65a49fae40ba290503524351ecf197c6166743f1a15a504ac8ae1715c

SHA512
fc3868ac51a28cf48608daa58b030ac5226fa3e0053f43eb08ba44f9c2e5273fbb7fa3b5e2d31febaa6b4a4d44815224ed72fa8503c54021c7c4be17bb015a5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
dd08f79c109164a2b43a5497b16b40a2

SHA1
a9df9e88ed0a12b5b59ae471c0f5a49eb21f78fa

SHA256
2ffbcb020418f0a33088a872c557ebe2179b969fd65c6f86f19abb757fe44bed

SHA512
971452fd54e1a4f8dcd5d0b4b5d9379a4d2a50989d7c42ba21268370e50b097b82ca4a44357ed9ced4140937d574215f2bc717ab429a5f240cbdf9cb7e43cdf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
c91e979ead15993eea103fd5bef6c16a

SHA1
80ae365a934223f07f16d194301c99832def08fc

SHA256
92085d09082124cf4efc8cb00349dc6b4d271130aef3924bb902c2bdacce31e1

SHA512
4c4601a902a70b708365b252e3143844d952267b76e8e7a3f609c4c2967bf0e9c25761c6567a0c65930b62dab2a90c3d7e9a68760d1668e8210c4565d25f23ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
dc980768ffbefa55f8db979362377b13

SHA1
4da18fa77fcdc075ebd8e1524adef1bdf63d30c6

SHA256
b0e8fe4b1c259afb6ad004bff6fd3dc97cec14a2dfcbf3f624d2c36087c353d7

SHA512
8ee96561eda5be0d689528e276770af8c2cce22f7d18740b9c8946ef2e189b45580acce2c94563c0ff7bfa4fdafef9c2412c9d21ad20ec52f19087337e3bcb63

Download Submit
\??\pipe\LOCAL\crashpad_1044_QEEEEMHXPYGXFYTX
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit