hxxps://t[.]co/1vjDtJZ75b

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.co/1vjDtJZ75b

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2800	msedge.exe
2800	msedge.exe
4736	msedge.exe
4736	msedge.exe
4452	identity_helper.exe
4452	identity_helper.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4736 msedge.exe
4736 msedge.exe
4736 msedge.exe
4736 msedge.exe
4736 msedge.exe
4736 msedge.exe
4736 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4736 wrote to memory of 1340	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 1340	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 3012	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 2800	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 2800	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 1308	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 1308	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 1308	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 1308	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 1308	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 1308	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 1308	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 1308	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 1308	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 1308	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 1308	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 1308	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 1308	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 1308	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 1308	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 1308	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 1308	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 1308	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 1308	4736	msedge.exe	msedge.exe
PID 4736 wrote to memory of 1308	4736	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.co/1vjDtJZ75b
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb23a846f8,0x7ffb23a84708,0x7ffb23a84718
2⤵
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,57110631769926691,17456404533372928028,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
2⤵
PID:3012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,57110631769926691,17456404533372928028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,57110631769926691,17456404533372928028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
2⤵
PID:1308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,57110631769926691,17456404533372928028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
2⤵
PID:3724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,57110631769926691,17456404533372928028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
2⤵
PID:2076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,57110631769926691,17456404533372928028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
2⤵
PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,57110631769926691,17456404533372928028,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3456 /prefetch:8
2⤵
PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,57110631769926691,17456404533372928028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
2⤵
PID:3648

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,57110631769926691,17456404533372928028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,57110631769926691,17456404533372928028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
2⤵
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,57110631769926691,17456404533372928028,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
2⤵
PID:3716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,57110631769926691,17456404533372928028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
2⤵
PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,57110631769926691,17456404533372928028,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
2⤵
PID:1988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,57110631769926691,17456404533372928028,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5284 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2664

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e4 0x4e8
1⤵
PID:1480

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011
Filesize
1024KB

MD5
c2b8a4396edc04973844c1a6e7073a65

SHA1
d773588c2ff75eda183fb51a60b048c6b5e1e9f8

SHA256
b3ccb1b37be27fe743bff3f402216e9b6807b4babf78754d192eb5f7d3796c8b

SHA512
c57ea7faf3606c67cf169beb77fee33d1ec0bf0070df64faccbe231eb2c5267dea85bd12ec2f261d0f61bdec6fdce60316b659c0d4ca6b71fdad233e8831f3e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
144B

MD5
b335e8b98ce82635de530f8fefc17f8c

SHA1
f9612986625e41eec04ccb9d7e488764523bd40d

SHA256
6a4901de0561fbc3dca11e0d82090cefd6bdb452c8bf0a171d2f3335d3167b6d

SHA512
30b5aca708968f1fd8380b7e23d812fe5401ef46177e958cda5d8aa0be4f4a33b385bf0ee9d43832f84d2a0bd69dbd8f4d62ced21092b17e257c379f02343605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
855B

MD5
0aba0d651d2d1e8143d849bc0c3dee49

SHA1
d76772066180d3297e1d301ddd11e33bb4a85542

SHA256
6681d0bde6c4e501dfe20ddc0dc74758bf5f6f0cf2c38d9602ec69c0d74d9543

SHA512
bdfd1500a881112885e1fddc6231078fdd704f656929243e8a580ba8db8495bfcbe5e9efd50fd98ce9d57d0e350effae1f62997d2ebbe66a30b5258bf1a5f930

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
6f74f3538f9f018d0ea5a67a8e062e28

SHA1
58bd10523b8514436e75298e27a646763a19f4be

SHA256
0bf7f2ef2fe66916f456b471ec98c65e9031eaf86b67eb2f7f70d27c5ba9cb98

SHA512
84f5bca3feed23c56f5724cd76d7aaba0f07ad05d7a3e585ea77a32d001df34f1e48e33d01ec464b9c0b3a623462bef67778af9d98dd30cafd71d3cf6062bd2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
542146633f4676c0f684c3ddc8ecc340

SHA1
0102ca0674fb93234bbbe6e538115ca067fabc2c

SHA256
d4c43e722fd20682dfbbeb01b73d33b0d534218ae5ad11217557d6bc18b1e666

SHA512
6f3fcfc78f5fac5503f74918ec53219bef9285deee525a1ac687e65c7b5c05bbd6ffe04a047f09c9ce3308ab1d5001013eb7e39c3972753909f69e7215604802

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
aa74d009c0f92f9f52caa430dad0789e

SHA1
014e88f85d2cc9ed67b322039708dfecb71a3028

SHA256
72d03a91b17a0ece4e10d6016578c474d5b3122f095e7ed85a7c8f46e49e2862

SHA512
fccb1966901185365732d82015007e4cb5f7ce9d04bb7f9bda8ead1ba3ca6dc65a8c4c82436f577274ddda4fc550e950948a3ba283f8dd04ebab0570396185ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
874B

MD5
337ef96cc881f8b599add5f780cec8d6

SHA1
745f2900159e7cb870fb0922073d8cf22be16133

SHA256
50906083b942d6ea6bd281fe543009c7a3cee95ae8de0215e6776450efb9b289

SHA512
c835eef4e076668b3ae6b0c18a851a8d647d9f6788eef8685a0f9da86ad5a8a81b5c7f0f9cfb43628a45e7b88f5beecf842cc2a9eff89c1bf0c30d3041a29c1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a72d.TMP
Filesize
707B

MD5
76dcd45bc3548918ab15bfafc4b8673d

SHA1
2777bb36dbdb45d13793870f2cbd1df8d5181457

SHA256
40cf5c837405f973122f71c96e9dc042e11aede8672f73121cc59963c41808b6

SHA512
8cef1f5fad0f326660df13e0cfb156d2c17475335daaca789610779b5913f19597e2c8baf4e8f215c2229a8c1d353187f4589929918d9716488152939036055b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
df5dd09714cc5dfef38390eed76aa5e0

SHA1
d4502ff79a8e378540ea716c2530afcfea8173e2

SHA256
724e9d8f3014548571690554950325e18fe8cb947620cec375f2427ac58fb37b

SHA512
5d10608e732a52e34adc4083515f88da41d0d2658796b845765ff919ac5be6eaf53a3adb060c5dcadd5775da0e872f52843bfb4a3dea4e1789db5ce78df8c087

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
883066b81614818cad17f73b1cc791f2

SHA1
c144e59f73c99a2a02459324d1d6e0029f9285f1

SHA256
fe2a337e65586d8f2f8b6f5b38b2c7c65796cf4b4c0ac1f613dde20f262653b5

SHA512
fef7a8338e8aa18d394f8b2c86190b380463b39e0d28886498ba0cbcc8fbb6d9cdb02f64a7104e71080e712aa99b5713d0d48f629c07031bf74204b0a40958c7

Download Submit
\??\pipe\LOCAL\crashpad_4736_MBNUFPNBWOCFOBUZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit