ffe8bf6840a91a56b3dcf6ec75baae7ce7e89f8a3f99eb0e93081471addfc073

Analysis

max time kernel
157s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 16:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e223283e56986a7808d294ec01f66a50.html
Size

44KB
MD5

e223283e56986a7808d294ec01f66a50
SHA1

6296d9b2fb1afe9c56fef0748a3351597bfd6e54
SHA256

ffe8bf6840a91a56b3dcf6ec75baae7ce7e89f8a3f99eb0e93081471addfc073
SHA512

a9a72dd9678caf0ea61a53109590053d996b1025876720832d5f70a616dc737ffd7771eedd6ceffc6d6144bedf7462ea3d131f1879ac89ed84663a78d12c9c82
SSDEEP

768:A6521HuIO+25DA6xqEpiGlS3UT5E3O3qsRSyFlq4dfC3RscTCCgsRFi3JGOrkk8P:A6Q1HuIk5DpxqEpiGlS3UT5E3WqsRSyI

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
972	msedge.exe
972	msedge.exe
2144	identity_helper.exe
2144	identity_helper.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 4956	972	msedge.exe	87
PID 972 wrote to memory of 4956	972	msedge.exe	87
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 4044	972	msedge.exe	88
PID 972 wrote to memory of 1056	972	msedge.exe	89
PID 972 wrote to memory of 1056	972	msedge.exe	89
PID 972 wrote to memory of 4828	972	msedge.exe	90
PID 972 wrote to memory of 4828	972	msedge.exe	90
PID 972 wrote to memory of 4828	972	msedge.exe	90
PID 972 wrote to memory of 4828	972	msedge.exe	90
PID 972 wrote to memory of 4828	972	msedge.exe	90
PID 972 wrote to memory of 4828	972	msedge.exe	90
PID 972 wrote to memory of 4828	972	msedge.exe	90
PID 972 wrote to memory of 4828	972	msedge.exe	90
PID 972 wrote to memory of 4828	972	msedge.exe	90
PID 972 wrote to memory of 4828	972	msedge.exe	90
PID 972 wrote to memory of 4828	972	msedge.exe	90
PID 972 wrote to memory of 4828	972	msedge.exe	90
PID 972 wrote to memory of 4828	972	msedge.exe	90
PID 972 wrote to memory of 4828	972	msedge.exe	90
PID 972 wrote to memory of 4828	972	msedge.exe	90
PID 972 wrote to memory of 4828	972	msedge.exe	90
PID 972 wrote to memory of 4828	972	msedge.exe	90
PID 972 wrote to memory of 4828	972	msedge.exe	90
PID 972 wrote to memory of 4828	972	msedge.exe	90
PID 972 wrote to memory of 4828	972	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e223283e56986a7808d294ec01f66a50.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcae4546f8,0x7ffcae454708,0x7ffcae454718
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5115006916620442712,2097920575048877853,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,5115006916620442712,2097920575048877853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,5115006916620442712,2097920575048877853,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5115006916620442712,2097920575048877853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5115006916620442712,2097920575048877853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5115006916620442712,2097920575048877853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5115006916620442712,2097920575048877853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5115006916620442712,2097920575048877853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5115006916620442712,2097920575048877853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,5115006916620442712,2097920575048877853,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5115006916620442712,2097920575048877853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5115006916620442712,2097920575048877853,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5115006916620442712,2097920575048877853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5115006916620442712,2097920575048877853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5115006916620442712,2097920575048877853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5115006916620442712,2097920575048877853,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5115006916620442712,2097920575048877853,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2476

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x318 0x2c8
1⤵
PID:5272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
d0dae7175236cac570f84a6b5947ebf5

SHA1
198851e4fa0f423614ce51785424949f73e1694a

SHA256
c681831d02dccc6d17191adce0dd52353f410cd0a97b31ca754a99495e833f05

SHA512
51907003666445ca6d77067ed9ee21604cfa83b9d304df83690d7ef70557d68042c84a2510b006284c51a2aabb2e6ea52661ae52deab96881c55a5a0a6707e5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
6da283fe32cf94bcc2e5e59989b6625f

SHA1
4c91f7afa098d47de2f926c7c5d658e4e3a1fa1b

SHA256
4cddb2fcbe53c6fa08c59bef08aac8e252a42878eed35ed113eea7032623c069

SHA512
78ee83ef04bafb340f226a3fc4bd21cfcb34b6b427b2d3c9678d2e609e6810540a606ba96445675090af6541829ebba62e17dd694ceb01f9a1545616001691be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
92541ea4b1c068b1833bb9fd0dd7b5ac

SHA1
a7f6b9dc00550d1a0bc0e3f26204abb560b7bd7c

SHA256
4435a93380aa020d02da76a99040bab8af7090b566bcff1c734bd9bfbcc63f48

SHA512
c443e4c0e66710708940b47f43f7fb767663b9e86e817f1a393d643ea0a3bcc5666a7d6f3e9bfce25ad205de8e63f8dafbebfeed9b41f854d2266a20b2afe7e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b68076e297b1b22d52dc4b7aaedbf33d

SHA1
e837a18b2ac93fab9cfcd76ab2c6068d4311a737

SHA256
3b3411417de29e470078fca98cdcabcf0c829d3ef0ce968c97113e9ca9aaf9b7

SHA512
ae332935146c19fc7768edcdd9159aec043a0e3934c52a4aee1e1fc11c85b5fce624e76c49397901a405b2cc63873a4345fb8c21abdfa9467bb7cdd86b044cbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea0bfaad535c3f9bdcd740920f865c05

SHA1
a026c6af28cc85accc344bbcbfabeccf6b5e94b3

SHA256
17e53c8b7917f871074d643810932b11afdaaf43559a0fc1ad7f3e85d9a9cf55

SHA512
ba0b694a63cbf55261aa7ed418bf4fb7d512b0bbf4dc02f1e189f4a2132367e9444b435fb341b6e5b8af6d157a838af6ead9a8411100bfd068eaeaf85e350b4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dd31fe002f854e05992e4cad07560713

SHA1
4260c75d8e77b8a850d0c6b588fb56cfe1986791

SHA256
53f269e2f15f43aa25110c53a7560e6f1b6dba51e09a5f12c6d88cbc9a5a4687

SHA512
8e37615ae233760812792a3918dae332573117338b424ccd6e3a62a018caa8e62a6cd0af8c141cd5fe16fad0c5b5189d9cfe6c2c257321682f3866dabcf9408a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
cd610a7a3d32b2f604f5ed921b76dd93

SHA1
b1cdba9ee13d7e1f6f2e2db357280ab4d94a6a2a

SHA256
539f33c70bd69f088a72e4a14ad9fd5fccbe953a150171e18c8379bd3809c489

SHA512
5f786ccc19ad78e3184d4b4401e6813b5fefa50ad2ec110825a170d18536b7e3c94e27df29ae4e498ecd7d3e47087adc645622556de134d3cbb6bc9d56e1ab26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
54bed9f6956e60e8ffc072f6aec9c513

SHA1
5d1c4d2ed8d27da06b37b9108e0a9a282c94340a

SHA256
79d87e2cc403088dafdf615c518d28d96482511978d24bd6a425332fa65123e8

SHA512
14340c27a229b41ed1cd2b2a725d425e19912aec86675b980c45a366caf96d2ec6b16d3b5a656846d82c1bfb90f0c336577bfe7cb064b374a898d4fdc962ceb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
28963bdce77eb223d2a9963dbc29b7b2

SHA1
985c2af4f4207711f92f35bd4481c4045a9929a6

SHA256
592d14911c65bb9f8d9cacfb4ed3b72982e2d19cfb5158e136fed23f44ee38ad

SHA512
823b016f6685f0a8e16018fa05b41e98fb179802056538c8151c9341e63e33f4fba54d90f2886560a0d300b0e7fe6095d2a40d7d061f5bf1b28a51b14430f1ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
3782611c3fae39fdca81725b024aa4aa

SHA1
372790c956607d8e9a9e2ef6eab61a7b7a502bcf

SHA256
69b1a67a47fc37ea6c279073d614c8bf387aaf9b46ebe614963f321bbe93810b

SHA512
e9f07c4373270dea5494da8706281054d30b1af18178dd49d688b0d2f9f452b2d5753aa50fd2fca6c3135b8f9df0c1e99a6ec946d6934a458c82d4c2e6973c11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
2c07b126e0b078c9b81f8e65ab625da2

SHA1
8ced480b6e694a954dbe03b3c4a4b233197a3301

SHA256
d56b6285d29e3997817e0adc3e56643cd9f76b3ae4b34542ab0937574ab15f09

SHA512
2e5675c1e87e60b67e4ed78a06a5ae5adbc405f20a41f5fd9c9eb40932591d9c08bc620a1421777f276803c359425e3c388ea560262f38c2d2516bb306b8e2ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58291e.TMP

Filesize
707B

MD5
880351f79b532314edff76f37d6776af

SHA1
604c2e39bb4ac86a35a407eea068f44761a0eed8

SHA256
e06217eabc6c2df14a385f8e9d9a999a9b4626f0b53191c8c463cc374ee735dd

SHA512
60b93801f7fa04e47ea940ac95ba00537ccbfca4a5d31e59dd2a4a7cae94426a4b7b491747619bd69b155b81aac59779420da25064daff8fc0d3f9c5a8cd909d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8f29cda79b4cdb973768016fa5ae774e

SHA1
643080671327e0b66e96257b1f06da09d3cd7edb

SHA256
3df9453f17efe3168b7f7484d5cccd1cbd79515d702576e5f283b5e9ffdb9425

SHA512
3ba59309e2a5b56c929323e6331d55d2cbf242e3a75503392a0dcf565a3531628e60b0941e4f871a2b32ac4dcf315f6dad57f8d18857258c6084587c90193eb6

Download Submit
\??\pipe\LOCAL\crashpad_972_CSVIWHVJILFMASSF

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit