hxxp://img9[.]dmty[.]pl/

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-04-2024 06:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://img9.dmty.pl/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
860	msedge.exe
860	msedge.exe
1048	msedge.exe
1048	msedge.exe
4320	identity_helper.exe
4320	identity_helper.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1048 wrote to memory of 1896	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 1896	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 3052	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 860	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 860	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 4960	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 4960	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 4960	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 4960	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 4960	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 4960	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 4960	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 4960	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 4960	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 4960	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 4960	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 4960	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 4960	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 4960	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 4960	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 4960	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 4960	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 4960	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 4960	1048	msedge.exe	msedge.exe
PID 1048 wrote to memory of 4960	1048	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://img9.dmty.pl/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9af7f46f8,0x7ff9af7f4708,0x7ff9af7f4718
2⤵
PID:1896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,4329868137352866931,3526165221585939955,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
2⤵
PID:3052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,4329868137352866931,3526165221585939955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,4329868137352866931,3526165221585939955,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
2⤵
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4329868137352866931,3526165221585939955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:1
2⤵
PID:2120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4329868137352866931,3526165221585939955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
2⤵
PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4329868137352866931,3526165221585939955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
2⤵
PID:2116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,4329868137352866931,3526165221585939955,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3432 /prefetch:8
2⤵
PID:4700

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,4329868137352866931,3526165221585939955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
2⤵
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,4329868137352866931,3526165221585939955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4329868137352866931,3526165221585939955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
2⤵
PID:3040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4329868137352866931,3526165221585939955,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
2⤵
PID:1968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4329868137352866931,3526165221585939955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
2⤵
PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4329868137352866931,3526165221585939955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
2⤵
PID:1040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4329868137352866931,3526165221585939955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
2⤵
PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4329868137352866931,3526165221585939955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
2⤵
PID:2116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4329868137352866931,3526165221585939955,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
2⤵
PID:4232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4329868137352866931,3526165221585939955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
2⤵
PID:5512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,4329868137352866931,3526165221585939955,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3696

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x534 0x53c
1⤵
PID:3984

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
576B

MD5
f90ce7ecbe4502ac59db3922a6dc52aa

SHA1
c2abeb281f2ca1a7e13119cf68969095fc71f8e3

SHA256
7f9bc0dd1688e16f3551df58e1a44fe67c7f8b857a10f42e987525c5cb5d4a19

SHA512
9daaf8b984d22668ad2dc1c2fc18526295ee799f22ec4bc7a5e2e2012d3142c0baba22c62a89c28ee162a2ccb90820cbf6bc33382676886e4a2a8a16dbbab8fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
a56d647952587079dd3a872bdff849b1

SHA1
055ff51c84853d7ae3994c307bed71d6f098dc15

SHA256
40949a7bfb30fa4111ad4114d2f5a56cced23e8d36130e106d5c95697ac70df5

SHA512
a4c6dee08d1104959b8b4eb79cf4020a675a86fcbfb99bb9b5507b076a7ff76a194e7e282fa6f746d31abac26b59172333d1085e39842631c0b063a78fb543f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
5b5e91636693eafb9a752cf64ed9eb68

SHA1
0c687a48d6eef67b7a8232c9c5534bf084fb7855

SHA256
10f11608d9e206d12f2034afd7f4350f7969c9be49b382a73658b735e52cb8b2

SHA512
46e468bf58824be868366835f8c11744e7e7ae50846daf4b4169198470bf8b9e8d15c7cd3cf5d141dfbddf61da0053c7d4eb88a16b9837151f52686c3d1868c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
e14f03e1b425045ec25fba498dd98bb4

SHA1
98d8e84cb18e24bc6473579b3af2864712e3f640

SHA256
0c899c2e6d0dc005bc27435ffb8d64621374ee77bef2bd427d3778e60bdc85ee

SHA512
fb59eaa0ae3b88e9dfcc9a7d8a31fb9e9d451b3ba1392d338f4c5b8dbdcc4441d1c903116a7eb723c017d0c17a896d031351a249b275f2c436252e605338b1bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
7a41d62cb32c20e6d85f781712889e84

SHA1
44e05ab45c6dbc4dbf20d448a5a58114acbf829a

SHA256
a38ecef1d09753884064f4de93540e99ff23ae5e0bbab87061852a7a430785be

SHA512
478a60eaee21197102318df8ba5221348b0d204d9d0614e7faef99779d72dd9f1d2a847cd34400744fd339defd51efd5d9ee008a6986358bd505e61ef9507773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
cf52065ee3189e543fbaf04e1420c378

SHA1
39d54bfd9ea3a51505868873fdcfafa886d88471

SHA256
8039392691ec290208b5eb7cccdd2a40575116f21233d1378f408bc6b29e9ec6

SHA512
fcfb11f2348e05d33bf6c7325e66aec6ece26c9631876e5bb2366acbed17180acb76e529cfef0a09c4b6d1646ef7e0850833c14f2e2678df272db4eefabc721d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
86d654698b7f22a802b4f9753d92d046

SHA1
5cbd625f28259acc84834971f1bb5bb39525b13e

SHA256
42baf27bb2c6d235d7e80e70e90a26c1289b6b5211e2c26fdffa77556ad356fe

SHA512
dfb7e11d2e0fe4c56af36f50da219f2e152f94d4725b38ecf5051d23ef59d1863867a1a386f8a4995be04799d002315681d666802c986798179d3e574f1ebfc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
c467e3c225dbd80006cfd007766f167a

SHA1
c91d136ece452581798785bb357bc06da3527259

SHA256
701a0af6d51d5b9d4e3c8bd556e25c0747c079fac867ca0ae5713b5857b8ee57

SHA512
7b932d8d0cfdc6ebe856daaa0c9ef668ba58efcd1accdb95cf25cbb8b1f0ad9f35caf49cc19ae315af5f7d34bbe55d38560b8c3b544e6c43d81264709241da4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
e19c209b52ead2bb313ff2eb8e22bdc8

SHA1
35db4e18178a5cfcc3802f8a04623ca9c313e8b4

SHA256
87c972912e8c54a90428918ef48f4434071259eb0c8502b5671006628c1c6109

SHA512
ad5186b3414632066a90fcb3849f815d8e82639bdfb029038c61ffc511b7222b8009602ac504594feb4269bbde61521f0ab42c2d769cee95352f7cb6d2c36580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
72c293dba9d901d2fed1d76324fcb729

SHA1
c9a343998bef89c36d703f6b565bbc4c7071569e

SHA256
a509aef2c8cccca527a5cab92bcf3419abc603bda703c90c0b767cafb317d145

SHA512
d4f20891665306d2bebab9752a4ceeea91f9f71b78805039138d7e071e7e97dbda77e59540b2fd72d775be485334946c22e37e3af391f5a6ed90411c02b61b19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
4cab3cb77e6751b430b320c15e43aa22

SHA1
265402c52be62678ccc70b77c9d7f2a7f9f4d85e

SHA256
1cfd40f629babbf38babf4a726f46d9ad4b4d362b8be2ddb348147926a8c01ca

SHA512
42d7e93b135dec5043d8c9ee67a3d1ccc9c198e7b5758fb022bb8db4dc63ff8ae6326c948b3b58b63bf207db72d095db345d5e85bd504d316d550cfe2b9c381d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
8bc2d30274118908f629a9437f3f5084

SHA1
2cbbd551facadcf14e84cc2b4a08d6f3b083393c

SHA256
306c61dbafcafa227dc7b38e29a09cd87aaa0d24692a16844fc4c7a3b4a6c868

SHA512
c9193152ad1d53d92c0b2675d331cc814bb3f3fef22668e19d722cf6f39079b0ee144658595465d7ce7917482581d3272b355939b8046d355f10ee253820d7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
63b31eebd3d13c192fa28ec24cd087b4

SHA1
7afa22b88b87526008a32cb3e506233bc804c672

SHA256
6216195b3e771cda6f37047f133b9460f26a7391af886c861b561850774efd80

SHA512
b79211b6580dbe7019abf1a3def778b6fda67a35632ee2cf193893f4adf0f71ea3a901eff4ab45471742e0e3c56a6484c900de022de28f96e56458c04b72232d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
a161caf1b74983a1579d076c6a860252

SHA1
82beef67db29ed74eaf189536731e63bd7a5bc7c

SHA256
38a75c50400d1af6e77aa8571ef186724af2d9a04b4107a798f4fdc408f2a550

SHA512
a1115f10f812905731e84475723898f73aae054148681c60848b4e06d71e83f4393aa1df13dc0758c4836501ea14afefa795412b0590ca1c85427b0c6849f725

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
73b2d363ab0583b0b1646b5031cf2850

SHA1
9ce60d60ff817b1ad5af1418021a432c35ca0fe9

SHA256
27570017b120389601ea9f964d1192494b53910b2de442488a533958f923825a

SHA512
77834c6a188a35a768795e5a0d07a03ddd9a2af492eadb1770dcf78b65964e81d9baffdb230b9b9bcab5860f358518764be183c407ebf7199da3ebe8d688ae6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
370803ad8e9be04d5d01ed698535dcb5

SHA1
6b72725c6d4d5cdb2e191fe0789c5b8a57d293e2

SHA256
21c54e481b85ed49a0492fab847fead45989f6592b9b95cbcf9eb9b6f6793331

SHA512
99cd4f7d1484139e82d59c809f5f761506211830493929a18bc43d738738d46405997ce98fafba3ff84b13036ee29e02fbb46466fa1395e7175c8adcfbd0ef7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d021.TMP
Filesize
2KB

MD5
0ec415c61ff67695a2d38f76eab81979

SHA1
10adf9faf9d345484e8b369a0f5395da137296d1

SHA256
5e63789fcbbc03192b676940dda6c3ddafdd9b90de84e4e7f14c446c906c7a24

SHA512
0d541d48269275b2f8b42cae7f0e2ee346f83db83a4ea979606564e8f389c03e813c1329d9eb4edea593792d88a52b8803218baacede91ada0110fec54ef65cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
a9fdf904a6d50f6c58dc3cd8567eda35

SHA1
17bc4344c6e2485eef14b5fba59218004dd204b3

SHA256
3f442ffb168b8180537ed750d1020950dd8849a0c14d79d2f9c9fedc0096880e

SHA512
ec639118799d457492eb2021a4245b281974007b351cf6c22f921a7b3e6ea1c8515cde72ce2bb7955716bfdde5f0f799d6b2443f8a6c8cafaf9f6b09ca476676

Download Submit
\??\pipe\LOCAL\crashpad_1048_XIMIXTEOJRSYRERJ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit