hxxps://app[.]donorview[.]com/Communication/Click?prm=uEvQjbLyROfQy1XICroxZgnn6zkK-jxszv3c-V7QVTzbyWCRnwEo72rfjdFLOn6LD-AbzGoObSWvJEDMZH3l_sAl_z1NUhFuXl1zt3juOmIcN_J3w3rrSbzKkTErDNu48wmAjuOwMWYFji5HSlNfrNvlQzfcdYndFW3XpMVPR1ahJlmQEYNAysRt4-YWnhMQPXKbA4Diq5MECXxH0hT8_be4LADzMz-s1ZJP8a9qn301&target=hxxps://cloudflare-ipfs[.]com/ipfs/QmP1syHrSAveCbPBWBwunVWiYgzCDE2YarT2CQe5SQ4TpP?filename=newnewnew[.]html#YXhlbC5nZWlqdGVuYmVla0BhZGFsbGlhbmNlLm5s

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://app.donorview.com/Communication/Click?prm=uEvQjbLyROfQy1XICroxZgnn6zkK-jxszv3c-V7QVTzbyWCRnwEo72rfjdFLOn6LD-AbzGoObSWvJEDMZH3l_sAl_z1NUhFuXl1zt3juOmIcN_J3w3rrSbzKkTErDNu48wmAjuOwMWYFji5HSlNfrNvlQzfcdYndFW3XpMVPR1ahJlmQEYNAysRt4-YWnhMQPXKbA4Diq5MECXxH0hT8_be4LADzMz-s1ZJP8a9qn301&target=https://cloudflare-ipfs.com/ipfs/QmP1syHrSAveCbPBWBwunVWiYgzCDE2YarT2CQe5SQ4TpP?filename=newnewnew.html#YXhlbC5nZWlqdGVuYmVla0BhZGFsbGlhbmNlLm5s

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

15 cloudflare-ipfs.com
16 cloudflare-ipfs.com

flow	ioc
15	cloudflare-ipfs.com
16	cloudflare-ipfs.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3700	msedge.exe
3700	msedge.exe
3344	msedge.exe
3344	msedge.exe
2508	identity_helper.exe
2508	identity_helper.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3344 msedge.exe
3344 msedge.exe
3344 msedge.exe
3344 msedge.exe
3344 msedge.exe
3344 msedge.exe
3344 msedge.exe
3344 msedge.exe
3344 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3344 wrote to memory of 532	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 532	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 4556	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3700	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 3700	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 1476	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 1476	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 1476	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 1476	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 1476	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 1476	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 1476	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 1476	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 1476	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 1476	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 1476	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 1476	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 1476	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 1476	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 1476	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 1476	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 1476	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 1476	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 1476	3344	msedge.exe	msedge.exe
PID 3344 wrote to memory of 1476	3344	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://app.donorview.com/Communication/Click?prm=uEvQjbLyROfQy1XICroxZgnn6zkK-jxszv3c-V7QVTzbyWCRnwEo72rfjdFLOn6LD-AbzGoObSWvJEDMZH3l_sAl_z1NUhFuXl1zt3juOmIcN_J3w3rrSbzKkTErDNu48wmAjuOwMWYFji5HSlNfrNvlQzfcdYndFW3XpMVPR1ahJlmQEYNAysRt4-YWnhMQPXKbA4Diq5MECXxH0hT8_be4LADzMz-s1ZJP8a9qn301&target=https://cloudflare-ipfs.com/ipfs/QmP1syHrSAveCbPBWBwunVWiYgzCDE2YarT2CQe5SQ4TpP?filename=newnewnew.html#YXhlbC5nZWlqdGVuYmVla0BhZGFsbGlhbmNlLm5s
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc31be46f8,0x7ffc31be4708,0x7ffc31be4718
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12638699891243043920,6284781426624867507,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,12638699891243043920,6284781426624867507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,12638699891243043920,6284781426624867507,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12638699891243043920,6284781426624867507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12638699891243043920,6284781426624867507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12638699891243043920,6284781426624867507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12638699891243043920,6284781426624867507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12638699891243043920,6284781426624867507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12638699891243043920,6284781426624867507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12638699891243043920,6284781426624867507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12638699891243043920,6284781426624867507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12638699891243043920,6284781426624867507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12638699891243043920,6284781426624867507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12638699891243043920,6284781426624867507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12638699891243043920,6284781426624867507,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e494d16e4b331d7fc483b3ae3b2e0973

SHA1
d13ca61b6404902b716f7b02f0070dec7f36edbf

SHA256
a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

SHA512
016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b2a274ba00b274cd9e79172ab86fd4e6

SHA1
4216dd1bee6fc803389596b3112826149a9d1ecf

SHA256
3b1c26b158018099951e4c9f752159f9fe02f555ab1e89df2b3af7365e91e3cb

SHA512
360f52827f186d568bdd42a024e82404acaab18f7d424c5853720148a899a9dbcb1bdcc6a44a2362267d969d477226cfe06bad0e1cd7f3a75acbdb12a18481ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
07e4c047192ad4dd2c0c328bb8734b6b

SHA1
6be1527b0d90a865d0f1626e883111d3b8bba7fc

SHA256
1a7f3888a994961539ac5d51f041a00c9e1ec472920579e8e62ed36730d154ab

SHA512
9aea4d119c8c301d8272fa0e5da63734e2f11a7e0245dbcce3101514658bd860c08463f0d70de49749c9a5c65ae36edc9a847ed8c1c0eb59ea0b4da335b3a67d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
22ca750279d17d2957d3f2d425b7687f

SHA1
2ca13586c76b95bb8d58ecf5617608c48312ece1

SHA256
89f1f8cbba1e76db00edae2c362e13a575e8b355bf1e43092ed9a920cd2434b9

SHA512
2c50da55e045570b5da5a700ecc9a103cd0c62670f32079739891af13ee97dadbef714d190ca2697df610fc99bb8be2e69e7350806f1188ea6472a4c3db6290a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
789b63453b23c3769679cd08c746c178

SHA1
07e5777c6d90963660239903eb960b2ca4a4a69e

SHA256
8b1372268b49872d4b065ad343a547f5eb7870f4dab70e1cf7b9186e8fad6989

SHA512
a2d7ba77f395cc5a1697a91d37dd7d8878132c1ee1ee7085d947a01378b49f3a35c77e855e0e25e89c6dc3fe37fc50bbe1e80d0e1d5393a6bf401ba107298099

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
44679ece7fff60bb8cb50204e2f18557

SHA1
5565a9abe91128d17c2cd0b27263b37b62cd4615

SHA256
4954a291376ad8f7b7c13625db6a7f5c058abde9f7ebde24d72f122a1b3e70a2

SHA512
de06d29ad0074ef8c908c06984aface8ceb5659906c77833ffef8d91cfac281c08bf448eeb74242239f38db11e2110fcf5b3a2eea2d4a37fb4565622adfb2d91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d0dd.TMP

Filesize
1KB

MD5
36a562e3d95f28dfe90a7b43b92d81d0

SHA1
1d7474312f1f98f5e6cdde8bb7e2ddae0901e934

SHA256
c3ee9025cbfa45632b74d164babc6bfb4628ba0e147c84306a10a60475071196

SHA512
abdbb9322125128dc274c8fd40eddca6f7c4315dff6ff7e3dca972a7f0acf67dff0167a9119ff7292fbf2cd8831231de27fd858b7e283f21235169e35bfe6d4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
08bb100ef32211803e72cb7f851033ee

SHA1
9930948b058886c331f31409ba7a825c655aeb5f

SHA256
b4a62808d9758366d1ad7fce88eec3c3756cf941a7633073f6524d5974ce3ab0

SHA512
909827f10aa8cf000796566532886a3b41b9b6661ec8353ba6ac273a28907fc26602733c14410609262aaebdf9872cf67ad1c0986c84d8f55f914c220647f73c

Download Submit
\??\pipe\LOCAL\crashpad_3344_SKAJMNRJTZIUCCMM

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit