9ecbf28720a944bdd3f3c20cdb3f4da7f40da903b651be520348e01a8efa2504

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

kayflock-beta/packages/ranks/winhlp32.exe
Size

11KB
MD5

0629e6d130f226c009ea9ab329f37acc
SHA1

1529c6cf3265311b690992dc975443b35177bc7c
SHA256

4fce997bdd3475c42ba856d8c288fd4f9f91fd1370075ad7e0b11b1e71ae69ce
SHA512

a36f25cd5b79891f0cc5a8e85636ce4ef10c91ec6d6c7c0f5c5b622d0af1f4f400c864d331caffaa8a51d9a2734777b5b9ce87cabb7667a9aceaf8837e88c847
SSDEEP

192:ZomhYgSgGvZx5qdoth1Pdk7WneHWGhh4j8q05:L67gGnP7q7WneHWGhh44q

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1516	msedge.exe
1516	msedge.exe
2796	msedge.exe
2796	msedge.exe
4356	identity_helper.exe
4356	identity_helper.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

1516 msedge.exe
1516 msedge.exe
1516 msedge.exe
1516 msedge.exe
1516 msedge.exe
1516 msedge.exe
1516 msedge.exe
1516 msedge.exe
1516 msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

helppane.exemsedge.exe

pid	process
4844	helppane.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

helppane.exe

pid process

4844 helppane.exe
4844 helppane.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

helppane.exemsedge.exe

description	pid	process	target process
PID 4844 wrote to memory of 1516	4844	helppane.exe	msedge.exe
PID 4844 wrote to memory of 1516	4844	helppane.exe	msedge.exe
PID 1516 wrote to memory of 2820	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 2820	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 3500	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 2796	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 2796	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 528	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 528	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 528	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 528	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 528	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 528	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 528	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 528	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 528	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 528	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 528	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 528	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 528	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 528	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 528	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 528	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 528	1516	msedge.exe	msedge.exe
PID 1516 wrote to memory of 528	1516	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\kayflock-beta\packages\ranks\winhlp32.exe
"C:\Users\Admin\AppData\Local\Temp\kayflock-beta\packages\ranks\winhlp32.exe"
1⤵
PID:2784

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528881
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc950646f8,0x7ffc95064708,0x7ffc95064718
3⤵
PID:2820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,9696010659802462239,8349682164559065388,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
3⤵
PID:3500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,9696010659802462239,8349682164559065388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,9696010659802462239,8349682164559065388,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
3⤵
PID:528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9696010659802462239,8349682164559065388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
3⤵
PID:2500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9696010659802462239,8349682164559065388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
3⤵
PID:3600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9696010659802462239,8349682164559065388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
3⤵
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9696010659802462239,8349682164559065388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:1
3⤵
PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9696010659802462239,8349682164559065388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
3⤵
PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,9696010659802462239,8349682164559065388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
3⤵
PID:2696

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,9696010659802462239,8349682164559065388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9696010659802462239,8349682164559065388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
3⤵
PID:2788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9696010659802462239,8349682164559065388,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
3⤵
PID:4536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9696010659802462239,8349682164559065388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
3⤵
PID:2540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9696010659802462239,8349682164559065388,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
3⤵
PID:1832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,9696010659802462239,8349682164559065388,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3132 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2276

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
846ce533b9e20979bf1857f1afb61925

SHA1
4c6726618d10805940dba5e6cf849448b552bf68

SHA256
b81574d678f49d36d874dc062a1291092ab94164b92f7e30d42d9c61cc0e77c3

SHA512
8fb228fae89f063159dabc93871db205d836bdb4ec8f54a2f642bd0b1ac531eea0c21234a8ca75a0ae9a008d2399a9bf20a481f5d6a6eab53a533cd03aeaaa2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
104aab1e178489256a1425b28119ec93

SHA1
0bcf8ad28df672c618cb832ba8de8f85bd858a6c

SHA256
b92c19f079ef5948cb58654ce76f582a480a82cddc5083764ed7f1eac27b8d01

SHA512
b4f930f87eb86497672f32eb7cc77548d8afb09ad9fdba0508f368d5710e3a75c44b1fd9f96c98c2f0bd08deb4afde28330b11cf23e456c92cc509d28677d2cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
480B

MD5
6545b0df9da2a983fa46cf9e526fd17a

SHA1
bc53bfb82902230b43e1d7051334f584451478f0

SHA256
1161da7e054eda43d685915f123c8e74803410828c12b8c0305896e41a39c708

SHA512
e61f6edfec6dfe34d4aedf5eea13244447cc1dfb2e9811bb6d9c52b8dcfb85f6fe3df1197c5e6de525003a6bcfee6ec1e2fac544baf89dad75f1c4b6cd48be2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
b222361ea398efad3c0d95ddebf34015

SHA1
f5db1a8d4fa588466b9532c388a57aa8dfc6cb52

SHA256
b8cbfa382952704077042d3ee0d97f9ac8566c709839ad1dca19904b32fd6a03

SHA512
cac3045d7c554cf6f88e82f76a7c365c3c56da4e0f8250232a66fe17e68707fbf267b2cecbf4276418b50bd0f9be8f89b784a27e8d7895bb45d07c095c1ec3d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
3023f54f23af718d6ed964bbcf6a8a81

SHA1
0b976b0cc50247257ca368f60f5ae931267dad24

SHA256
308dda51a76cd0531d27c0dc01e7f13dad759d62b48736c31387532029c4b3a5

SHA512
5215ef1ff7b3a449a18ca6c0a08945b8a9ee7546bfd17cdf31920e51123de5f5f474a628100e8229649ec4d89ccdffd9808350ff01b8c9bb3451f4e69d97a7d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
1eb81f92356ecf8d03b07cc5f8440ca4

SHA1
59ddb71974048d8bb53c72478855563b18969829

SHA256
f60bdbf1cbbfa05b2b556018445096d6e53eb9ab853a84484d634e10b8f0806e

SHA512
13b09861fbacef1e6af094d7108b568d2e219c29af1b0cf71ea52f01b4ce8b1131658bde5d74e7bcc5facc8f8f92fb60cf06d791a5bf2a4e9d134c5a7033d1cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
6da580fa5fae6b2c9a1aa52041c80efd

SHA1
3a4dbd36dfa01881e15bd3ff952fcbcc1bbc4fcd

SHA256
55a409b056d713ca12b8a5ee3cd24624d1996bb0a17274240b59208639574722

SHA512
b307b2c3d9e1fd842019251c382684f21e2a13f93e8071a0f14ba57c750ddac2aace284ebd8a0925d118e0c1be6561c11b19765aebf856be6ebb1775d50f60fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bca9.TMP
Filesize
1KB

MD5
d50c6914f7883eb9ff879c64b9f42691

SHA1
a036db865a22b1fa4ca0ea0dd378cf35fdf44d37

SHA256
7586723009e1d9b86189f5a11d748443a4e637e66d23fb55470dc369baead267

SHA512
4dac4b2784d764abd847861656636ccced20df44dd86a92b4334d06bbbb735b125fdca0291765261e93fa1deeea1becea100f25e983be4bce289c2c6c336e3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
d71de2d16be1d1ab01a2b235851aa374

SHA1
35b38236027abfac4cfc88e3c3398ba4d18c2503

SHA256
c6ab092b50987903a81c255ac5c4133286e6724aa28873dd9a164224e3c04d56

SHA512
0162effd3c130da1e9381742fc54179f3b18023b187f98570e439bc26b22bfc1a0c8db62bfbf3f986425af24bac411037cc533d237cbeb5a327e3b3b0ae14dca

Download Submit
\??\pipe\LOCAL\crashpad_1516_CYHOTXEDLFCAFEBA
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit