hxxps://cloudflare-ipfs[.]com/ipfs/bafkreiemj2se6ffx63x3has6jswij7x2htf7kuybawuyszftrvfuz7oxfu#mhuitron@ienova[.]com[.]mx

Analysis

max time kernel
600s
max time network
595s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cloudflare-ipfs.com/ipfs/bafkreiemj2se6ffx63x3has6jswij7x2htf7kuybawuyszftrvfuz7oxfu#[email protected]

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

240 cloudflare-ipfs.com
4 cloudflare-ipfs.com
7 cloudflare-ipfs.com

flow	ioc
240	cloudflare-ipfs.com
4	cloudflare-ipfs.com
7	cloudflare-ipfs.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1984	msedge.exe
1984	msedge.exe
644	msedge.exe
644	msedge.exe
4588	identity_helper.exe
4588	identity_helper.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

msedge.exe

pid	process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

msedge.exe

pid	process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

Processes:

msedge.exe

pid	process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 644 wrote to memory of 3192	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 3192	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1388	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1984	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 1984	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 3732	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 3732	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 3732	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 3732	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 3732	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 3732	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 3732	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 3732	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 3732	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 3732	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 3732	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 3732	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 3732	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 3732	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 3732	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 3732	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 3732	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 3732	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 3732	644	msedge.exe	msedge.exe
PID 644 wrote to memory of 3732	644	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cloudflare-ipfs.com/ipfs/bafkreiemj2se6ffx63x3has6jswij7x2htf7kuybawuyszftrvfuz7oxfu#[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb6a6b46f8,0x7ffb6a6b4708,0x7ffb6a6b4718
2⤵
PID:3192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6242713510372162035,16801134283404297821,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
2⤵
PID:1388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,6242713510372162035,16801134283404297821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,6242713510372162035,16801134283404297821,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
2⤵
PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6242713510372162035,16801134283404297821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
2⤵
PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6242713510372162035,16801134283404297821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
2⤵
PID:3980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6242713510372162035,16801134283404297821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
2⤵
PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6242713510372162035,16801134283404297821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 /prefetch:8
2⤵
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6242713510372162035,16801134283404297821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6242713510372162035,16801134283404297821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
2⤵
PID:1272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6242713510372162035,16801134283404297821,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
2⤵
PID:3500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6242713510372162035,16801134283404297821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
2⤵
PID:5180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6242713510372162035,16801134283404297821,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
2⤵
PID:5188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6242713510372162035,16801134283404297821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:1
2⤵
PID:6072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6242713510372162035,16801134283404297821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
2⤵
PID:6084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6242713510372162035,16801134283404297821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
2⤵
PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6242713510372162035,16801134283404297821,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3032 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6242713510372162035,16801134283404297821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
2⤵
PID:6024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6242713510372162035,16801134283404297821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
2⤵
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,6242713510372162035,16801134283404297821,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5240 /prefetch:8
2⤵
PID:820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4020

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x338 0x4fc
1⤵
PID:5640

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\149d0d2e-735e-4ec8-b1d8-3711657ef347.tmp
Filesize
9KB

MD5
afd2e7f895677f7651a14cbbd7526727

SHA1
ce7c79d0ecef87b887bac94531110696f14e4d5e

SHA256
a171ee85004abde36bdc8e8d21c8dd078b5d287229b40817f08a72513d529fec

SHA512
ba0239231e1e34affc3a05d908fb4dfea171fabf3555d13bb56f10398285e3733f3a083b061768437b79f56cc70a48b16a174d76dbf3bc1b44b8fe7c9f35dd15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001
Filesize
25KB

MD5
ca2eabac48868288a5dba9191d401b30

SHA1
5b8887f4efd8fe14d10578a50f79bc12d03444a1

SHA256
2beb53e99fc61b073e7cc9426ab7ffe28a10ee48e6a2145f97b34703e12be20b

SHA512
aff3882d979866418f4c759830ce1920cbb5cfa159cfea6a0c8f929dad1326a6c8fb38c370b97cd2b243cf973595acad4b6b41ea7692a8514818afd189f1537d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
120B

MD5
384f459622b1cde6d3636f5ab87519ac

SHA1
5e390d479357c10825e9611877e82c9740c044eb

SHA256
f596fcbc477097542f0340a4d180d214bba211ee35f234a080b2205b320a2510

SHA512
b4c5e51bd531f269a8b9f4555d73dcc929f94a3f15fd406f9c04468f4595fff109de7c40267f76d88e10c8a7bed0fa066c00e44c7aef65dd75ad0ed84bc9244f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
264B

MD5
13b1ef7dbb68af902c6527016d08930b

SHA1
0dac015f04e267e6aedd9a2a17a02c862a3c63e2

SHA256
64c5868e5ac83bca01a9025d8bf726efb71d83440044716e974d77dac3941489

SHA512
d038c760c98daf386f6ef2fc9019b63f07f427d7cee7a93c6ffec9b343560dbab7516520f695b3b913a3c4747506dc4bb22852dc66665d64a4a38bb7f6b98aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
4737f9f65b8d8d52a24b976e75e6ac08

SHA1
438f8a584ff0a9faf15163a113a901faa2214e33

SHA256
7ef50b520c18ecef93d829a3902ac6de8c0dcfaca09b5f00cc25b9ddf2db0ac3

SHA512
20649f00d950b8f13901ef0af72e3643264e41f5285b280e4694671cf206f13141976dd88f12e17bcae271168afed8f4a5c6d2706827ea38111828386af67191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
0aba1805d01f247b09578467a2754587

SHA1
5a3e171557de48a177597d78c33ad1fdf8776074

SHA256
848b169f715c8b6ea7085eda4bb80df5808fad7403e3fac3206cd75102046120

SHA512
65cfe071857d62879460dfa0fec0b511f0dc35cb1fc993d9221e50f7eff2eb55489286c9aa0ffd33543af31aebe18590e9ac3cdd6f2526a0de488ffccd959c40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
9ff083190085475950a960485bc0b69e

SHA1
c56e6d8814927182a23f903cc497b3c0f9938138

SHA256
21889664ff5abfeec5571b27a4a2f27c886898fe42691f3265bbaccf52d4cee7

SHA512
b1f2f397029ae0886b076ecb3522818c1955da253e1a6712ff289664130676f6da3e47ff8daa59b617dd47bf0090d9810913c6029e08e777bf4217982255cd06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
8f01c6a9a581d16fa67f3256b3295b78

SHA1
dc26deae5a101e06f9d3161d3929b150a482da44

SHA256
cd75998eb148feb89871ec4399db92b780183570651a99c9507255033b600055

SHA512
0dbe117ed2661c5055281bc8b48d2bb6932696293a07ebb2b24a191e7ec250b6c623b2367cfed59921991182467c17b986b1cd28068faef7787a903bc2c192b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
00e570704d8bfe37bdbd60feba27b78c

SHA1
c8ca3acaa8fe28067a189ca4e4791515ca87303a

SHA256
e3ab65d1308f433ed35464e1bf07eddb9587424c91ab2846d118aecc09e4a93b

SHA512
76861c576723e8cf4dd8f200982db4e1837c848f5206c3c24aa8b2c99065ab7a1407cd4be10987b47eb59fc98bdbd8a9ead579330546c5280e15cfddb7a222ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
49cc4e1c996c8bd4bf9f4eb5030cda7e

SHA1
8731519bf1437c64cde3354cfb866347b75264b1

SHA256
7610cbb7c759cf31cabe5a0af3a2cd29f9cbfc05bb0d0c87914b1b91902303e7

SHA512
6bdbdd9f497bc319b9898479edea26e7d6edb32a82075cb4217c93677ce681e15681a40cf1f4311b347061dc742c71c2a836d794b897715c778b41deed1d5a18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
10KB

MD5
e457ff686c810fb7ab52414d53adce3c

SHA1
f226e64496c68ca1d6f6d6ddd273d14d6c0491df

SHA256
907d3535831970321196a66f0dca3f2ce6353da05b7dd28724aa6b9ab36f6a9c

SHA512
7ec02cc7483f25a41e374f2a10e126afceab302e4dd58a4ce4391159c959a97397cde766637e668adc5ac024b3d50d1ee8932be387fd2248d0726865498a0515

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
a103bde00b59c3f2864f44e9a7a1d8a8

SHA1
e652aa710f75acea457044edc6da311848ee4ca0

SHA256
172bcc391c6021928e4925dfc594eef859c9d9b1b743e94095888b39ccdd3982

SHA512
c5d8655f76abb088c62e6adcbd2961e3844fd5eef716dba1ad2a9b294402ab8c4f8ea21df53403f51a3de38af8897a073a06377dc6259e0f8bcbde8ce2125f33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
538B

MD5
7c730db75f4b248c9205c923d26cf743

SHA1
e57852ce159c59256e9b842ff107b894939c2646

SHA256
c96b2ee365ed798b5b4000787acf7e563069306eb0b80469ce0668c7c7a0982e

SHA512
820ec3635c0efcb0cc5e22209dec5fae0b26eb89907e648f6dcee69f5e7b9c1cfe121d56c23d6dfda3e305badce6a155021ebd2200f25089c1d68098af7fcdac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5f0151.TMP
Filesize
538B

MD5
235578992dac1b254e482f91ce1dab5c

SHA1
67c677d51e631b9268308eace3287c379a2d6244

SHA256
31fa562600a605f2559706e31573627e775dc9ab61af0db4729f4cb286ec18f5

SHA512
e1be0dd530527bf772124be78ec1d054b2f611d7e14f6f2555768d68503c347fcfe9856f03e74fe92287f8a9cba279da44911335e4f297f2187156bfe57ee150

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
80955a81818d8fd9d0a119f1c716972d

SHA1
d2db8677b98a48ec8c6e80684f93cb05ff714427

SHA256
608b0b8ad78a926cfb7c8260007662667a1dd8281100bf80dc52f858ddd6a702

SHA512
c97687ea80075b8e45be6cf28088e7840638afc2ae847029cd906254320e6ea75b9a47f53fc0942f4a8113f018835abe288baf3fe81be087108fd5fb0c91691f

Download Submit
\??\pipe\LOCAL\crashpad_644_QCDOPIQSINXTEADG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit