hxxps://flow[.]page/bnadobedoc

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://flow.page/bnadobedoc

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3136	msedge.exe
3136	msedge.exe
4240	msedge.exe
4240	msedge.exe
3240	identity_helper.exe
3240	identity_helper.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4240 msedge.exe
4240 msedge.exe
4240 msedge.exe
4240 msedge.exe
4240 msedge.exe
4240 msedge.exe
4240 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4240 wrote to memory of 4016	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 4016	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3816	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3136	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3136	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3804	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3804	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3804	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3804	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3804	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3804	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3804	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3804	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3804	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3804	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3804	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3804	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3804	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3804	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3804	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3804	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3804	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3804	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3804	4240	msedge.exe	msedge.exe
PID 4240 wrote to memory of 3804	4240	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://flow.page/bnadobedoc
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb014846f8,0x7ffb01484708,0x7ffb01484718
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,7102942327104224204,2975955981448738630,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,7102942327104224204,2975955981448738630,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,7102942327104224204,2975955981448738630,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7102942327104224204,2975955981448738630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7102942327104224204,2975955981448738630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7102942327104224204,2975955981448738630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,7102942327104224204,2975955981448738630,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,7102942327104224204,2975955981448738630,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7102942327104224204,2975955981448738630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7102942327104224204,2975955981448738630,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7102942327104224204,2975955981448738630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7102942327104224204,2975955981448738630,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,7102942327104224204,2975955981448738630,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
341e312f4bb71d98214292a7a8b359b0

SHA1
0cb97b9cd64091aff304d5fc0bc3846295f3bb40

SHA256
cca3666298efefc0795716a8cd22d7352fd5a5f1fa5ab92411a580d70c073c35

SHA512
868d1743d507fb86e61fd8d2c97ddfec4e70d67cf955714808d70736a148b17df7b60e34afa7af1fba48f8e90315fe546dc022f4f4f80cad1f2706110fafe09f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
1378df0b6cec637e5caa9734551b2ba2

SHA1
e38d4be2ce985337c9e74bda7212d8b4b156a91a

SHA256
776f76899be05586c5c6e41459595c40612c90a77d8f44af0b4d603b8aaafe67

SHA512
3c041874fa4fbed196382daaf74611632f01b59ab1519b836efcbe960e1100fe951759944d5fbb9b5760e685739baed319bd765e16c5792a1b8107cfe18e8ee0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
52a5cc7f33a3ea12ab3e669e3fee2d55

SHA1
75fd51390ea7be52a87d217105b538b8a73658ba

SHA256
219ccdd67d144dfeab5f84c84301a443854a13cff331db6cca7863f9064f5a98

SHA512
3c656defb0eee53e95998655f850e4c682f6b83f60ce8d17e64d4e5283e92722efe40df0d63fe9ca8b6d3891e240bd8dc645c3d47305405655cff7c3d8c73793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4783ae4afc7aaea0b789a95feb8ce3b5

SHA1
431cbc7a94de91cf524f8126faa60ffdccbe4d10

SHA256
c9e0ed13253c1dcdf07d31c9144be53ae7f8dea42e119e353e43f450440a7c9e

SHA512
48338d533eac392dfcbb43a237eac578f0c61578cbaa25472bbfae4a7a66428479cde47a8bee73ae1c9ae07cff77fec3b5ab10a91c8d7186922336f1238a837d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
50427568da4285b4516dbc6f4fbec05b

SHA1
4cb3f09a1018a067a672f00d68e7b9359c8e495e

SHA256
89ff7ca1df9849052d42fc3f3210e4f0fa0c0d0999be63e9d89e6a812b4d1103

SHA512
afb6b00d4d07ea1eb1eda7fb2445e6d51e8023580e3921cbdcc91650860307dcd5e4590e13dc52299f4d546d5ee55756f5a2b521b8899fa5e267428345754d5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
226b4753688f3dd4f5488b1fc2bd017a

SHA1
e6df5ae9bc2bd9058aa94e1db79cdc3fa0438008

SHA256
49fcea93e3107cd8f67dcfe75dd9af006e666923d9bb8414e8295f4480f14345

SHA512
a9bdbfa55d28cf46685a713f988880ccae6cbd0dc8d41f805a6b79ebb7eca01a18ff325fe271e43a683398312150d00ac38b3ec3c16caec8145f7396c9b09e6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4c3674195cdfe05c90678eead8d1b2d4

SHA1
e08ade4863e5714740dd455bf2b8d5d8888d01b9

SHA256
1d19e5dc459dd127fe640d4911a63ccfa31a3a013c64817bb5e08ef76cb1173e

SHA512
ee8756637e3febe4e10d83a8e7a46fbcf070b8b6aadca91788d7b4e59073454b8c065edde505c6f1d1c696fe6261c099f51c10195bbe7c8c030d52c26b38c8e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a05104d3e1edc8f5ec1ad726b72bdf97

SHA1
c14de04bb7886e62023f69d999c053f1555a39e5

SHA256
2620dd45116fd8e3f2224b7e38e6fd11a968eb0d90843336463bd4b634a38d68

SHA512
20d43197b560c8fe2984efdcd3526bdbfeb3a82a1213f70652732ac77cd7bcc2371d65fd49c95c0276e27b3a5112f007230dcaf2e49fe49f0accb5708003030b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579589.TMP

Filesize
1KB

MD5
38540ebe1aed1325c59628659d5f9f2b

SHA1
3eb58285b1b90ad1208689e76c8a44ca8ddf1b77

SHA256
f378ac7ea9eec13a929a4c5899f3da736c2e1ace9634c046ecef2925a2d7036c

SHA512
2632410a9ca31191f928f62dde32ce144204d2211105e0a791c522c1f7642ff39728326cd44d056a95574d6dc0e81a901382419c229c197a44871c77aa0db9e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fdd06fd8bbe3b75d2aef5e6e4012f6ff

SHA1
aa94eb06e7a892a4d47b0d875d5241c126bc77be

SHA256
e75dafa11fb1c281742f6167013d2544582ca98e0417e38c46b00dbed68837ae

SHA512
b66b9aaf56c44dd0199991c86d4f3898889c272a7694763f7aefc3b62ddb06f7dfc769bc05f6440a9046d9d5008d484bacf1fcb286d08d3e12d597e66a00b7df

Download Submit
\??\pipe\LOCAL\crashpad_4240_WYVKFRXZEXTEQAFK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit