hxxp://cloudflare-ipfs[.]com/ipfs/bafybeievhgrz5gi5nb5ys34luie55mf5p77morzi6vbhnbfxjp2okxnvry/?openboxmailer/auto/email[.]web/987ftmail[.]aut

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://cloudflare-ipfs.com/ipfs/bafybeievhgrz5gi5nb5ys34luie55mf5p77morzi6vbhnbfxjp2okxnvry/?openboxmailer/auto/email.web/987ftmail.aut

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

14 cloudflare-ipfs.com
4 cloudflare-ipfs.com

flow	ioc
14	cloudflare-ipfs.com
4	cloudflare-ipfs.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4212	msedge.exe
4212	msedge.exe
1872	msedge.exe
1872	msedge.exe
696	identity_helper.exe
696	identity_helper.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

1872 msedge.exe
1872 msedge.exe
1872 msedge.exe
1872 msedge.exe
1872 msedge.exe
1872 msedge.exe
1872 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1872 wrote to memory of 1052	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 1052	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 3864	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 4212	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 4212	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 1348	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 1348	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 1348	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 1348	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 1348	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 1348	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 1348	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 1348	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 1348	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 1348	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 1348	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 1348	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 1348	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 1348	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 1348	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 1348	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 1348	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 1348	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 1348	1872	msedge.exe	msedge.exe
PID 1872 wrote to memory of 1348	1872	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cloudflare-ipfs.com/ipfs/bafybeievhgrz5gi5nb5ys34luie55mf5p77morzi6vbhnbfxjp2okxnvry/?openboxmailer/auto/email.web/987ftmail.aut
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe6ed746f8,0x7ffe6ed74708,0x7ffe6ed74718
2⤵
PID:1052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,11450014615191538741,293853403395728667,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
2⤵
PID:3864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,11450014615191538741,293853403395728667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,11450014615191538741,293853403395728667,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
2⤵
PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11450014615191538741,293853403395728667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
2⤵
PID:3128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11450014615191538741,293853403395728667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
2⤵
PID:1324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11450014615191538741,293853403395728667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
2⤵
PID:1916

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,11450014615191538741,293853403395728667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
2⤵
PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,11450014615191538741,293853403395728667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11450014615191538741,293853403395728667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
2⤵
PID:2576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11450014615191538741,293853403395728667,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
2⤵
PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11450014615191538741,293853403395728667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
2⤵
PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11450014615191538741,293853403395728667,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
2⤵
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,11450014615191538741,293853403395728667,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2384

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1eec45bd-1ac8-458a-84c6-4fd5f758190c.tmp
Filesize
1KB

MD5
9c4f6631bea01b5bf4470949f0c7d6be

SHA1
ba541b71302a36fc65c938653a8f623afdd4b1d8

SHA256
d80bfc434015adf972e63d9ab432b372cdcec1ea824a8262931002b890b15625

SHA512
981192312ffdf7ad9403562d4d0aa7efbcfae3fe0976c080cff31772951c60b8f898c173f1ad6b32e3b36acc5a42d3d7e69c8c05807b69eda368db6774dd49d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
120B

MD5
932310eb052020ea3423f9ad7ca9fa9d

SHA1
cee1537505b6df332695c16064602fcbc95a2118

SHA256
cc1ee53db37353146a125abc457afbd8017f8a63b4e73f93a2ed9d80201fd19c

SHA512
b9edae0679d5a90921bd9fbdd61c67abb50664416edbbd908460d57fa2cda2c7e51733d026ccbcf061cb89a7441d1e029d15c170a652c5c692737356d53c5dc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
240B

MD5
112108f025c6829b1aaed3f91e612374

SHA1
0a15f09fe9d1e14045052c599ac2e328df575831

SHA256
78535064e5bf3ee2b602d602c57af891dc1a0e9c8ff8d9d87d4197ff4ed33c76

SHA512
b93305e47d18de942ce91c97953649b0ffa6c69da715324ac5aab435d26f516c16f269ceb291e5dfeeaaba5be5cda0e29d5dd69d29ded08f44e67b32878ceb24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
dd0dc15838cb897665578d9bb6ba9c7c

SHA1
629533321f1513d3bc62fec1878ced0b2d948649

SHA256
8a3b846519a3d2c066454cec520f31ff54fe2b3729e222747d5a0e7c2c882ab8

SHA512
209877df0cca5350451db7929186c6b9eb7d77cfcee3b9d09e71e338c171a0567c310305fe501c9eb8e4b3c5b4cca471dfd3472da4213183e455445f5f737d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
115bacf86ba60da34f425d3778b6e89a

SHA1
8d4a07b43631611ce5493bd94063ab4e7eb9e7c5

SHA256
f2cf84f87b2bf5c6538c0f0baa1d1b030e0fe33bda8ca80274245d095fdbba77

SHA512
20634941372efb77444060af4172c5df271480dcbbc3882636e7282afa2762b97dc79b17567b097255b7ef3dd80b1ba5d4ae8439bc9ddfe19af4d2ab02580aab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
c15c322da92e884a82991e90347863bc

SHA1
d26f5d8caf4130d9ebdbe1f6ef84cfb9201e7649

SHA256
4a3e78e696b66cecb424252516195313732ac78e73c8dcb192f7e69be31147c3

SHA512
7ef2401f7dc88878f626281d76e3748ac65e87938fb6a18408b646ddd0f36570dec8b58af003e3a88799a4641dfb5a413a50d5fdaa0dd579885724157a8408d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
db1fab5e5739a1be6c7e3c14cd3140e7

SHA1
6b3e77a2b4de489b4c33806c6dce2ea9e5f9e21b

SHA256
a712ac958f61d49cd12836da20910a3fd09b63180ba97468cc78a05d8e21433d

SHA512
491d83bc49c1af35708343d79e18c4d430ec11859a321a06c44347c55cd5248ce3c5561f8b2840096e46bd86bc54f6ef0daeef3be5c92a2b06c0b570ac15a547

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
873B

MD5
00ed6759b68f800c42e617b180b54a49

SHA1
4a9d8feb6b8e06d65734caadfc8e1e453b27e9ff

SHA256
a7aefdfeab3cda33f2f019071ac38913479f69a9a75b9a2c45d96529ac47c01e

SHA512
7b837fdd852d5573ee9bc68b4c6e01ef3460af5452e7b18fab01baacf9ab84570452c5b2ecb66c5237960977c34e89b830b0ed2c0c63c8962f679d81a0d28b4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58507c.TMP
Filesize
706B

MD5
355747fe51f6718c444eb1bbd69a21ec

SHA1
5ae7efc5fd09b69e1eb58216869343aabe58e528

SHA256
b0720f94ef7d9ad19f652a40032f6e946c4914a6847c8207425f6f1f1de0ea42

SHA512
3ad637b27a061ab2a3a1051144dab50dba8a23148873b1241862885e2b123de4d989d0b556a015149802097e8f1cb84b943451a3279f1fca10c07edba8b0ef63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
84a98d9956fd48a41eb2fc6ede359b05

SHA1
9349daa53a5da141d092d811c6f997475bf4ffbd

SHA256
cbfd9b5742afdbb6e088378b8a4b3432508226dc8fcd398f1da83799848dc946

SHA512
1eec1f1800b2793cd143a4b74532ef33cd42d266e7be693091c551f1164378dc1866c76081aa697fa1bdbcad8439efb358679c4171c36275504adda538cef197

Download Submit
\??\pipe\LOCAL\crashpad_1872_TZVMQCAQVXEFRDEG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit