hxxps://forms[.]office[.]com/r/33GnrxwMK7

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://forms.office.com/r/33GnrxwMK7

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1956	msedge.exe
1956	msedge.exe
4840	msedge.exe
4840	msedge.exe
3424	identity_helper.exe
3424	identity_helper.exe
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4840 msedge.exe
4840 msedge.exe
4840 msedge.exe
4840 msedge.exe
4840 msedge.exe
4840 msedge.exe
4840 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4840 wrote to memory of 4660	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 4660	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2376	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 1956	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 1956	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2136	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2136	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2136	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2136	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2136	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2136	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2136	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2136	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2136	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2136	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2136	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2136	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2136	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2136	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2136	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2136	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2136	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2136	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2136	4840	msedge.exe	msedge.exe
PID 4840 wrote to memory of 2136	4840	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://forms.office.com/r/33GnrxwMK7
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd944946f8,0x7ffd94494708,0x7ffd94494718
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,3936875125441714599,6273376657417884632,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,3936875125441714599,6273376657417884632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,3936875125441714599,6273376657417884632,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3936875125441714599,6273376657417884632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3936875125441714599,6273376657417884632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3936875125441714599,6273376657417884632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,3936875125441714599,6273376657417884632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,3936875125441714599,6273376657417884632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3936875125441714599,6273376657417884632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3936875125441714599,6273376657417884632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3936875125441714599,6273376657417884632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3936875125441714599,6273376657417884632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,3936875125441714599,6273376657417884632,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4992 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
19KB

MD5
92a840dc3d177339dae03fedf22a22b5

SHA1
c1c9a6e6442388d07a9d9d72c12da25094d6920f

SHA256
4a986ba8875f22a0eabc356112a6790f90e114adb72eaec4632e03812ec1ede4

SHA512
98c705395dd249501d8069a03e0068bc9ccf4f2d139bec63a00564c69cd21c05cb25cf56ba7b40822963737989d5048ad310e20d6022e84346c982cfcef79e11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
d0bf9d390a4fad0b98cbfd063077c965

SHA1
566cd1043a2950f06053a7f51bd9589c0d41e49b

SHA256
ff1768f632d6736d0817e796c06ba82dd875a98809655d3f677d799d829206c1

SHA512
6698778b92cb08170ea514d29454bfa36ba860fa25a5810beea7e2e98a1347f86b9766904b7f3a308a702910cb93c53a3cc679041438ea755931add5f4e45856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
43b5d9617dfe1413cbd33da6fffdc1cd

SHA1
9700f4b5831944382868617e6193d56a407bf947

SHA256
8274a959a787ebbd3205421146d96fecab8597ea8a8c9ddacde44c5c1b8b347b

SHA512
2c2dfbcc4d14fe320bae348441f90eac1a6f8a3702e9d2f117fe7078acd9d6bb6defeed46a66b6efd2ddeef0bb8bcb755ff53f0143c4f97d056b68701b0bb3a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
fa27b01010f8847afe1c41e49e99e015

SHA1
863992d71446d31b25481b539417a85f0182a5cf

SHA256
a29c9c950d47f3fa89b312bfe559e62392cb35d4951f117aaa17f298c139c0e8

SHA512
2ec16f86e272fa7c593e5a42d3cbb7e8875aae625e2c7991f4fd6445c6d91780f1cb8eb735a26998a02a07f6bc7e23087a9b8aca8fb73426a430a91ac4938084

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
647B

MD5
4d8d40ea9397748c1a746a2e02f91198

SHA1
977cb9a29c1b7c2f59d31c8291d6b80da54a4f9e

SHA256
40c983fa6ce1869fe910a347a0bd1e4beddd808fe22da082db533148bdbce586

SHA512
a5c908472765c48cae03ce4b53d7772c481bd9d451681fe3af999ee4147eda221093966cca27d20aead8d1c46e4a387011f25d8824177af0e7a225b2e0b4f9ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
736B

MD5
e3475695b6ceddf365e2442e94eb18b9

SHA1
b166109acdf25d70be4e63b8426490ee06d7604d

SHA256
3905ed69e8f5ef0f458594cd68be2c13e580063589eba3e47414ff1fa485de04

SHA512
f07699dece1ea6da02fed72d74c58e0b1a008d5f86b98fdc84521466b33ec48e67f5493f654012459349218ad971f273eabe08be979ac6a37447263bac2afcc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0292da90fd5052f61bb48faf908dd6bf

SHA1
1b8445d57ddd7b667025034b710cc8b253821094

SHA256
65dc325ab386bc791c8889e7650a3015601f512696c991e7fb264e5ad2cd3acf

SHA512
cff8b85b655015df6f44832d20649cac4de4b149f7e86e2f8f60607b86d8b41b4ebc0e5ae6936db297a01bb0192a23c235f736c2c54dec93b92cc15c8fd967ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
05e3eaf235396fefcc6669592e9ef6d5

SHA1
f0592f7fe97a69cf23d776736ebb5ef3193d47bf

SHA256
b531416620ddd55cd31acec05c5df04d7fb8622d44c0188a9b92e62d7c435cd1

SHA512
b077e9c154f5ba26b2cc001b2d009ee0e46a9738616ebab552761e53d43893a1345e9a50f54fe065d898da406c5c2526fc850d62b6b164b36c289297277abf6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4ee88fa779e68bf819695326a9117731

SHA1
3ae8f90271e840849e861edc5a769bcdd89fb696

SHA256
76e46b6639e2e1d4fc40dd2328c40c35985550a44ac3fb930dbd81185b919e36

SHA512
c4cc6ea563be04d95616f2e65d8900af69efeee656550cd903e7836992b7cf9c5f7d7d1e5eaefe5264c45bc3004dd134a5776281ceadf37d345f8ea1b781b1dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3cd3c26d30e834c2e1a8b350ff823b32

SHA1
1e77c1e4812a78bca83696bf1fa42f42f2dcf4dc

SHA256
3b0e4a1e16959bbd9aaad43cbb85044dc41d868eac39775ad328480e3aba28e4

SHA512
1fc390709716393500a3f7f42978fda6e55485065e9701c5d9f8dc9eca2955bc02b0c2aa61ba5e732e8c2fe429dcd99abb0ead80236ebd24a2e0e1b837c0444d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a4b1e4ad1cafe4d5fe5ed47801885bba

SHA1
a656d8082791f871f4927e400bdd44625b1b765d

SHA256
24d986b21c070b1422013d025347b841e4a342104d15af6b46a874f07913040a

SHA512
d1a1ee73067b64e16879fb1150c9c412d55b7d7cefd5ab0773f2d1d991566313a7c7bb9aabed010057fa23e9d0d69a7d00f66c98eec0c09a04c14b1595a27e3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
2d24d8cc4566066a053250a5cc7d923b

SHA1
618a97ee156e188044975eb7b0848d548ead264c

SHA256
032c1581af836a36a93c06fc466d697a0168969a9b6bca15d9ca59ed714fa9ca

SHA512
5068f84d1244e072f56155f8315363fe624535d46cd97bc9b41f1ab00335238d715ef7edd9af42cd514616eae0395d0c245e989ef35042f7583eb62f9e6b00e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
0601a6a6d179ce084d2dcb3a93dede85

SHA1
5962e241ee1682b78ec3733c528a31cdad4aaa55

SHA256
74750d193df4e9e535a8680ff2537143e29bfc06b3a590b75d9883cd193c4363

SHA512
b66fd69c06bc74d1afad17031872a2877008bc00ec86fa8187f8e9cb47b8ea3a19d4cee6208c94d61779ff79ee0d432db3224374c541786996b9908a04d3fef7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
560fa299b6b813bd82ef86033f604d59

SHA1
a3425d013e8c9f815ba38c16000d871afc7491ab

SHA256
ff2787060d1b1190370a88ba56a5906d7eaa293c9ccb1ab3738c03073a6f260e

SHA512
197b1d08236864e1d10b63c4f5f37ee880f562ed644b1a95e6aeb7669c186ff5faa4ddd3910bd06bf41d5bb6089c5d644c00dcf5efec97c682d094b1a9b61819

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
c5ec51d28c2bac9152fa2e258c7b24fd

SHA1
63184722418ffbef9e9b2ba9b1dfb742d304f9bb

SHA256
e31cae1052487b43dbda68428dea82a2770969a26f17709d4ccbb40c9e8831f1

SHA512
361c02a81a631df0f3199701d0cb331258361834ea91a4f761952aef53c6c85bbae3e343845aca8c5cdd7c6cd4ce95c952c5e4c7c9bf3a98d294290fde8b7f32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
b5235cfe03bdbd61ec0a4da23b9517d0

SHA1
5f40abbeb74a7f5604a02836cf791fecc36f1f72

SHA256
53c83d73298ecad4adb1b20f7d1cc73e1e8d5b2cc54117bbe0dce0ee44a582c6

SHA512
27ee04ed20ee4168dd41670d84e3f860580f1e7675f4a7734cf763f6f2e6eba120b630f10c7bcc5fda39397a68b96b40da6ee00030e7587b7507a4cae2de4c21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
b32c7ed0e079d8ce9db9951558249925

SHA1
66ca1864d8b6b05ff09a3547d1f62351f0205389

SHA256
beb0396a418ab4f94e4ff2a742d5db547a0c6684a4d2a0e9df55a6ed2b221a9e

SHA512
62f66f644536ef986473eff9fbbf5ff7bc4c628e7577887f899e3d86409e31e1546d261e2c9e49a902a20e745d42dfb4c7bcdfba3432207af7b1b66d14b3d1c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
8537fa174b6c34a6c9b8b425a693c61c

SHA1
42252cd2e36f80b47182a1070b57beeec11deae7

SHA256
61e6849d6e58be5415990e94385f1075e91a034e2f0804778b21274698763181

SHA512
bc438e2f0f841a5a3c0497ed12076fe8702269778d4b221fc80f2f2416ce80988958e35ebfa312c7b5507bd3e637c00ef9a8deaa90fe4a101526beaa12b5937a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
41901c5960e75990c7ef916a5ab7800a

SHA1
90c8fe820625e6919c8a93b468391f162e261855

SHA256
97523eef6bc6b9dea69e1e5c8dee67eecf34df1a30cade8f2481da08d9fecc37

SHA512
ef6e7fbd7341f3d56a005fa023b36e78d4320ffba126c792cbb53bdf6260c816c446478b3a1c7bf8fde5a2a82740b48052e9efd28831f664047faf505d7d244a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dafe.TMP

Filesize
706B

MD5
b59417bd641906e270296a31e22dcd02

SHA1
8087386af9383117af5ccc8f6f48eac48161441e

SHA256
bb42737995ee4151f395f17f9ce192dc24a494af196f644e650f7e13ec384a3e

SHA512
ec3faa3a0e7644b8c5d3a8612899608e7b4a0026f7e943321029e0dfcd86d1ace6fad9611177caa43e4425e0cae601149c6ac3553901660e8d149df0b54298c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1749b8a0714e8456583bfa2ab67545cd

SHA1
eb0fcbe78699fb733deedb9938fb1ed03d3d454c

SHA256
e97c787ad87a1a5e1cd9656237e7130a4dc3c6337fd8c542f2ed21e7bfd8381a

SHA512
b223b874ed54c2291d7a92811e7f70b569ab367188340bf879c4137affff2af9303996048edf7f34b38dfef2d36e42c52aeb7af99f8d7381903f14555d30154e

Download Submit
\??\pipe\LOCAL\crashpad_4840_UFFSTSOUTIKHDSFZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit