hxxps://url12[.]mailanyone[.]net/scanner?m=1s9PCz-0000cD-4j&d=4%7Cmail%2F90%2F1716296400%2F1s9PCz-0000cD-4j%7Cin12g%7C57e1b682%7C11949542%7C14589158%7C664C9C811D87B03FE2E6472997A0C22E&o=%2Fphtl%3A%2Fatsnhtaageeteoilogt[.]rgsigc%2Faz[.]&s=1YKQiaLIfHH0tTbjCAvEAnTGAIU

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://url12.mailanyone.net/scanner?m=1s9PCz-0000cD-4j&d=4%7Cmail%2F90%2F1716296400%2F1s9PCz-0000cD-4j%7Cin12g%7C57e1b682%7C11949542%7C14589158%7C664C9C811D87B03FE2E6472997A0C22E&o=%2Fphtl%3A%2Fatsnhtaageeteoilogt.rgsigc%2Faz.&s=1YKQiaLIfHH0tTbjCAvEAnTGAIU

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
5044	msedge.exe
5044	msedge.exe
2004	msedge.exe
2004	msedge.exe
1060	identity_helper.exe
1060	identity_helper.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2004 wrote to memory of 4244	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 4244	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 3400	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 5044	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 5044	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 4344	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 4344	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 4344	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 4344	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 4344	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 4344	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 4344	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 4344	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 4344	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 4344	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 4344	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 4344	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 4344	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 4344	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 4344	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 4344	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 4344	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 4344	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 4344	2004	msedge.exe	msedge.exe
PID 2004 wrote to memory of 4344	2004	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://url12.mailanyone.net/scanner?m=1s9PCz-0000cD-4j&d=4%7Cmail%2F90%2F1716296400%2F1s9PCz-0000cD-4j%7Cin12g%7C57e1b682%7C11949542%7C14589158%7C664C9C811D87B03FE2E6472997A0C22E&o=%2Fphtl%3A%2Fatsnhtaageeteoilogt.rgsigc%2Faz.&s=1YKQiaLIfHH0tTbjCAvEAnTGAIU
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb2aa46f8,0x7ffbb2aa4708,0x7ffbb2aa4718
2⤵
PID:4244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8211013625850740517,8715129781606025468,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
2⤵
PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,8211013625850740517,8715129781606025468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,8211013625850740517,8715129781606025468,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
2⤵
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8211013625850740517,8715129781606025468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
2⤵
PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8211013625850740517,8715129781606025468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
2⤵
PID:1600

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8211013625850740517,8715129781606025468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
2⤵
PID:3440

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8211013625850740517,8715129781606025468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8211013625850740517,8715129781606025468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
2⤵
PID:4140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8211013625850740517,8715129781606025468,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
2⤵
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8211013625850740517,8715129781606025468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1
2⤵
PID:4652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8211013625850740517,8715129781606025468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
2⤵
PID:4088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8211013625850740517,8715129781606025468,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
2⤵
PID:652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8211013625850740517,8715129781606025468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
2⤵
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8211013625850740517,8715129781606025468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
2⤵
PID:3444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8211013625850740517,8715129781606025468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
2⤵
PID:5028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8211013625850740517,8715129781606025468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
2⤵
PID:1932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2068,8211013625850740517,8715129781606025468,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5960 /prefetch:8
2⤵
PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8211013625850740517,8715129781606025468,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5868 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
206KB

MD5
f998b8f6765b4c57936ada0bb2eb4a5a

SHA1
13fb29dc0968838653b8414a125c124023c001df

SHA256
374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef

SHA512
d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
9380530a91028c1581e7b69399fabfa2

SHA1
5592708a54ebcfd324e4920f5d458e61433cfa0d

SHA256
9757b9687ca0d6358ed4aba6e971fed4dfd459aba74cf65a4999589547bed321

SHA512
86b5dd2f8fca421f62d4c5d255e5ddd034261f6a6e4ded4d57a920d39cf877076d34a009fa70d07e0cbe9bf7ac4cf4a5c66ae9f3370f541d6708085767a47abc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ec58a312af0e920aaa8e282950170f70

SHA1
c6aa8184a46daad8802f6f8c31df9596d4f9975e

SHA256
b9aa1be3866e009beef84ce68b511e807c2fbc2df87b532f4d7553d4832fa5d1

SHA512
fad393aaeff2dbca2f36d74deb2fdfacf5cd1df1b6041abcb2d7a08a44f0a80db44a70ed321ab543d4e4039246bd3380531de92c7b5e339662791de903e85b25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2430a0e2f34e125710d48863a4176e7c

SHA1
33b616dac3df7d5ec30492b00d56dae6c85bd456

SHA256
d239e666544d37229f80717545912448e26eea0892304cc76a0e2c930e8e5975

SHA512
5b290b6034638ea344271d0cdc48116469fec5e51c6a6cfcde02bda78d77c715be30a91bc2e693d6dc1c77a4b95626641cdb96a067f6cb71a9d8a480ba9da5df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0e0fd505c36abfa10e2f0932280fc057

SHA1
6efece881c11b2685f07f43f55cc9617143fc7b7

SHA256
3c77dafbb1bdbd79fea0ba195baa00acb434ba7394981dfaaf7896ade30d39a4

SHA512
6e021991c30d92f35e289fe735bacba2bdd7bbc594ef330959e3e0db22a9832407e748aad838b9e48e10ad9bb5eb7e8d45ec4f44efe4f4940cbc5606e52c792b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
51cf35c47b9ee3549bb8a51ee2d0a4a9

SHA1
e24f0e507528babbcb4b22ba120eaee385f358a3

SHA256
9923e14be704294b87a95e2106f5d5655fb04a5d0086618a3e29abf3fcec06c9

SHA512
fb57991a608044ceab16b9d244686f024203280b268932ab31f88be21cf45c734bec4519fa3b84b27b090d3a57b36dcfbd438af09e2925f7f843f62a6846fce8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c366dd787f30111827ea613546b31a60

SHA1
b0ccd542b856357a553b27b57a4ff5ed579bc601

SHA256
02c2bde82092b27ccd3f4987a886acd75074493c9efa2547d7c65ef67793b2c4

SHA512
6cc5a9b1ac053ca9b061d1b77dcd09d41001a0df3564f683a03916e135cd75c535a9bb5a367f97467ad938026d92c324da10d60f961279fac8f98d3944a2e41e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
45aa796dbc127be87bbd8688c605f1ce

SHA1
2dbcd676e80618c54779e6f7e6812b8d8bfcbcce

SHA256
e41f8fe4dbdf2f6f75782036975f45bfe676b94f7082b5f7cec58591c63229df

SHA512
1574c243ae7085bbc8e9847a5217f4417c207c9e3d9c7130035237677aae06a8d5d6ab0eeddb5e6fc04ead2fa835eb0e3124e22292b4ae30711b1dc4178cc424

Download Submit
\??\pipe\LOCAL\crashpad_2004_ZGVXTDARMTCYMFOD

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit