hxxp://sdf | Triage

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://sdf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2312	msedge.exe
2312	msedge.exe
3992	msedge.exe
3992	msedge.exe
2620	identity_helper.exe
2620	identity_helper.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

Processes:

msedge.exe

pid	process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

msedge.exe

pid	process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

Processes:

msedge.exe

pid	process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3992 wrote to memory of 4120	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 4120	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3712	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 2312	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 2312	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3200	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3200	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3200	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3200	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3200	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3200	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3200	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3200	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3200	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3200	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3200	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3200	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3200	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3200	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3200	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3200	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3200	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3200	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3200	3992	msedge.exe	msedge.exe
PID 3992 wrote to memory of 3200	3992	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://sdf
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcab8046f8,0x7ffcab804708,0x7ffcab804718
2⤵
PID:4120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
2⤵
PID:3712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
2⤵
PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
2⤵
PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
2⤵
PID:2912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
2⤵
PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
2⤵
PID:2808

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
2⤵
PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
2⤵
PID:4236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
2⤵
PID:628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
2⤵
PID:740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
2⤵
PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
2⤵
PID:3824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
2⤵
PID:5124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
2⤵
PID:5484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
2⤵
PID:5564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
2⤵
PID:5752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4016 /prefetch:8
2⤵
PID:5400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
2⤵
PID:1644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14167141440796594375,3280235006150902173,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6844 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
206KB

MD5
f998b8f6765b4c57936ada0bb2eb4a5a

SHA1
13fb29dc0968838653b8414a125c124023c001df

SHA256
374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef

SHA512
d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
db3750350b358ac7be980233390b6327

SHA1
38877e482bcdce4752cb29dda7a127001d02d4a8

SHA256
3b35389a491633df7f5e98421f43b381711ce233a1a392187fd3e0088826c564

SHA512
6a6b6db3e417dde6ee702b62447f7697058b92db9483c610cd5b92f2817e536976b48a0da4b1a9e55d19fb3699726356ba1c176fb4b0baff3c09c0d03c231c0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
16d6b0b53dc991c0e31fa5c6817952e5

SHA1
704df28e4b60c1eca7c678eafd0689f777f3a84e

SHA256
6149e176937df290fa8c8d4e6bf060dc65ec1081d70e9e23639f73312e7d8e8c

SHA512
5cf351d0c375d9d9d44a4d74e2cc31899aacef4d736329eac58528e2c013935771187540a22865194f405b00ea5b26ec88e1051a67971976a159433b58b1a5df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
65213c945acae949df9266409481da2e

SHA1
057e074e241d3e74a1049aa742f6add40fa4ea55

SHA256
e0988e8123f347e0e276c1849fd5f329dda3d8aba5272b5f1b97c73e741933f7

SHA512
2fbf5323093222fd025314ef609894dede7f72ab5d15a34a837eddd6771541c40cf7d198277808577f5b54f93ba69dec7f71e557c55f5ce41b56a921a448915e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
51ef356b15140433278c759564c023ac

SHA1
5e3470dfb1d23a10b2beb27c437c1ec901c7f7ee

SHA256
7dca615ea628371ca27be84a1d58a759cedda98c9fd09f93dcd7e031ddecc359

SHA512
39ed7324810e2ed7c628d53de87f9aabfe611845f2c26e380426dbd8dc4257cadf9a54f07bf647e7590e0478b1cde16fc1ff4d88f153e5ebd00796c3e39d143d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
57e7ab0af77bbd1048c7e56ae1babcdb

SHA1
a0bbc0644365711b6b5cbdf4d0247d0658be890b

SHA256
8e961d02b0f1c5460abaa2c67da2cc7f66141545bab75b08c6d5cab6d08902b2

SHA512
885bd4031ae2d631e37a3e11043a14eaea081a9328bcfdc120119a06662d093d6781c9a070a7250bb870956df0ed5f85ea1bfd5dfae180e8297ca99064cbc131

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cdbd851dd82d22c0fe508a108833e11b

SHA1
6eff0fe4e4db4a9ddff926dbd8d9876895130108

SHA256
5093b53043a1894af3dc3c6c1e2626d5177c53c71c062a2ba9590f9520234c4d

SHA512
fb586d1d879bc0de87fb8269f714e4e1af90cea524d3100090c34de702a850dcedec607ae69159b9be21f440c2d82a42f0cb586b7de72f29b7caf8b217630f6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb355a10f7006547dc8bac70cbbb0121

SHA1
bb614316797e460202ecde749560f4bb622cca81

SHA256
b3348c177e792a1cb06e3aadb1b093d87ff4adcb534236f23835800e2550c6f4

SHA512
3fddcd5e3fe5dc035b5788b344c271c22c8a3ef2b01ce55eea6cbf6b87651dbf48f5bd23980404ef8f85ee894e1a1aea5a9f698938a90fc3641d33a12468a65b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0f671be92f68f65d0b94cec6de9a6e49

SHA1
4ff3da0b22862bfef872f55a06dc7c2641da44d9

SHA256
0f678ea11ea103297f7c5adf1b69d36efa5dfce2762619ac7450c9264af10dcb

SHA512
47debf8885c92fd24308f2b7138b087011792aca39db7893a2e3214c43bea07c8ed77794ab75c0a6405d7315526f705e7a85106e12b7163851489694aab38026

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0d06b35f3b6912cb192f992f81c6326d

SHA1
39a1a0058f647a0672940a7fe9d0c74698ed3e03

SHA256
7eeb20b9c1d3890ff1f4eb003bc969b5910c2ce04c9733b3db4fb001ee59a29f

SHA512
5036f48bb2e50a27d866f8ca74c6602efa11a01b1cf7c353d81c79b0598da2eed5aee60f1c756fbed0e8bdbaa3439ade4ab87898726085777b3a695e378246d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
8da99b194cd1c1366cad5cb2f1a5f021

SHA1
0474426377cc6b77605da8178d7642bc68e44cee

SHA256
b20e424b69cb4419585bf7831e54a3e33d0cd90d9fda0948984c5f80eca89088

SHA512
941e6636545bdaa121cac498c17a4e07ae424988e6b7400481b75f2d03ee45cfd03398e8dee93af037d5f6092f67779481c54b8d05f35b2185c40b5771e7b575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
13e6b42de5040a5a3c9b9ac131d769cd

SHA1
d6ba106115f80fa8cba0e1a2c8b3713237da724f

SHA256
638c8b6a9be382fa700bfbb1970a0d45718292c96235b150b88617bc0c33cd30

SHA512
632a746581d38f80e48d583cf7f96ef1188b7c621ce343d4e301c512cf54cc3a06e2cf302d4d52632682640b10c912cdb7404c5a0435da25f9f1156c5de574af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cb4f.TMP

Filesize
538B

MD5
e372f4bf9d2ac8f71d64beade9de6c99

SHA1
2496a68d61850884df7aac3b94e97b425144651e

SHA256
3a875dd3671c3eb9e8c862e5e07fa1d9390bde803a86fb3fd82c503f59bc76eb

SHA512
5fc27bf2379d73c8c1afd5642049c48a054a45f8351cf289e17a92512c98439c3735d8434bffe903e6fa9404ca283b490aea553530050fb4828b3f21faf3929d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c202d4d9e596687f724ba75f43cd6a0f

SHA1
66a877dd5eaa6775adea8392f00eaf5dbc3fec6e

SHA256
1c3aab31bde88a5e98a0a5667d1ce6020c40e0c4a1af45915742de9d1196832d

SHA512
a774c14faf154504ae4a6de509d71adce02bcf8576b857e5dbd70d0502b75e42c6159ccdede5a5cb62c24155d0a4fa6f873bd2e6f027e080ef8f03820c1cea96

Download Submit
\??\pipe\LOCAL\crashpad_3992_AAPERAXJBHVVLKKC

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit