hxxp://x2[.]c[.]lencr[.]org

Analysis

max time kernel
220s
max time network
222s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://x2.c.lencr.org

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
1228	msedge.exe
1228	msedge.exe
2236	msedge.exe
2236	msedge.exe
3144	identity_helper.exe
3144	identity_helper.exe
4276	msedge.exe
4276	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

2236 msedge.exe
2236 msedge.exe
2236 msedge.exe
2236 msedge.exe
2236 msedge.exe
2236 msedge.exe
2236 msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

msedge.exe

pid	process
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2236 wrote to memory of 2348	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2348	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 2328	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 1228	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 1228	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 4956	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 4956	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 4956	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 4956	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 4956	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 4956	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 4956	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 4956	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 4956	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 4956	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 4956	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 4956	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 4956	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 4956	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 4956	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 4956	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 4956	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 4956	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 4956	2236	msedge.exe	msedge.exe
PID 2236 wrote to memory of 4956	2236	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://x2.c.lencr.org
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb533746f8,0x7ffb53374708,0x7ffb53374718
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,10512085988363377137,149144507931361557,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,10512085988363377137,149144507931361557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,10512085988363377137,149144507931361557,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10512085988363377137,149144507931361557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10512085988363377137,149144507931361557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,10512085988363377137,149144507931361557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,10512085988363377137,149144507931361557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10512085988363377137,149144507931361557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10512085988363377137,149144507931361557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10512085988363377137,149144507931361557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10512085988363377137,149144507931361557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,10512085988363377137,149144507931361557,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10512085988363377137,149144507931361557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,10512085988363377137,149144507931361557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4276
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtOpenCRL C:\Users\Admin\Downloads\download.crl
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,10512085988363377137,149144507931361557,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4692

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
394c2b5b4ccc2d32d6822741dab6f0bd

SHA1
e00c6434d5ef4dde02fa9a373b9a1ec28384ee95

SHA256
b943114ffdc39622fda7834c5fe1fab56c472e4bbf82c75bf0785bc6a4243995

SHA512
faab1910f45cbfe8901d34fbc62308c49fba5dc98197ba44c0215b6b879de4d91a0ba38b33200ce6ee8eb33146cbf672ca53dde8bec7311cd6777904f94c9c2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
50b48e2fa26ad19ca6b6105b05560ba5

SHA1
68c460c4051ba5d0150af66242a1d02d273407bb

SHA256
97cc268d922f13098d168d3385f9648ffd14d0c8bcfcfc93664180c8045c81c5

SHA512
091fd4af1f6af0bd51274af382e5550055633d778281fd15a4d212ddd9e5eb9031cc32dad128289782361bbd6e052f3bbe04f583377ce1a095c44e12d96f23be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d4a37b6bd8774dbfa010b6cc0cc2461

SHA1
e13a66a43b0a7532142ef6ff542b88c86806cda8

SHA256
a5705749761a0327f40a30f201bacecfe3f2879657b213a7d2bf43e29bc7631b

SHA512
378e5bbcdc69f40322843774763ae9b824b37f5f549fe6978643ac53e50fd7b0637ab567d7205d20de044c757db0c02105c8f00326d45bee5d68898aea6bae12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c7ba6dc81f6fede187ae7672b64e72c5

SHA1
e20cf59f89d1c0d561f9debb08c867ab8217b4fa

SHA256
70eb02a20a268278759b3805f24a4b881e9e96cf099c1f12537f4a320a1303d6

SHA512
667ee322ac5daea1e0b81127f466294255396836d2966d754832da63d6f4face75285f128c34f2e4b6ad0f8474a38ec796e48a501c0f94d0531ce27e9c19f617

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6cd5d966d020f2ebc782266b5e96b856

SHA1
142a27e128d6c8a9ea5000773b6aac445cea70f5

SHA256
4eda62be78fd7cc6e27b114fd49f54dfafb2dad1bd9837e2c502157e3c07cde6

SHA512
69e8033a4a983e92a080ef1ecce3c8dfda576af469bebf0815293f5040da19b8e99c5d56da21bfbbae364d79ba4c347980f270bd54d326e90243630fc23565a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
cb5cb7d83741ce2ed6848deedfde48e6

SHA1
a5367d96b90fc21a7b7f1872299664958b66cc63

SHA256
158eac8b9e4b9fbfb111af41fb512b6be4742261f29d1694172233cacbccc6bd

SHA512
0bcefd693061966701cc1b6913c2cba61559d4feba7e30cfa70df43efcbffede451c7e025310c00b3c7f9245b19ac3dbdaae0ecb79e1e41f187488035ec25e5e

Download Submit
C:\Users\Admin\Downloads\download.crl

Filesize
299B

MD5
5ae8478af8dd6eec7ad4edf162dd3df1

SHA1
55670b9fd39da59a9d7d0bb0aecb52324cbacc5a

SHA256
fe42ac92eae3b2850370b73c3691ccf394c23ab6133de39f1697a6ebac4bedca

SHA512
a5ed33ecec5eecf5437c14eba7c65c84b6f8b08a42df7f18c8123ee37f6743b0cf8116f4359efa82338b244b28938a6e0c8895fcd7f7563bf5777b7d8ee86296

Download Submit
\??\pipe\LOCAL\crashpad_2236_TITYMFNJLORDDAWN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit