hxxps://109[.]234[.]159[.]185

Analysis

max time kernel
98s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://109.234.159.185

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

3336 msedge.exe
3336 msedge.exe
2924 msedge.exe
2924 msedge.exe
2608 identity_helper.exe
2608 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

2924 msedge.exe
2924 msedge.exe
2924 msedge.exe
2924 msedge.exe
2924 msedge.exe
2924 msedge.exe
2924 msedge.exe
2924 msedge.exe
2924 msedge.exe

pid	process
3336	msedge.exe
3336	msedge.exe
2924	msedge.exe
2924	msedge.exe
2608	identity_helper.exe
2608	identity_helper.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2924 wrote to memory of 468	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 468	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3312	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3336	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3336	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 4848	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 4848	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 4848	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 4848	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 4848	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 4848	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 4848	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 4848	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 4848	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 4848	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 4848	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 4848	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 4848	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 4848	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 4848	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 4848	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 4848	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 4848	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 4848	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 4848	2924	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://109.234.159.185
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff091646f8,0x7fff09164708,0x7fff09164718
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,9844870377896452121,10368366405679200277,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,9844870377896452121,10368366405679200277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,9844870377896452121,10368366405679200277,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9844870377896452121,10368366405679200277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9844870377896452121,10368366405679200277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9844870377896452121,10368366405679200277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,9844870377896452121,10368366405679200277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,9844870377896452121,10368366405679200277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9844870377896452121,10368366405679200277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9844870377896452121,10368366405679200277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9844870377896452121,10368366405679200277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9844870377896452121,10368366405679200277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2640 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9844870377896452121,10368366405679200277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9844870377896452121,10368366405679200277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:4224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
206KB

MD5
f998b8f6765b4c57936ada0bb2eb4a5a

SHA1
13fb29dc0968838653b8414a125c124023c001df

SHA256
374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef

SHA512
d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
a3b138aa4f93ddcaa8952c8796bb1122

SHA1
a07b8cb29aa53b6b83e767ad7fc4349911664cdd

SHA256
d29a9463bda3252492b1948803a957ece487a924d1f6283e6a9c290e785047a1

SHA512
85e1ef9d2b5626b4f40a9815fb206d6fd8b0817934748a95ff2705ee1703e1e35a56d77f07613c21d0465a2339552171b0b16a884306935463b70b142994b0a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5a15d3115e6e103a958cd017719a17ce

SHA1
d49f192838ef753272fde62a61ddc6c497254139

SHA256
4cbd7f6d9c22a4183b3f071e9be9674fbe0e8c337cedebd6f8378f465ffebc35

SHA512
c6a2eca17b6f6475c7fe2d0e063a082cfdcf157f25cad550023e8c451793d6d76b942c05f2942bfa1681399432d4bf36a0a01286ff47f3777f9e9a6ea61c1cd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8bcb26032a49b2bb936f6903502f5f1a

SHA1
3bc234434dcb629a41fe2ec6c1442fada2ddc193

SHA256
8f6698a92a2a18904eb353773bfd07d6af35524ff889c7eb298358ec87de92e6

SHA512
f7619cc7c360a7c4fce1f1bd38c85e70eb91ff455d6bfc70527e0c8b1dc455aad1e289303c34f3a6ae91380d09e5c33d75e327d72f57b83e09b5f376dea2f42a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
de1408eef6374276751b9573c92424f2

SHA1
a735ea0e8629a9977c1cf1e22bb468bf77c0ea81

SHA256
7fd4b31f6b5927c557f8b213e77b1381baa71118d50d23fcb7b095541a0c4c9d

SHA512
4c7ee1e9a6768c72034e8d933d02f66d94bc07ce5a8330f864706bac021c3f49ccc8eb0c84441f0e5093c098cf5d03eb16c9dfd439a2a6d368c415f299e1ab34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f2eee81942784a0cfffa250cb5a8fdf8

SHA1
b8e7476ef4c36515c7f068a182f917cb135c8b70

SHA256
1e480b33983ca1fc0c52ab10673bf6949e61214fabc3f2810d1d8b3fd61f7241

SHA512
116dfae189f2ef37bfad8b532ee06d9b94625f0c70764a6c822fcadaf8cf93839d440e56a382ad82b47857a376bd5c1cf6c9ca1d331a12214055803123259430

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
485ecb23ca8a1b4256c4409051ebea27

SHA1
3949fe2ff07ac6c9d5e9a539a669c0a7b733a14d

SHA256
d11d3e884b4607b746998f395b72af788884ebeb148fb996d2a4c4d28d3f0d3c

SHA512
ec7dacddfc68f93612a9a6750b37be698e30a58de69a4352e460e2ce06565166bd019bb8abb3a38d81200d3f309ee820c96198fc5ed001e6d876e3f5fc28eb9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
0710ecebf9490fb627282ecde67b1893

SHA1
df28e97e81b0327367e764fdecdabe89eda0e14b

SHA256
0db8ee913fe83a616390c94637f001089ec01f72953976bc302d3826cd898f1d

SHA512
3bb53716e1f3f0410d48f16a799e6e3b66387964249f30f572075d3391166a1d40bc40cc731ae62d4dc8eaa95098d95b54d58934f9c13f6bd8d5b1c9006f00d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583803.TMP

Filesize
372B

MD5
bf7ec207b320345fb7601241a7c11abf

SHA1
41745f332c4f57730ba122088983d619a2e5878d

SHA256
5d25201d73ba7cef1a96ee908370f2b816e4306a898854a0bc3027411ff13f54

SHA512
643944c41dc7d8d7fcac40a754aee75c992db1a1df6b040d39f90aecde06ed5b51251bda152cb863bd0eabaa54b0b57db802782e70028ac692d08bc7d6ccac2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
60ca8000fbbb08427f28c2fd0b316785

SHA1
d932d6452f50719f99ec8871af1dcd33ff0b990c

SHA256
82ca5509c6a94d02d1d217f2f0b6fdc9cb9f521dc565afc636aea33b021dbb3c

SHA512
0ade7a6f011d9a602d7f56bed325d63307b5f9d69b87b1c0a667861244b9c6e626f04322b6ec83094bd047b25588fcc8e9ebca6ed44187b2fff641275e4cc54b

Download Submit
\??\pipe\LOCAL\crashpad_2924_NDSULQIJKYVJPNRI

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit