hxxps://chatgpt[.]com/share/1c2753f2-ec24-482b-a1a2-bd679245b1d2

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://chatgpt.com/share/1c2753f2-ec24-482b-a1a2-bd679245b1d2

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
5008	msedge.exe
5008	msedge.exe
232	msedge.exe
232	msedge.exe
2264	identity_helper.exe
2264	identity_helper.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

232 msedge.exe
232 msedge.exe
232 msedge.exe
232 msedge.exe
232 msedge.exe
232 msedge.exe
232 msedge.exe
232 msedge.exe
232 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 232 wrote to memory of 2660	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 2660	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 1488	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 5008	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 5008	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 364	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 364	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 364	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 364	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 364	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 364	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 364	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 364	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 364	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 364	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 364	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 364	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 364	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 364	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 364	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 364	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 364	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 364	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 364	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 364	232	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://chatgpt.com/share/1c2753f2-ec24-482b-a1a2-bd679245b1d2
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffb42bf46f8,0x7ffb42bf4708,0x7ffb42bf4718
2⤵
PID:2660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6912601100361587051,12164808720831592599,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
2⤵
PID:1488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,6912601100361587051,12164808720831592599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,6912601100361587051,12164808720831592599,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:8
2⤵
PID:364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6912601100361587051,12164808720831592599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6912601100361587051,12164808720831592599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
2⤵
PID:3604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6912601100361587051,12164808720831592599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
2⤵
PID:1016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6912601100361587051,12164808720831592599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
2⤵
PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6912601100361587051,12164808720831592599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
2⤵
PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6912601100361587051,12164808720831592599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3836 /prefetch:8
2⤵
PID:404

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6912601100361587051,12164808720831592599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3836 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6912601100361587051,12164808720831592599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
2⤵
PID:3776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6912601100361587051,12164808720831592599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
2⤵
PID:4208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6912601100361587051,12164808720831592599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
2⤵
PID:3080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6912601100361587051,12164808720831592599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2564 /prefetch:1
2⤵
PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6912601100361587051,12164808720831592599,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4572 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
504B

MD5
8258cc972a512aa318384dc61320508f

SHA1
02444002246b02dc110e948c8beb5ff9bd1c677c

SHA256
fd002f0580402a05607ef54c65c6bbf03dbff30ce0d3f2b7a8d0c7daff22749d

SHA512
67aaf1c2e0b937f2b8eb36bf2da95d247dc01b38b35e435b8fc664aff1339b3db3251db36545491620eeeeab820ced0ed36c04f1f2820d995199ce87bae52a64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
399B

MD5
f7c519df05445e9b718b06afe29fe8bc

SHA1
59303eef19934a26768505c9627192c2d7d981a7

SHA256
b68d614f40a76b66754132c49186decc4baf6aae6d8a028978e55b2c7de0bcf7

SHA512
902e9336d104162106be15681a4c7343f0474dec6bd140edfd47f39d071e50647031af4b969919aa8cabf032a4da617acaef659212811b043ebb5af2f64ccb8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
485B

MD5
91c5ffa637412b81cd10123ffaa5646b

SHA1
cf8e44ea5225c8760f39211d87c0da348c043c80

SHA256
7726f587a22f7568345136e06224252d36b53a9a849f86cf6a5e85dba337e068

SHA512
0d11cf13be176c89b7eefb036e39a05bee53cc115e985145a88b5cf8e12a2c75e7c660ccee1a899384055fe03716d8fc4fedb423ff208596df9d60fa454f30f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
a037a76c32aafc09364d7a4db71821b7

SHA1
38931d6881fb0fd27bac3081dfb740186480f28d

SHA256
4ee98e74314d65359e556aa8df773a8ffb09047b611712b537cf91afe0718c1e

SHA512
9eb18f784cac954cf80e1326f29c5af7f3e5e8ce3c8ce6f2d942e084d992aff390daeab93ef6aaed03c57404e984d6258e41124afaa10f1988646b9a58aafc34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
7b070deac13fab064df268b2e15d6a87

SHA1
68879645b46761fc078852854ce98a091fdb855f

SHA256
430aa1adde64a9a1cb289bc624e6634fcc7308727df231c5b03a66a042a59f6a

SHA512
6f22a245df025a7826909ac454fc7475b4804d4479aded391b90ce6d1147c04300e83ea65c80419c9ef32869bf2e9a8f2d1d5564686103998fa5d6985588a8f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
702B

MD5
4bef7e2d96f5d92ae4ac3bd9f7cea55e

SHA1
2591c8e95dc30c0a6de8781657fd15f582e45bd6

SHA256
7e0d9a13e15f51cfbd3f2e2368822d98a59b4fc460a59edee5da48913de0142c

SHA512
5671847cce7e5f4f65bbe82047df2b1a57dc306b4c3f20e9f8182b9e7b392d855a3ec3379a8c704ab0e0965439935422ec0d486434fa98643a66b5bf7e166109

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
869B

MD5
05f8edba6c95768750642e545670e111

SHA1
c55b3b793687d30f9ec06da8c543c5998b22fcd1

SHA256
681a042c4522571178349e7b4200a78265ae3fa44fc22accbb2b3436c3edc17f

SHA512
7ad8f670e78b87098eb8450f0084419bc6baf3bb77b67daad689e8398cd86e892fa495359f97a8014b7a29b2e3dbecc2f6dc89e1b9dd768d627e5103f1f82e2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
702B

MD5
b6a9dc0c9a37e6fd459f5fe03b2b08bb

SHA1
03c48e7f21c122c33263ab30aff136f91c247867

SHA256
a9e66c57b48b330433ca4516b2ed29462a21b37f0d050ec4cd17a7b9b0e66f06

SHA512
717496ca5eff300e9be204e1db58f1f9b1714d7929bfd354a3c1189ff3b13cd392951182b6f5efd22d350ee8bd63b8513ba81c46d7999ae8080fa9040dbcb8f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a122.TMP
Filesize
702B

MD5
3a6720ee92c475cbfc9d5fd513111aad

SHA1
4d3858cbcaec7217cb1cd0d34fc6956ac9017d81

SHA256
4691a0ec94f5eb3e9e85088785e79b227d6b5888952024f8dd1507a68db3fefd

SHA512
8ef664d98fbd77b06e98eb7967c7b355272d7003fe1e6d0ac1f06e30f58d4f8cde2120e9fb16d8d6e9b015bcb0cc6055e7fb2fa0e008a905020a9161e484a5b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
e859b201b36184f1dc7b981758619089

SHA1
349fe3cb1bfb829ab811e3bd8cc94d22cd8823d4

SHA256
e12a1fde1fc42c38fa8cdaaa6951025ff0998369ec1a9036dccacb98c159912f

SHA512
174518cc7bf20cd7735d86df25e6d52bb2c7287d9f7c6d33a6c164cb8e4c459a988a8e6d334d8c90c6709a6bf8ef68a4ae9b4cb6f893e17718773cbc4299cd97

Download Submit
\??\pipe\LOCAL\crashpad_232_XEYDWUTVAOIGWVWG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit