hxxps://sc[.]link/hBv6i

Analysis

max time kernel
57s
max time network
53s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
02-06-2024 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sc.link/hBv6i

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exetaskmgr.exe

pid	process
4252	msedge.exe
4252	msedge.exe
1004	msedge.exe
1004	msedge.exe
4680	msedge.exe
4680	msedge.exe
628	identity_helper.exe
628	identity_helper.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

2144 taskmgr.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

msedge.exe

pid process

1004 msedge.exe
1004 msedge.exe
1004 msedge.exe
1004 msedge.exe
1004 msedge.exe

pid	process
2144	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

taskmgr.exe

description	pid	process
Token: SeDebugPrivilege	2144	taskmgr.exe
Token: SeSystemProfilePrivilege	2144	taskmgr.exe
Token: SeCreateGlobalPrivilege	2144	taskmgr.exe
Token: 33	2144	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2144	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe

Suspicious use of SendNotifyMessage 62 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe
2144	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1004 wrote to memory of 1844	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 1844	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3832	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 4252	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 4252	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3316	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3316	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3316	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3316	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3316	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3316	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3316	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3316	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3316	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3316	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3316	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3316	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3316	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3316	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3316	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3316	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3316	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3316	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3316	1004	msedge.exe	msedge.exe
PID 1004 wrote to memory of 3316	1004	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sc.link/hBv6i
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff983773cb8,0x7ff983773cc8,0x7ff983773cd8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,2995129023340933180,1400127538912254501,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,2995129023340933180,1400127538912254501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,2995129023340933180,1400127538912254501,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,2995129023340933180,1400127538912254501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,2995129023340933180,1400127538912254501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,2995129023340933180,1400127538912254501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1860,2995129023340933180,1400127538912254501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,2995129023340933180,1400127538912254501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,2995129023340933180,1400127538912254501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1660 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,2995129023340933180,1400127538912254501,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2852 /prefetch:1
  2⤵
  PID:3612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4332

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e4bf11ed97b6b312e938ca216cf30e

SHA1
ff6b0b475e552dc08a2c81c9eb9230821d3c8290

SHA256
296db8c9361efb62e23be1935fd172cfe9fbcd89a424f34f347ec3cc5ca5afad

SHA512
ce1a05df2619af419ed3058dcbd7254c7159d333356d9f1d5e2591c19e17ab0ac9b6d3e625e36246ad187256bee75b7011370220ef127c4f1171879014d0dd76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
23da8c216a7633c78c347cc80603cd99

SHA1
a378873c9d3484e0c57c1cb6c6895f34fee0ea61

SHA256
03dbdb03799f9e37c38f6d9d498ad09f7f0f9901430ff69d95aa26cae87504d3

SHA512
d34ae684e8462e3f2aba2260f2649dee01b4e2138b50283513c8c19c47faf039701854e1a9cbf21d7a20c28a6306f953b58ffb9144ead067f5f73650a759ff17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
8b48629c09c8ed529c7c0db2fb96e566

SHA1
f7d7c6afe7ab51c0c3d82dbffdf3de79516bfbad

SHA256
17820a7412e9ebe5b05f224936509a7bdf2386d56bb35aa09a53fe19880c506a

SHA512
4d970846896dedefc57b21e0ebfe325dd984849fb47c3b32e2425c234f36f157bea0b67ce02d3a820078f56d2bd071182912285a60a6db3aa19f47f6e766d7b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
28998ccbe4aab3cbe452e5c410284a8b

SHA1
44ddddc433ee23a4db7f7e987f42d61dc223fc66

SHA256
3c85f63c08123c6db3bdb89d22c7fa85095724f495ce10bace4da129b14112f3

SHA512
f80e46f677f88193991093ddcc93acecba4aad3d4541ba5fb06c721501b4c8f88fb74a3efa3af13bdc73c935e52284b3ea01889ff3f67ec1fb856789f141203f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
931a59dffabc5d2252d4ea183e4e432c

SHA1
a1a448edc0122881de33c05ab34b2dab0452fe22

SHA256
6acdcb28e0271c76ffd1fbd07ceaac980f8c688ee3495f4e91236b21d7bd24f2

SHA512
d16235296fa4a29a89450f83f1f06b1c3c6f2a054e1fd6477eb2daf7285c8609162c01ebfa89893032f343491bd2c528249d0f25542357e5c9c0aec066908b1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9f5a686331bc990d9c441aa0981890dc

SHA1
e3698eae67a422340b63c887081e37f9704a60cb

SHA256
5b6b06c5a473168ac058137a1b95dce67d95b114435a73afaf3e34cca28466ff

SHA512
bcea1aae392c5c98133b97c0801310ec0087c18c319b08ceaab5c753fbdb3a2514d7736c91ec9b4e99857d9654c0ae0542c3d7c2ac49e54f3e16f92d9e46b963

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
259519a08fe7ca93465a2ba2024b93f3

SHA1
e0901fb74c1547cb683877a9fa75a39b1e89c648

SHA256
a654ef5bbe7cc51f04ea968ab46df713732a9945a215f8b734f418c70e413523

SHA512
988a05b054396ebfe928fb7ff385ee901d2333a4b470bc8175d27a0ab53714942ff143de6eba0760577f9bf8b8fe4591b45fe2e67f2f838729de907e56c9581f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6c1ed2b530b4d3fcdc5ac7cce843d50f

SHA1
ca5f2eb8d9dc39b02842d5348d3263c3f1df3ec5

SHA256
3c1a62106890da640cfe91c5715ec3193b28e28e8a4a039c9129c0668718c451

SHA512
e7aa9090a9c6606cb335af1ce5a8a860f9b5601fb30115d6e9b269c24e3bad99a34bdd070db7bb2d05375840029c5cea2abf47b7789d9e0f45dbaf3f978b4976

Download Submit
\??\pipe\LOCAL\crashpad_1004_HAHNTJTZHFNVEJMT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2144-174-0x00000258F86F0000-0x00000258F86F1000-memory.dmp

Filesize
4KB

Download
memory/2144-178-0x00000258F86F0000-0x00000258F86F1000-memory.dmp

Filesize
4KB

Download
memory/2144-184-0x00000258F86F0000-0x00000258F86F1000-memory.dmp

Filesize
4KB

Download
memory/2144-183-0x00000258F86F0000-0x00000258F86F1000-memory.dmp

Filesize
4KB

Download
memory/2144-182-0x00000258F86F0000-0x00000258F86F1000-memory.dmp

Filesize
4KB

Download
memory/2144-181-0x00000258F86F0000-0x00000258F86F1000-memory.dmp

Filesize
4KB

Download
memory/2144-180-0x00000258F86F0000-0x00000258F86F1000-memory.dmp

Filesize
4KB

Download
memory/2144-179-0x00000258F86F0000-0x00000258F86F1000-memory.dmp

Filesize
4KB

Download
memory/2144-173-0x00000258F86F0000-0x00000258F86F1000-memory.dmp

Filesize
4KB

Download
memory/2144-172-0x00000258F86F0000-0x00000258F86F1000-memory.dmp

Filesize
4KB

Download