hxxps://krs[.]microsoft[.]com/redirect?id=-crYd9Lj

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://krs.microsoft.com/redirect?id=-crYd9Lj

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3404	msedge.exe
3404	msedge.exe
856	msedge.exe
856	msedge.exe
4596	identity_helper.exe
4596	identity_helper.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

856 msedge.exe
856 msedge.exe
856 msedge.exe
856 msedge.exe
856 msedge.exe
856 msedge.exe
856 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 856 wrote to memory of 808	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 808	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 4432	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 3404	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 3404	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 1168	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 1168	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 1168	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 1168	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 1168	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 1168	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 1168	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 1168	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 1168	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 1168	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 1168	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 1168	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 1168	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 1168	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 1168	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 1168	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 1168	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 1168	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 1168	856	msedge.exe	msedge.exe
PID 856 wrote to memory of 1168	856	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://krs.microsoft.com/redirect?id=-crYd9Lj
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd92c546f8,0x7ffd92c54708,0x7ffd92c54718
2⤵
PID:808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1549280962394251438,2219869992344575009,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
2⤵
PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,1549280962394251438,2219869992344575009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,1549280962394251438,2219869992344575009,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
2⤵
PID:1168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1549280962394251438,2219869992344575009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
2⤵
PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1549280962394251438,2219869992344575009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
2⤵
PID:2644

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1549280962394251438,2219869992344575009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
2⤵
PID:428

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1549280962394251438,2219869992344575009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1549280962394251438,2219869992344575009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
2⤵
PID:3552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1549280962394251438,2219869992344575009,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
2⤵
PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1549280962394251438,2219869992344575009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
2⤵
PID:1888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1549280962394251438,2219869992344575009,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
2⤵
PID:3164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1549280962394251438,2219869992344575009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:3648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1549280962394251438,2219869992344575009,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:60

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015
Filesize
207KB

MD5
e955953b801c04327c1e96c67dd3c618

SHA1
f9061d3780f153e863478106bf1afd85132bccb0

SHA256
e8965a2d52ef25918ebee58ab6971745d396177a7943acf1ed53a65bb4dddd45

SHA512
6318ff1eb838954dd73dab5ed891d47f4f39089fa5e899d30183c32269c5620bd09d169af4cf8303e3d5c2ebab23cfe9ae5d9fa5c3281023abb009f66a25782a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
480B

MD5
e2d2cdc230a11aad41395ce10edfa0a2

SHA1
22722ec7dcf2906b4e0ee0fe4b861b24698f033c

SHA256
5343226508821e7420844715bb7e878fb52b9827305e1dc2c208585c0a2fb3c5

SHA512
9ff0bb00a43235e18e04df06604035e28f16a2b50090cb76944cba2355d4ae6d1dfa425186d352e08b8da6b9e1bf119f748e7e4facd0fce8cd91d020a7d5936c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
a3a81842a329389ac21201dd7c1f19dd

SHA1
de2addfc3535e52d8a6abc4b12e59db3e0787fdb

SHA256
dff394857f87bd91cde535e9547f9bf3b94fa54c13ee567da56fc65dd1051e62

SHA512
150c9414438b689a74584bb10aafddf8de41841f413f60013a0bb48038f8c5a70c2ee5552cabaf177425c726a360ebf8b32359956316f9f4ad5acc05b7b78342

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
0f2f381e6c90212cc9eb2e8fbc31e758

SHA1
87f6e1083a659daac8eb3e2df229dc9e1a24c458

SHA256
8a759a511f842c835cb274186641cc1a1919eedb2e2058dd2e1fc1bbf4d10e59

SHA512
eecb8f256973a0deb553fa1788d6279889ebf1b722450e9f5551cc2cf361ee5cc820af862cee12883476cba5de0228c52ce52947cecf20b464d291a3b0e12bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
a825f558cebb6dd3b889b39a3e3d4e21

SHA1
9cc164cd7a0eff2242a509ca89ab235c2900ba22

SHA256
4cb23207560bb429ef2601286b646c12e29f59d43a3011e3d565f18edde7427f

SHA512
bbf725cba1f9376825eefcf3f478394dbb92f2c37fe2dcd15b2410eee653d569fc3dbb934d495430ddae71c518ca22b9022a021daa268549080685838a16503e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
8c2eaa753ce7fef3f19ebacf2e0a369e

SHA1
74e8470941374d4f110c733d5720b66ef0319474

SHA256
820309c8ecce8c0b534085e1ef924de3e155171c08be3bf947407c2c2e266c9a

SHA512
f36db5cdbaeeaf0a9f03b32d14c2f5322962f463cb25670afec14aa21bf9f0ecab043602e425bb0564abf0ef376f7480033f9b9994f8f45813c067cd39dc9dd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
4c6fb8403442e4440a4168a24e6b84fd

SHA1
104ac73242194ef3d15b2c971b4c6907b8f6d279

SHA256
ebccde01cf81081cccfb2bd229df468ea3b888cb2622ddd60974a1814b3c0996

SHA512
95d450baca3cd4bf6b9ec59c67d9b74b42c254ce0f6f9d88d0391d1ee358a20acc583e4e96506c63a804fb3752c142457bdc5ab2a8c9513123b21db225572aef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
51b51151aaaf0502446142d388d4b00d

SHA1
c68ff1ce2ec8968f858905de6ded7b5ee838c6e2

SHA256
01cc407a04676fcf3da90827b14c913469916fb0316c347c928872bc797d0476

SHA512
8fad33d365729c44378f2c3f7debcf2a5ae0edf0feacee11b23235be1487b57bca245f766df963c6b9fed5872ae1dc23167d98e84d36b450d1e9901d281a5fe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
c979c3a2b7a50c01837b4590289d2bb6

SHA1
475bca087b9e32a62f5d3992a62f4aaf418545ac

SHA256
55561706024aa3d96abb44f18321879e7fb3584c7e134e637cf14e5a15a32a8c

SHA512
72ef621ff04495f98d81d5fd09f774788ac04425cc7bcec0c94658455f8fc22fd4794dadbdd7ce21e6d696d4bd25f2dba18777acd085fbb3607c958271418d49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
3dd80504e7daa3001157aa1e2027758e

SHA1
18a12efc792b2c9ca52d6befe086e70d00c74ac3

SHA256
50daa8e184c0d1b0f3fba63a81d9b17b3c573f99b73a2557b66e1039d057fb24

SHA512
eab1dde5e56d69e71e7db669c34a1787ff6c3f920f4267ef32d01c7435346b7a5b7cde1ed90b2aeb41bc7cca6bdcc06e86f7c99898e49ba216e7aa9912e02710

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d0bd.TMP
Filesize
540B

MD5
3419ed80cd1f4b1ae8cced3986eb3930

SHA1
b0f6ea1490402d1dd10f67e2a594dbdbff3db027

SHA256
6ca7116269d044b1dfbc1885e1d0e348e3fd60363e7574b23e748dab7244d4b5

SHA512
693c48e42a1ae585c63be38b81247481fefbc3ac4b12f4ecf26f5913e5f4965ee1d6b6aeb172c2c9aaff1b96373940b003f86ec5678dc024f2ef90fe2cd51357

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
5356c2cb061f37144ec8b9b253891302

SHA1
34aac6ac955fea824db1eaa37b570a49e43ce514

SHA256
46d3c05c8c469cc78d9cca6cae82d2d072c539b169c4410ae7684f32ad98420d

SHA512
386ce97c767ce80c616ca4bb21025beac05c85dc820fc61509b62d506e9fcfdc09354825df70bd1d9bd4ed9469b7e36940701fae315602ef1789fc97c4653211

Download Submit
\??\pipe\LOCAL\crashpad_856_SFWVTVGNHICZNNRN
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit