hxxp://WWW[.]USEREXPERIENCEDAY[.]BE

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://WWW.USEREXPERIENCEDAY.BE

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4248	msedge.exe
4248	msedge.exe
1056	msedge.exe
1056	msedge.exe
4296	identity_helper.exe
4296	identity_helper.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

1056 msedge.exe
1056 msedge.exe
1056 msedge.exe
1056 msedge.exe
1056 msedge.exe
1056 msedge.exe
1056 msedge.exe
1056 msedge.exe
1056 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1056 wrote to memory of 4768	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4768	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3432	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4248	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4248	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4876	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4876	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4876	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4876	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4876	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4876	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4876	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4876	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4876	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4876	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4876	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4876	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4876	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4876	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4876	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4876	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4876	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4876	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4876	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4876	1056	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://WWW.USEREXPERIENCEDAY.BE
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc86bc46f8,0x7ffc86bc4708,0x7ffc86bc4718
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17298575194538517268,3276526916170073040,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,17298575194538517268,3276526916170073040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,17298575194538517268,3276526916170073040,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17298575194538517268,3276526916170073040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17298575194538517268,3276526916170073040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17298575194538517268,3276526916170073040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17298575194538517268,3276526916170073040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17298575194538517268,3276526916170073040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17298575194538517268,3276526916170073040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17298575194538517268,3276526916170073040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17298575194538517268,3276526916170073040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17298575194538517268,3276526916170073040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17298575194538517268,3276526916170073040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17298575194538517268,3276526916170073040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17298575194538517268,3276526916170073040,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4796 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8ef2f107-22ac-4465-936a-239490f4f3de.tmp

Filesize
372B

MD5
b51742e54a80311873c521b710ca14d3

SHA1
9e2a54ffd9bfa4fc13e548d72b7e0a26650e87cc

SHA256
0a8fc4fcc3294abeaa775f6081fc9ec904568c641ea0132e5f8a19c5699c2b36

SHA512
18942e0961d79023dca28f2b3db525ef755630b57387aa732a969ebca43ef85818eb76f8affc74696f849d9273cdd35f98ccf53af201898bb82d3d1272a3efa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ad130880fe159adabb9e87f9abdbba3d

SHA1
5c0b33c5ffd69f2d3d990fef77ccff0ce66bd3b0

SHA256
1ed7045d43077cde12ce96aaa858cd80de89a1b1c6a37e84a508b663a87e0318

SHA512
2b876d9d29e2b500ffda52f11682d1c476ece83fb037c25cae31cc167adf7006c145c02483206c4e574464083f8ba718d2a2ac965da3e94cb000c023f6545c6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c7faef0303374edc1b383fc4cdd32faf

SHA1
8ed4094980a194cef93d1cf7bba7120b59b50bd0

SHA256
d25e07817616229edb81d2e580e34fca4e4a97866255b761b1879a56bdfeea51

SHA512
4bfb783db925cd321894839f6fd61278e5eb67636467f704bf9a698dd73a993ce2f356e7691c5fc27f29c44421f771d7c9fe622bedec29eb8f0cd3089089defc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
667ae133099deb5cc6153abd57e8ac00

SHA1
41d0d664160ace45d28a55fc8a338d5806aacf59

SHA256
2a27599bddbf76129ad38e72d145d4753fd419dbadc49f1888a11491a4a53f35

SHA512
f42919e5fcb2aa432749390244bd70ed94f537051ff2b65b58e412631a3e3f2bb64263562ff5bda29f3df0c86972181e2256643122cc28a26c38df51347a12ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e63fa7408c19a19c9e7a19fbf24c1487

SHA1
ae142eaf8c27b46c2781f917945d17c33f466ea2

SHA256
b45ddd3ff5857f32604ff38377a64a56d402a6f2d6a9b8d54fdf3dd4b1706567

SHA512
cfcbdac7cca2e85aa493e20b21b628a9cde06c4f1b14ff79da912a870719e3715bfa423a97f988054767f16457e65c06aa03ddeec5c7b9c157265365c7d97701

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d3587775c0464f0683d2f01a2d384bf8

SHA1
9eb534df65c4b5aa42eeef9ef5bc786d2fef7883

SHA256
ef69301441b27a7bbcf82b826177fade906129ccf4329a589d54143cd45fc36a

SHA512
6e9dbf2ed5a0bc93381c63ed93d37ba63d816ca0df9d257d3744b9ae90ec625de2df55cd5204ea61626caed6a06a41856c05da79c172d271b3243599d9556437

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
35bbb8e2e511af4132d1deec6fbb9712

SHA1
be17a99fbbf275b847805893672b357c76e680b0

SHA256
4cb916e08813873969cea389f6cb324b6d3093fb2b16622c457884a8b8f8b574

SHA512
e556855b1e1204255f234cfd5c82bfe80998dc80b93e934707b63e86fc0a63fdaf8fe3e665885754de13dc5b7b2f78f2f6a0f705ee296d1cfe694e03d0715f35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6a88d9678940797340de6f229bedb32e

SHA1
f01659779c6ea8a5125b8cb9f255b027e4812fe3

SHA256
021f7810c34d1845837f85b9c62ec8abfbc26eeafe7cd0e1dd477f0335aeea07

SHA512
af293ac38aa0e9d80f44ad7bc49fe81f4418e93d2c55a8a055c45b702c635bab191cb1061fe09cdecc33b79a9eb1863dbca8d5351e64c7f1203271637a1ac6b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
f42f31d159da5549cb23afb52b059f80

SHA1
85450939c6061160af1cf3441ac382fc854b7a73

SHA256
4df235efe5e0f868650c50ee93105f7b8fa0a88ee986bc7b154df6eeef4e4873

SHA512
d947b8b2856d95d9bbb5f16009e18813021362e4781e8aee26f07aecc40399586b43b5e0076667b13adba5dc03e2fe0a92d89a8445260a911a10755c108393cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
0cdab456297789ac83660df164867e50

SHA1
bdb336e06e18f3305041a22c375dda2043055b8e

SHA256
1ac2dfeaaa75e5bc32105dea0a155556ece789a6af21a67a0a19bb3e300c720a

SHA512
e33e75bcd0dd3b9a6a47789f7c51c4ec2f2aaf40972da216d1eb78f2e009797711e4e85a1b3a805f47bebc79cec26a63b42f53ca95aa78db239b798fa315fb5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
ee87b05be18381d84eebe20cd2195b4b

SHA1
fea19467cdf3bb76721ddff19c513f6d0cbdb328

SHA256
2174c8b8138bcc86237c983725b3115ebe41d06794b7390cd1f04b30b00a62c1

SHA512
cdd366ba888ba8de5646c97b1576579a5655f3af7f6d4c7bb5e1a7aa5e7b877a90cf2655f1c462d386f472c75223fcfc0fdb45d850b2cdb6e78c45b9962fbc41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583ae1.TMP

Filesize
372B

MD5
f7be25415c1eb284214550da0b124c7a

SHA1
1b3dc8aaaf634ed091f02d32c1de4bbe36b933f5

SHA256
c7c06ecae7ed4e40bb320034526a103d04c3c6c30736f8a596b3ee04557f2618

SHA512
23c920ad9a4d51f509c7a0dc2834582fe54dd9e4b0551d673c646513d96b05f3673333f0404555937d815c52883a3df1663f89cb9fbb41153b2766abc2230383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9d5d58b8b4de2266184c38f13bb2ed8a

SHA1
6217390b02262fc8ffd84d336a8bcccb93d94215

SHA256
1a2da1a1f7b013bcfb27b63f7daf864f5248aa1759b2cbe8b5a290e508a860ba

SHA512
e490906296b243fa9c9aa9cdbde2b110e590370ea287e0c3084afd9f544a9d1b5cfe3f0b775a60e15b7d0fd74f93329c3a6ea29cdbee4e5afed19ec3e301a91b

Download Submit
\??\pipe\LOCAL\crashpad_1056_WMCXANYLFUHECREN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit