hxxp://starlp1n[.]online/7c3f4998a1adb9c4092d3ff60abb590c7a72ab7c02c7c976d751e6d3ffb0f3e6e2c3e84c090d3c60ed0f559c654ad0258a63faf935235c3f85f5b474980b7a0dc7920426e21ba0768430f0673c4a096c595cb5d86ab4a628bdbfd00308efc35703479a37aef1ff83829754bd7bc23fcfc7235299dedd44f492a41e105edbcdcc3a82ece99a0005584f815beaa8c6c8b87ff3846b25d025ff4001123a10a785eb652dc07a8ff9d6a8c9c1f8cb58241979515ede18ad754e3a16e0d6c654c748149555708dbc6df360[.]00cf42cb65c5ec8632230fb08f4c5613fae907121bc4a9fe37b30ca759fb8f58#peter[.]griffinf114fg@saic[.]com

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://starlp1n.online/7c3f4998a1adb9c4092d3ff60abb590c7a72ab7c02c7c976d751e6d3ffb0f3e6e2c3e84c090d3c60ed0f559c654ad0258a63faf935235c3f85f5b474980b7a0dc7920426e21ba0768430f0673c4a096c595cb5d86ab4a628bdbfd00308efc35703479a37aef1ff83829754bd7bc23fcfc7235299dedd44f492a41e105edbcdcc3a82ece99a0005584f815beaa8c6c8b87ff3846b25d025ff4001123a10a785eb652dc07a8ff9d6a8c9c1f8cb58241979515ede18ad754e3a16e0d6c654c748149555708dbc6df360.00cf42cb65c5ec8632230fb08f4c5613fae907121bc4a9fe37b30ca759fb8f58#[email protected]

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid process

1076 msedge.exe
1076 msedge.exe
5080 msedge.exe
5080 msedge.exe
1220 identity_helper.exe
1220 identity_helper.exe
3648 msedge.exe
3648 msedge.exe
3648 msedge.exe
3648 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

5080 msedge.exe
5080 msedge.exe
5080 msedge.exe
5080 msedge.exe
5080 msedge.exe
5080 msedge.exe
5080 msedge.exe
5080 msedge.exe
5080 msedge.exe

pid	process
1076	msedge.exe
1076	msedge.exe
5080	msedge.exe
5080	msedge.exe
1220	identity_helper.exe
1220	identity_helper.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5080 wrote to memory of 1040	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1040	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2864	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1076	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1076	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1624	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1624	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1624	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1624	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1624	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1624	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1624	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1624	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1624	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1624	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1624	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1624	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1624	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1624	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1624	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1624	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1624	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1624	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1624	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 1624	5080	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://starlp1n.online/7c3f4998a1adb9c4092d3ff60abb590c7a72ab7c02c7c976d751e6d3ffb0f3e6e2c3e84c090d3c60ed0f559c654ad0258a63faf935235c3f85f5b474980b7a0dc7920426e21ba0768430f0673c4a096c595cb5d86ab4a628bdbfd00308efc35703479a37aef1ff83829754bd7bc23fcfc7235299dedd44f492a41e105edbcdcc3a82ece99a0005584f815beaa8c6c8b87ff3846b25d025ff4001123a10a785eb652dc07a8ff9d6a8c9c1f8cb58241979515ede18ad754e3a16e0d6c654c748149555708dbc6df360.00cf42cb65c5ec8632230fb08f4c5613fae907121bc4a9fe37b30ca759fb8f58#[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e77046f8,0x7ff8e7704708,0x7ff8e7704718
2⤵
PID:1040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,2373413145115576044,14014132874493535579,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
2⤵
PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,2373413145115576044,14014132874493535579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,2373413145115576044,14014132874493535579,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
2⤵
PID:1624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2373413145115576044,14014132874493535579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
2⤵
PID:1680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2373413145115576044,14014132874493535579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
2⤵
PID:2932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2373413145115576044,14014132874493535579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
2⤵
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,2373413145115576044,14014132874493535579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
2⤵
PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,2373413145115576044,14014132874493535579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2373413145115576044,14014132874493535579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
2⤵
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2373413145115576044,14014132874493535579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
2⤵
PID:2340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2373413145115576044,14014132874493535579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
2⤵
PID:2724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2373413145115576044,14014132874493535579,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
2⤵
PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2373413145115576044,14014132874493535579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
2⤵
PID:2676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2373413145115576044,14014132874493535579,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2340 /prefetch:1
2⤵
PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,2373413145115576044,14014132874493535579,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4908 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3440

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9b8e2d8e-5159-4f58-9e3d-1fd09600ece5.tmp
Filesize
5KB

MD5
3ae1d19a66937870f0bf14bc82da6065

SHA1
87a5b7362aa3f251d0228ad7a5717413a00a2ff3

SHA256
871d30ae640e13781c49ddbc5570aa595f861d23629ce8c49503262585f64e9d

SHA512
c0c7f4c76970f5c05a28a314193625618da4d620ec497ab20fb5bb8fffb5bd9fd03f9816bd68b746c32c4c21bcdc158f7ee622a242cea2c8f72ad5fb4022827e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
240B

MD5
463dc193d5544d35a14eddc0b652a1ea

SHA1
eec41d31b4e9c35ba9275deab346d8b47c47955a

SHA256
7a2d7de4730030a4fe4e9f21276af8dc4193be213395191d86effc2fb3ece51c

SHA512
85209fe50b8662bed20cc98d2f66e2bbc9b54ebec30fdaddcc7c7d33a9faa31b8b4ccda3edabad0784f14a5866ba5002d647956c5f9f4fb044842fed066f9d02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
274B

MD5
ac98c3ef215dfaae678fdf2310547c68

SHA1
731052c0ba790676bd19e4b3a505d7718f417a23

SHA256
f8ac46890119f90ff6dddc5476630cfe8ce8461f2679e4ef539c9f303f571ff2

SHA512
6addec5b876398c9519981ac9bb227ad29cc1d6bdfe6d98424cc6f83c7339fa18de4ef8fe8bf41ba266de9b4a6de3fedb9134aaca8d1621834341240a2919a80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
71b66bea4e0ba308f6f183f5fe6273d9

SHA1
b8f68ae5e1296b88b0d9b137fcaa0167d3ea4e20

SHA256
784941fb77c2333dcace3eca8a84993ed8bcc15b60a8e4f95bd17eabda552fc7

SHA512
a09766629f2178f5c7090f71f6cf6080723c97e1941d35d0ee5e2901e82b92ece905e4e2d165ac6533edb730df3ada063d85c2aa1d9756d256eec3463ea18fa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
33f6e6103c44fcc4387b8488c4f350ed

SHA1
63286f826f462a0979d501319449db2debe03d25

SHA256
63d368a2f3c63324afcdbde467731bfeafc8c276be33b3d791f760524ede9ebf

SHA512
76e2177f4284cabf040e9991e2f566cd2b1021dc346ddb5212c3b94fb9863cfea94ff2254bcd65bc09a78276f4751d28ac40502413e2bf689f0390e15355d111

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
c27e444cddc3f0692aee38f33dd10873

SHA1
7cac880b66ee23736c22f92cd06978747a7964ad

SHA256
bbd3a27ba98183f36ec609a53ec3b50bb85cadbd01cf536169baf26ed436a978

SHA512
e5d89c79358ef328f34442f3778a99316d16a60ed72340d8f60c9577a0c3414dc63c6d142339345b01122161859f2dd158bc6d1655a01a7ef5f617483543cedd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
a23dff9475e89ed08097ae8024f32a1f

SHA1
84a8b133842efaad18f6c71a2e8d68fcdd128fc7

SHA256
69e8a0f666ac72f960748af158615fb767c80155739f100eb0eccad777911c9a

SHA512
fef0f8a71e9c97558ddcce4d3ea477051ef0d83866bb5a4e4b6b7cd411cb857c960969a0a69ed9ab3edf6ea514619182729d70f0cb01f3300d7a5c4f4e744626

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
2eaee038cce50592cfb62d4b3e37bb32

SHA1
165b07b139b8434de0ba6b14f99d5e22abeb560e

SHA256
a00485e9148c910566e54e1aa9ba1d053b56a368a0d0eba7ac6aa5ac4545261a

SHA512
dfc5a872803424cb829a0d221ae6b6290eba3ec5fc736169f595d21be716a5ec0ff23b728ad3cf1d26260379dcfa9269a31c19d59167890c6c66673f9220cf0c

Download Submit
\??\pipe\LOCAL\crashpad_5080_HIQUAPSXLYMVMEWD
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit