4dcdc0845b3ae86760441cce6ff8964e9e90d61b7cc5a94e530435af3d105d67

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2023, 22:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4dcdc0845b3ae86760441cce6ff8964e9e90d61b7cc5a94e530435af3d105d67.exe
Size

790KB
MD5

10e150cba1e1d57ce3b57d1b7045939f
SHA1

4c2802a30e05d3b474fd039b0c88808444288419
SHA256

4dcdc0845b3ae86760441cce6ff8964e9e90d61b7cc5a94e530435af3d105d67
SHA512

e7fb8c39c03d67ee909260a2ff8c38c72f21e1374a6bd23b476d62e4f49092d7afd38a9f944326931a83567b8aee550d63f8e871e0fa7447d953335b3afad62e
SSDEEP

12288:AqzXbaUrzJRmKQiKyl+G7LdDy1GPWboTlG4Oe5IWLBi:AqzXbaUrzbvQZyoGXxy4P8oTlG4b5bLU

Score

8^/10

discovery

Malware Config

Signatures

Contacts a large (806) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\ef2dedcc-f158-4166-b4e0-25b5a3d08085.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230307220825.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
4796	msedge.exe
4796	msedge.exe
5132	identity_helper.exe
5132	identity_helper.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1460	4dcdc0845b3ae86760441cce6ff8964e9e90d61b7cc5a94e530435af3d105d67.exe
1460	4dcdc0845b3ae86760441cce6ff8964e9e90d61b7cc5a94e530435af3d105d67.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 4796	1460	4dcdc0845b3ae86760441cce6ff8964e9e90d61b7cc5a94e530435af3d105d67.exe	86
PID 1460 wrote to memory of 4796	1460	4dcdc0845b3ae86760441cce6ff8964e9e90d61b7cc5a94e530435af3d105d67.exe	86
PID 4796 wrote to memory of 2916	4796	msedge.exe	89
PID 4796 wrote to memory of 2916	4796	msedge.exe	89
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1192	4796	msedge.exe	91
PID 4796 wrote to memory of 1516	4796	msedge.exe	92
PID 4796 wrote to memory of 1516	4796	msedge.exe	92
PID 4796 wrote to memory of 376	4796	msedge.exe	93
PID 4796 wrote to memory of 376	4796	msedge.exe	93
PID 4796 wrote to memory of 376	4796	msedge.exe	93
PID 4796 wrote to memory of 376	4796	msedge.exe	93
PID 4796 wrote to memory of 376	4796	msedge.exe	93
PID 4796 wrote to memory of 376	4796	msedge.exe	93
PID 4796 wrote to memory of 376	4796	msedge.exe	93
PID 4796 wrote to memory of 376	4796	msedge.exe	93
PID 4796 wrote to memory of 376	4796	msedge.exe	93
PID 4796 wrote to memory of 376	4796	msedge.exe	93
PID 4796 wrote to memory of 376	4796	msedge.exe	93
PID 4796 wrote to memory of 376	4796	msedge.exe	93
PID 4796 wrote to memory of 376	4796	msedge.exe	93
PID 4796 wrote to memory of 376	4796	msedge.exe	93
PID 4796 wrote to memory of 376	4796	msedge.exe	93
PID 4796 wrote to memory of 376	4796	msedge.exe	93
PID 4796 wrote to memory of 376	4796	msedge.exe	93
PID 4796 wrote to memory of 376	4796	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\4dcdc0845b3ae86760441cce6ff8964e9e90d61b7cc5a94e530435af3d105d67.exe
"C:\Users\Admin\AppData\Local\Temp\4dcdc0845b3ae86760441cce6ff8964e9e90d61b7cc5a94e530435af3d105d67.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.oneptp.com/ax/?uid=507801&ad=14
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd8a4046f8,0x7ffd8a404708,0x7ffd8a404718
    3⤵
    PID:2916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,645993238642385582,14051004087731786015,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
    3⤵
    PID:1192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,645993238642385582,14051004087731786015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,645993238642385582,14051004087731786015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
    3⤵
    PID:376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,645993238642385582,14051004087731786015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,645993238642385582,14051004087731786015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,645993238642385582,14051004087731786015,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,645993238642385582,14051004087731786015,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,645993238642385582,14051004087731786015,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,645993238642385582,14051004087731786015,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,645993238642385582,14051004087731786015,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
    3⤵
    PID:520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,645993238642385582,14051004087731786015,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,645993238642385582,14051004087731786015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
    3⤵
    PID:4060
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:2468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff799f45460,0x7ff799f45470,0x7ff799f45480
      4⤵
      PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,645993238642385582,14051004087731786015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,645993238642385582,14051004087731786015,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
    3⤵
    PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,645993238642385582,14051004087731786015,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,645993238642385582,14051004087731786015,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3912 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
462f3c1360a4b5e319363930bc4806f6

SHA1
9ba5e43d833c284b89519423f6b6dab5a859a8d0

SHA256
fec64069c72a8d223ed89a816501b3950f5e4f5dd88f289a923c5f961d259f85

SHA512
5584ef75dfb8a1907c071a194fa78f56d10d1555948dffb8afcacaaa2645fd9d842a923437d0e94fad1d1919dcef5b25bf065863405c8d2a28216df27c87a417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d2642245b1e4572ba7d7cd13a0675bb8

SHA1
96456510884685146d3fa2e19202fd2035d64833

SHA256
3763676934b31fe2e3078256adb25b01fdf899db6616b6b41dff3062b68e20a1

SHA512
99e35f5eefc1e654ecfcf0493ccc02475ca679d3527293f35c3adea66879e21575ab037bec77775915ec42ac53e30416c3928bc3c57910ce02f3addd880392e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4e2df702-04cf-48d2-bb39-d1bc6c2ff0ad.tmp

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
61KB

MD5
7a7b9c4a8624adbb3645ef99ba374353

SHA1
2bd2d23ddd06ab143ffaa54f29fbfc45bc18982f

SHA256
ff913aed84077f232791314df22f4d3eb0ab4b08a3a6b2276405ede624a26404

SHA512
b6a9496466b7b9f6af46886c1b5b0c888b071039765ed25e9837d858fcc110f13136c1a3a53a1b69ec30dcea28bacebcdd2c232cb72148afd290d8a7e908bb79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
98a12924474feeba9b1a7ac289b9566e

SHA1
e530600c5a912fb1bc55f0c0236cf9b8d4f857a2

SHA256
d172c2e09cb7a50393ee60cbb0df9424977d7ac9d8d206dffbec5dcd7ba6e7d7

SHA512
2a501094addbefe5509f789d8e539bf4609ead543bb472a4bda86c5936d02acc7055002bb307a3d274618d2719fb3d65a2bcddd1078f3b0605369aa9581b6d7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
f0e7a14aa2c6205252e89d4b62c855f1

SHA1
b2bda2aa9500fd8ecb9e458ac22e52387255ca18

SHA256
d90bab89deb4846d4fc35f64b4f4fed48eb392587407a1c2c83f0d4655346442

SHA512
c34e6f7b8774fc6c6eae92b5f1be7b290e8c1dd909ae7a1dab269b243f587c1d9d3e962f13002e7027a6ab4fafa00ac1faf065ef1df2f20578020454619a71da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
5bf887eaecaedc469aa4047938881de1

SHA1
e14150ba128687048119bb88e337e6f19f56a768

SHA256
b08461443ce4427a3b604a6b50f747c2df4a5022031c339482a6beab095754b5

SHA512
c9716921e95caf8abf3769a880d00a113bef654d5cd9beb9c77509423430ab58191330c5ebfbd648f19c35d59a7191e0490cd0e69798bbd3842da8d04b77744e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8ae5dbbba790f790c500144ed3600039

SHA1
1c75c92b46fac5a9fba7a0d0b4a2e5efa97eb583

SHA256
bd4d4814ebaa816970552ecb83f1b5e51fe308a50c7e20e0cd9b14b498427469

SHA512
44db465935fa4d7935f078e0481efa2e93d765d9062a4d67ee992e422d59bf170cba6148c153f93019bdc0897a142b321e5bd250fbdec7e9d1ec9608e575c36b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
8181bdbdd921c0af2e416f7c8b02fc9a

SHA1
c9317c777177e49ee99916b29aca390f018881da

SHA256
e10f5cdbe2c2d053c7328468bdb125daefff074ee4047eda7a4c51311ec10df8

SHA512
81f7806791a7ef471fd3c7baaf42c799a38abac4cc842ff733f61e246d04360d755687e6aa7d11b37f7d3085da95ad16cbf9d483ab32f3c71e58d6caf0a00d25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a464b38a6df580ab0a4eb493ea3126a9

SHA1
b4af881778ec8c0fda0925528b082cf315ac82ad

SHA256
6c3e4a1c5ec90a400cb7b561424b125001eab540165891eb15c7c2852cef0450

SHA512
6daf7c0827e3c710189d80c99c71d304a09c57195c1fd51c01e76b4d42df92501f4bfd9772a2da6028a97517d92de4538e6ede946fa580817e960badc5358dfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
19a3b8c23f80f50eea3ff21a9b85594a

SHA1
266674631ad8d8722514643a76831616ff7e98b9

SHA256
a0c3ca6f507cd688ee6d49e4450836eddf790a3562578f4b3165461ad5a5ec8b

SHA512
26d9a51bc5048c16c4d36f1525b8a2fc63e57d18a641c724b8eb48122c29ddf0f5a6385e5091b3b6e0e1d95b2b77eeed58418c6f5940807e5d82c3adee5235b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
130644a5f79b27202a13879460f2c31a

SHA1
29e213847a017531e849139c7449bce6b39cb2fa

SHA256
1306a93179e1eaf354d9daa6043ae8ffb37b76a1d1396e7b8df671485582bcd1

SHA512
fbc8606bf988cf0a6dea28c16d4394c9b1e47f6b68256132b5c85caf1ec7b516c0e3d33034db275adf267d5a84af2854f50bd38a9ed5e86eb392144c63252e01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
708B

MD5
76d2a647077558eb000ead07799771c8

SHA1
a0b60a66e89ee8363d6d93b6c44527fe3a41d800

SHA256
290317a266ec1d68c76a1ca6e4418782e430838d1075a436ef6b3f8f4f257c6f

SHA512
05d02332a65b5f656db54ad0b526dc7e40b910aeb17726a2f20e7b66a74a3451780c9a76c161da883c4c662c188bad10366ecb8673792cf3e5a2b0de7a090891

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57085c.TMP

Filesize
540B

MD5
74377a0f20eaed0fe389f9c9b069bbef

SHA1
40d534e648527d7623606756ed7e9d9dc221fe2f

SHA256
d6032d1adc7fb042cad85528020d23089fe6dac4d7abc6afc2f73710b182dbc2

SHA512
0b59cc9c1ae936ca631c3401c71709db5c21a8d55d9430eb2261fcd148222818926206ead9e766044a77547562044b0790719f43f545acdab336a2b6ee9d77ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
7971f8037dec5c4075bc6dffcae76213

SHA1
2e4223d20ea25a359dc8b353208fac6a6fcc1025

SHA256
ac56662fc879763acf32a04ff1d8f9bca2563404875258f9b11e1aad81e79005

SHA512
1e2d59d4630e67a7bb651708ab149cc668afc739863f4fa593e946211f771c7c361ff57ac42d7cbf01a0b472c810e5f9fcd0f3a6f69740504551cf0d980c34a8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
dbcdd41b25d855f73707a2c000d738fb

SHA1
2b3d1f663ac6f198470fe36fa5b53bb43a5f29d0

SHA256
1edeeb48f990807704a782b91b18ca55601e922caf04e5ca51c249ee37bb43c6

SHA512
dd79490000af2abdd311e1639a797eaa340adde9a3771ede9849c11b157ce0014f3c3ba70a8dc929cc10f30f2e1ad3263a4a72480df5caf56a864ee47dad446f

Download Submit
memory/1192-163-0x00007FFDA8490000-0x00007FFDA8491000-memory.dmp

Filesize
4KB

Download