54e03972b66091e138050cf687363d817acfa980e7c2e4c8b647d5ee3d721cac

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2023 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54e03972b66091e138050cf687363d817acfa980e7c2e4c8b647d5ee3d721cac.exe
Size

790KB
MD5

499567a122222f7812c51ee8b126076a
SHA1

855bcdd944db2013147a2e882e10b2963e981b9c
SHA256

54e03972b66091e138050cf687363d817acfa980e7c2e4c8b647d5ee3d721cac
SHA512

531c186e029d871085708389965507e19a98c7aab52e524db233e8d7de6e473ac83ef1cec55889992b6f2009df82ec15fb5a40ff354a47fdc70bbd4d3f4595b4
SSDEEP

24576:6tvs2ttd1WSiDyxxJTy44Zo6lG4Wh6o+Y:6tvs2ttdw5DWy4olG4Wks

Score

8^/10

discovery

Malware Config

Signatures

Contacts a large (768) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\a32017e9-9b72-4695-b529-705dd3d3ae62.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230308003447.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
220	msedge.exe
220	msedge.exe
3480	identity_helper.exe
3480	identity_helper.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2624	54e03972b66091e138050cf687363d817acfa980e7c2e4c8b647d5ee3d721cac.exe
2624	54e03972b66091e138050cf687363d817acfa980e7c2e4c8b647d5ee3d721cac.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 220	2624	54e03972b66091e138050cf687363d817acfa980e7c2e4c8b647d5ee3d721cac.exe	86
PID 2624 wrote to memory of 220	2624	54e03972b66091e138050cf687363d817acfa980e7c2e4c8b647d5ee3d721cac.exe	86
PID 220 wrote to memory of 1352	220	msedge.exe	87
PID 220 wrote to memory of 1352	220	msedge.exe	87
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 1128	220	msedge.exe	88
PID 220 wrote to memory of 5076	220	msedge.exe	89
PID 220 wrote to memory of 5076	220	msedge.exe	89
PID 220 wrote to memory of 4320	220	msedge.exe	91
PID 220 wrote to memory of 4320	220	msedge.exe	91
PID 220 wrote to memory of 4320	220	msedge.exe	91
PID 220 wrote to memory of 4320	220	msedge.exe	91
PID 220 wrote to memory of 4320	220	msedge.exe	91
PID 220 wrote to memory of 4320	220	msedge.exe	91
PID 220 wrote to memory of 4320	220	msedge.exe	91
PID 220 wrote to memory of 4320	220	msedge.exe	91
PID 220 wrote to memory of 4320	220	msedge.exe	91
PID 220 wrote to memory of 4320	220	msedge.exe	91
PID 220 wrote to memory of 4320	220	msedge.exe	91
PID 220 wrote to memory of 4320	220	msedge.exe	91
PID 220 wrote to memory of 4320	220	msedge.exe	91
PID 220 wrote to memory of 4320	220	msedge.exe	91
PID 220 wrote to memory of 4320	220	msedge.exe	91
PID 220 wrote to memory of 4320	220	msedge.exe	91
PID 220 wrote to memory of 4320	220	msedge.exe	91
PID 220 wrote to memory of 4320	220	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\54e03972b66091e138050cf687363d817acfa980e7c2e4c8b647d5ee3d721cac.exe
"C:\Users\Admin\AppData\Local\Temp\54e03972b66091e138050cf687363d817acfa980e7c2e4c8b647d5ee3d721cac.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.oneptp.com/ax/?uid=507801&ad=3
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb72d346f8,0x7ffb72d34708,0x7ffb72d34718
    3⤵
    PID:1352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,2080300592562146099,12119606153634879201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,2080300592562146099,12119606153634879201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,2080300592562146099,12119606153634879201,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2080300592562146099,12119606153634879201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2080300592562146099,12119606153634879201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2080300592562146099,12119606153634879201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2080300592562146099,12119606153634879201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2080300592562146099,12119606153634879201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2080300592562146099,12119606153634879201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1
    3⤵
    PID:3496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2080300592562146099,12119606153634879201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:1
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2080300592562146099,12119606153634879201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:1
    3⤵
    PID:820
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,2080300592562146099,12119606153634879201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6832 /prefetch:8
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:3212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff72a775460,0x7ff72a775470,0x7ff72a775480
      4⤵
      PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,2080300592562146099,12119606153634879201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6832 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2080300592562146099,12119606153634879201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7716 /prefetch:1
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2080300592562146099,12119606153634879201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2080300592562146099,12119606153634879201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7096 /prefetch:1
    3⤵
    PID:5520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2080300592562146099,12119606153634879201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7200 /prefetch:1
    3⤵
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2080300592562146099,12119606153634879201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,2080300592562146099,12119606153634879201,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
78c7656527762ed2977adf983a6f4766

SHA1
21a66d2eefcb059371f4972694057e4b1f827ce6

SHA256
e1000099751602ae1adcec6f1c74e1d65f472936817b45239dfed4b043984296

SHA512
0a8e58ae95163b3cdf8e81b5085887761e73cb7c836a1a6a972e837fb3df69b2ac70cfd6311d06d40656344ec35eb48e512f007561480f0345486ac2b329be0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
099b4ba2787e99b696fc61528100f83f

SHA1
06e1f8b7391e1d548e49a1022f6ce6e7aa61f292

SHA256
cdb1db488e260ed750edfe1c145850b57ee8ab819d75237a167e673116a33ee8

SHA512
4309375e10785564ceb03e0127ced414e366a5b833f16a60d796471d871b479e4c044db5268902d9dfd14715ca577cb26042bab8f7b0f31fe8abf33947feb9d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
61KB

MD5
7a7b9c4a8624adbb3645ef99ba374353

SHA1
2bd2d23ddd06ab143ffaa54f29fbfc45bc18982f

SHA256
ff913aed84077f232791314df22f4d3eb0ab4b08a3a6b2276405ede624a26404

SHA512
b6a9496466b7b9f6af46886c1b5b0c888b071039765ed25e9837d858fcc110f13136c1a3a53a1b69ec30dcea28bacebcdd2c232cb72148afd290d8a7e908bb79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
8dae8be6ebda8b5c12a81b0083438c17

SHA1
03793da7e475d64108c6ea74a86ae93aa036f514

SHA256
94b82af071c7b3b1beade1d2ad6c94bf17c03ebec4cd8918b3a4691d52b756ec

SHA512
5bfbd2ccd67af6e8ec60dabbef5959c962f3aeabd8f3ef63e21ecc5cb92f8930c41b373d8a71bd0b2c88d160320610df004a169290e88e707b2c7772b8c78e7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
db25c32c467c5215b36444a597031334

SHA1
48239084516273a509c337b31e9f49db451101a1

SHA256
febdfff6162f7ee41f9289f42cb4cc2bc26b9737fa7e52aa366108853348ff3a

SHA512
cf3ee58cdebe58b219d40dcab0d2d173a939ff1dd963a5a834c5158391abb34ab46be5c2d42d57b5b0ccd60a0cb2e4a7508459a3d986493ef979e490bd6f6d37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
1b4a320c00de0033c00232cedb32b549

SHA1
add161b321bf3c754923902012d92b3aa0b2b8e3

SHA256
2d9dcd40475480ecfb98d8f2be037b4054857c16e069e077fa536b1d2ded667e

SHA512
8af0ffd8fc804dd809b5d762251774492db06fc61c0da1667d0781616a8533e4c53102b771ad4de6d0ca0e08b0b4dc5d80b368c439a14c981abb16164db808e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
464467366dbbcfe97bae85b15fc62980

SHA1
a309c4d35566543fb45d7b10914517bdba5edb96

SHA256
85497c700600503f94fff85b2f027d876ccd00eb21a50ec2755db516387692ea

SHA512
a92a7bc6d2aaacc7642465debe987235875dd4e76653f463c579556a1e19763cff48f77b07251b1a771987b5bf51d72f8913189a73aacf45bb90da2da46201ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
5d752939db011585f306ea3708dae0a2

SHA1
7e47cda594e98dea654162f04b3ee2a37ffd93eb

SHA256
6da173a3646f4a54ba2d12fc17e2afd9f7b7a3798b969822b0e02a2edabd5115

SHA512
b0de6faa1c7d0f37ab44d1750ffcd4ce2bd7eafce417fe74cf7737e8365dfc26320577fec6e1b7566eb9cc7c9823ed7d8d4fc730d81d4fb88e285dff32f26124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cc39c82f8e2f8e56505516f2970c8f1f

SHA1
f3d6e0b6e45c8cd2c57302abb29e469fc5f0d8be

SHA256
901b58c309728d23b885e19fd425289e4977867daac8975792d106cc4d1cab9d

SHA512
738097795075b7124202b9e601d45a18311ad416117e8df11f5e9a28c5e08377c1442851c9e5a2e3b89a807d1a1b41224c6ccc9ea987c9ede2b3a2e9cd9bad48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
82a3fa35b93cadaf6534ac0804e879ff

SHA1
6e8ea488a982d427bc4745fe1e25d4c8040e5cd5

SHA256
4bd943369f91ab567f6bcef92f3722e3e4e70b4b49304ccd5e7b41f2aa4b62c7

SHA512
71831ca0a890f681ed75ee0a584e7c65bba0a70c9000a08ee29fe5e803f755b823dcde56d5919a77844481d269dde604724755f8d71a6b2fb8bf03cab66fa6ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
02ee7addc9e8a2d07af55556ebf0ff5c

SHA1
020161bb64ecb7c6e6886ccc055908984dc651d8

SHA256
552d3ed359b7a52278ce621674d16428d8a7969f6cd5663df18e240cce66aadc

SHA512
567989543c3848a0c3276d96b96ca761f750e4b71fb74f36d809f590ffe16a72fd5ece251737a8b1ffe65f0051e211bd7ad19d2b8b0b7ca1b7ffc86dd2a52883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
764171401348ad5de3288dcd51d9107d

SHA1
ff52e502ffb43c4967d00e142e50e76ee54dbc10

SHA256
815aaaadd785ce645975263bbcb91ec4f768560dceb50693ceef75196dfc9b7a

SHA512
e3794eb7fc1fbafb6c908857e249724b90f30a901db16cac3906b341ba9508ccd87ca03ab700ce3c560152f4fdc563b2fe4d9394555c9228880d978e54751c8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5700db.TMP

Filesize
1KB

MD5
e31d96e33a7cd1c66de8fe1bef8cf1fb

SHA1
bd6e512db2fcc396e049140760b850e479a6ef75

SHA256
75c6b7fd26e15a996b035e79fb5c3e2e73defc3a36e3297091039a17bcc73efc

SHA512
5265b4bcd8cf9df48f4474b2a70f5d8a416726ecbb3e45b366b8173d14a7425e38e6e0482517ae0836039cc8cc1aa99e0ca0ead1159a582fb710d55d4910ce75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
fd2a7b958e0c6557bf12179b3e3ceb94

SHA1
7e0bdcfdd8e561864ed1ad384398c9c4f6ee5797

SHA256
3e16eb2c6787aeb12b815675bfc367ec40c96522ce98a987384fb16d71dc1eb5

SHA512
731bb1cfd716bfc9de58f40aaac0f7b1216664978e89e1120b11e952296671dd51fe75f3a57d11330bf2c6674a8afff0ebe396830ab5b5e7eb870edcf2f21e37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ccc8eb94ecce0ce764db6739106d31a9

SHA1
9cf61223ab406d618f3d9bba3d29d4048d728928

SHA256
141874236cff2323762f57c921840e89807779b3ecf89a97262a0f5c9298c263

SHA512
1f23ee74aa2665f6e75cdf86d4869cd5c536ffef2231ad4d81d6183455b1a1d0ba66f34aa01fa11b5fe6fdf1cb1d12feb82f0c019425825706ef5992a4e0a421

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
e21fcf7257d12b8ceb0032b6ea8be1e0

SHA1
0a9314878f62630f1c3453ee193ea84969161b2b

SHA256
9099cf495105af222136cc92260a18564a30fe5871bbfbd8d5e732a3bd65fd41

SHA512
564ae35df4966020ba3ad05ea8af9ef10e252ac6591ef84809010b090440c647264ff195b51330d53d75198219611354beaccd4920df59f2dd2ff84f1ef30b99

Download Submit
memory/1128-154-0x00007FFB90AD0000-0x00007FFB90AD1000-memory.dmp

Filesize
4KB

Download