31f5887478a9f227054a2e38392510cbf2d5e421fcba9135d863fe189278476d

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2023, 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31f5887478a9f227054a2e38392510cbf2d5e421fcba9135d863fe189278476d.exe
Size

790KB
MD5

62baa11a70073bbaee2354d661f263a4
SHA1

f6d087c415e42fe7dd1c50749f181c258f6088f1
SHA256

31f5887478a9f227054a2e38392510cbf2d5e421fcba9135d863fe189278476d
SHA512

d5eaf49b2273f0f748b132ebca50dc925fefa9c7b81924e35cb3219d57d4a10b72bfda94918b2b33c511dc83d823f82a244e7f1754305f6fcb6bc711866571cb
SSDEEP

12288:6tvs2ttd1PuZUiMqylDxljISy1G41To6lG4/ehhWXoq:6tvs2ttd1WSiDyxxJTy44Zo6lG4Wh6oq

Score

8^/10

discovery

Malware Config

Signatures

Contacts a large (893) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230308020921.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\e17b1574-1859-4ae1-88bd-211b920748bd.tmp	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
376	msedge.exe
376	msedge.exe
1980	msedge.exe
1980	msedge.exe
4408	identity_helper.exe
4408	identity_helper.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1512	31f5887478a9f227054a2e38392510cbf2d5e421fcba9135d863fe189278476d.exe
1512	31f5887478a9f227054a2e38392510cbf2d5e421fcba9135d863fe189278476d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1980	1512	31f5887478a9f227054a2e38392510cbf2d5e421fcba9135d863fe189278476d.exe	91
PID 1512 wrote to memory of 1980	1512	31f5887478a9f227054a2e38392510cbf2d5e421fcba9135d863fe189278476d.exe	91
PID 1980 wrote to memory of 5116	1980	msedge.exe	92
PID 1980 wrote to memory of 5116	1980	msedge.exe	92
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 1540	1980	msedge.exe	93
PID 1980 wrote to memory of 376	1980	msedge.exe	94
PID 1980 wrote to memory of 376	1980	msedge.exe	94
PID 1980 wrote to memory of 2212	1980	msedge.exe	95
PID 1980 wrote to memory of 2212	1980	msedge.exe	95
PID 1980 wrote to memory of 2212	1980	msedge.exe	95
PID 1980 wrote to memory of 2212	1980	msedge.exe	95
PID 1980 wrote to memory of 2212	1980	msedge.exe	95
PID 1980 wrote to memory of 2212	1980	msedge.exe	95
PID 1980 wrote to memory of 2212	1980	msedge.exe	95
PID 1980 wrote to memory of 2212	1980	msedge.exe	95
PID 1980 wrote to memory of 2212	1980	msedge.exe	95
PID 1980 wrote to memory of 2212	1980	msedge.exe	95
PID 1980 wrote to memory of 2212	1980	msedge.exe	95
PID 1980 wrote to memory of 2212	1980	msedge.exe	95
PID 1980 wrote to memory of 2212	1980	msedge.exe	95
PID 1980 wrote to memory of 2212	1980	msedge.exe	95
PID 1980 wrote to memory of 2212	1980	msedge.exe	95
PID 1980 wrote to memory of 2212	1980	msedge.exe	95
PID 1980 wrote to memory of 2212	1980	msedge.exe	95
PID 1980 wrote to memory of 2212	1980	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\31f5887478a9f227054a2e38392510cbf2d5e421fcba9135d863fe189278476d.exe
"C:\Users\Admin\AppData\Local\Temp\31f5887478a9f227054a2e38392510cbf2d5e421fcba9135d863fe189278476d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.oneptp.com/ax/?uid=507801&ad=14
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd834e46f8,0x7ffd834e4708,0x7ffd834e4718
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,8229217103168437765,5752921644560841855,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,8229217103168437765,5752921644560841855,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,8229217103168437765,5752921644560841855,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
    3⤵
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8229217103168437765,5752921644560841855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8229217103168437765,5752921644560841855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:1
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8229217103168437765,5752921644560841855,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8229217103168437765,5752921644560841855,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,8229217103168437765,5752921644560841855,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6968 /prefetch:8
    3⤵
    PID:4268
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff63fa55460,0x7ff63fa55470,0x7ff63fa55480
      4⤵
      PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,8229217103168437765,5752921644560841855,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6968 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8229217103168437765,5752921644560841855,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7380 /prefetch:1
    3⤵
    PID:1452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8229217103168437765,5752921644560841855,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:1
    3⤵
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8229217103168437765,5752921644560841855,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8229217103168437765,5752921644560841855,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
    3⤵
    PID:5356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8229217103168437765,5752921644560841855,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
    3⤵
    PID:5652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8229217103168437765,5752921644560841855,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
    3⤵
    PID:5760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8229217103168437765,5752921644560841855,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:1
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,8229217103168437765,5752921644560841855,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3224 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\11d11724-322a-48c2-bd3b-f4b1a20b22ca.tmp

Filesize
12KB

MD5
05de1bbe6fa0224520fb08995c4ca061

SHA1
3214568e0596ccf7cf8c663bb0349f1e8284fb28

SHA256
0d0ec4b9855056deb1c0f39af5d7b85cf6c2d2fbdc4240644c4b4d77121d03cc

SHA512
0e3e6b4ae640e59ec0902b51d92b868a7c7a93cab5ef351a1646141d9802c1a75fdddd58ae70b248c36e1c77aee16fbcfb5adacf8c91b452ab59dbca81c25fbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0820611471c1bb55fa7be7430c7c6329

SHA1
5ce7a9712722684223aced2522764c1e3a43fbb9

SHA256
f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75

SHA512
77ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
425e83cc5a7b1f8edfbec7d986058b01

SHA1
432a90a25e714c618ff30631d9fdbe3606b0d0df

SHA256
060a2e5f65b8f3b79a8d4a0c54b877cfe032f558beb0888d6f810aaeef8579bd

SHA512
4bf074de60e7849ade26119ef778fe67ea47691efff45f3d5e0b25de2d06fcc6f95a2cfcdbed85759a5c078bb371fe57de725babda2f44290b4dc42d7b6001af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
5a7ef0aad3f75b4c91263708cd8cd9c2

SHA1
30c3d111de6e3b8d2dc41867626292ac29ed6647

SHA256
4a40fe90e629c37180d572fa6cdf013a446d982fb2f30b0b3493dd64e95a6979

SHA512
3d475df2154bda26be5294092e3542f796b48703d5023f95c2f29870cbf9844c54a2f5504bc58cabca16d2ed1e65c4a4eb4a3ea0be4dbc3fb294bdcdad1a954f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe576cb4.TMP

Filesize
48B

MD5
20fd7faf0aa2fe4c713fedeb95e8359e

SHA1
f3eafec49633f3acb34d22399032b6b4fb2e7c10

SHA256
088c74d60b04344712e511a5a770017303c0ac463686107ea37676ea4eb994f7

SHA512
0c7b2f89781a51cedfd9e9825cc002597cebe5b4540d8f2cd7f5be8fc7d0a79b292df5323c02f5e1c8e6c15135c8cba37a52279f45d979392b1dffcd0d7de706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
99029036c2047c4f61c99442544c64f7

SHA1
8a1f54575ec0b528ad7eb2cdc1af22c9563ab230

SHA256
1efe24a26e95953688f0d7613930f801f8cc3fc685b3e660c196cb7b7b5198dc

SHA512
8ecc4a756bebfba57a39124f2f9ffab13197c91bb8e5b56b5286422166ed2f5a35a345ccb240abebd91bbfe21a8799fff1da54b1d5ab9ca772c3dd5cfa94c19b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
05d1f374921f279a627cc658877889ae

SHA1
0c3227eb9e75e35df5e2a8d2402453f462fad0d9

SHA256
ee98d0e4377c5c3fc1672ed7c18d327893671ba8508f3eb92911d5ea926bf2df

SHA512
eac8752c6f6f75fed2d578bd19d9aeaba5c9b3a632df10a72a1c77c39b8a1604820730d10c460530e1dc7a61d54d180130a5ec21c68154ecc98ec7f579384bde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
799f0b75db473d3c8cf8ca15cb4d97dd

SHA1
fc5733c28664696c18ed7ddb62568d5dc7739235

SHA256
091d5db9ec975dc262d117e7027a32890e90ad4e50d635b954b3f47f67efa8ba

SHA512
588f732e6926d229c06ee6a68993f72da0d7b2242f1822558db6b3a2f060e3957c5e06e92c4c838bcde917560b72d26caf21e86c0dbaa4c99a1ac44c7bc3af23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
937f78d91458e86a48eb5e3454b31fcf

SHA1
9c87a85200c78e4751fe68ce43378309c150c4b5

SHA256
bf097404d43a77f2605c4aac57a783b738e2787ef77e8f85c55547bd35b5ef05

SHA512
651b691bce3114bd62df5f72de05f947481011f673a4a11146978514220ed608606891159f2f1333baec886822815e236425b47f1908690dfbeb68c38aa7c932

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bdc68ca98efa5aeff6a82fa8be7ddf56

SHA1
246f5d5ec830006f729cd3fff4cba00cfa3eb175

SHA256
3a88353a06119c32f76428096d80212e655033d5693a6a0edee143b1073172bd

SHA512
2957574788c70975b7961546863d7484d7d318a612847aa302605440ffa0052169fdb4b64084d5017ccda6178008d02a0ee5727d3baf4fbdcba87487231b2622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d53ac35ab3976e67caeed75c4d44ffc1

SHA1
c139ab66d75dc06f98ada34b5baf4d5693266176

SHA256
647867c7236bcb78b7d585b476d82a101a077fac43c78dc59e612253fbf69437

SHA512
391355c71734ded913239a6db10a3202087e756bccc8e29411108f21b3f2460d9a9c606619aadd785285be70eddcf61ef9519441cd387cd3823c1399a6967cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
708B

MD5
7f3e544a6000d8e532a06fa470a5350c

SHA1
0febf8f99f2cd728806178c04806ec4c14e568ed

SHA256
f1086b719dfc82ea479143dd85f2978159b26b6370e71eb33b87d72d7ded59e6

SHA512
36d499c0aabf677fc83901a82129197073c91b78d18aa7a2e38792d295e394c4171466b5324486411a990579188632ffe3adff902aa9eb1e559e78d77a87cd22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe573ba1.TMP

Filesize
540B

MD5
60ee0a61c2c4d092ded83eb27610b974

SHA1
06401799e2d8e8494b3476af590858033fb9333d

SHA256
c4bc35d76165928c2c783decca5f7dde7d0a531277fbde94a4cc3ef410f43a23

SHA512
75622c062b577f3e64e4ebfcebec520d48bcd15b85ed9dfcfa3ec26d89792fd3c296c7eb934dd6818e35c7032e58a562d3c8e8a39103b13e4102584a38b987ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
64eece093f084822985cb19926931c3f

SHA1
14593b556d10c2ddda3038f57a55cafc0bdecf80

SHA256
5be6addcdaaa8ba4a2b1fd1bf6e38cc7066131c7036a468d791f62dd74a4dedb

SHA512
b4f7247f7ca05899fb941c9ada753759840436d1cc0ab072ff8aa5420a0895300256f6c9290d5de4709a85136d32f99c89849f65937e48ebdadb38e5bb4739e4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
5a519f9002337c65c4794e13efdd4b9a

SHA1
3e3a15d0300ef49f846ba303b98a1db5d78e50fa

SHA256
9d9f717c2fd16345be040c3e2153dd7515ad00369132824e374f31dd4db89e61

SHA512
22c6da0a88a348fcf2e75013b7ef4309b5101f7d1014a7a64b30743118c3439348cfa2b4ea25b937045ee11c4bfbf90c21d5c039595c6d5a639d3a5ae663a1f7

Download Submit
memory/1540-156-0x00007FFDA0450000-0x00007FFDA0451000-memory.dmp

Filesize
4KB

Download