97d91d165fdc978b5b6a10e87b7f76c4b92f7815caacb23a537c0514abeeba7e

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2023 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

csrss.vmp.exe
Size

88KB
MD5

b911caae8fa815d93a6f2b7ba71db78c
SHA1

1a029bb0f62652613a80f772e4b6b84e78d6ad38
SHA256

97d91d165fdc978b5b6a10e87b7f76c4b92f7815caacb23a537c0514abeeba7e
SHA512

64bb34da08188f6a15658b87fb1786dc76c540bea44bfbba3ba796bef2c53538fd56b9d2bed42ce0f30664f7fdb52c40dc81adea46e74ce5300c9b8997f15130
SSDEEP

1536:s9VclN3BDdviAJ2uz1vh4vQVez6TrpfcDxHsTuTc4hPXTyPkzY8cZf/lHDm:sPYoAJZpN/pfctHKwnQOUf/N

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\34957f44-0af6-4210-b918-de5a57c56fa6.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230405124736.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1948	msedge.exe
1948	msedge.exe
5076	msedge.exe
5076	msedge.exe
3900	identity_helper.exe
3900	identity_helper.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

5076 msedge.exe
5076 msedge.exe
5076 msedge.exe
5076 msedge.exe
5076 msedge.exe
5076 msedge.exe
5076 msedge.exe
5076 msedge.exe
5076 msedge.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msedge.exe

pid process

5076 msedge.exe
5076 msedge.exe
5076 msedge.exe

pid	process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

pid	process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

csrss.vmp.exemsedge.exe

description	pid	process	target process
PID 4896 wrote to memory of 5076	4896	csrss.vmp.exe	msedge.exe
PID 4896 wrote to memory of 5076	4896	csrss.vmp.exe	msedge.exe
PID 5076 wrote to memory of 2712	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 2712	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4676	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 1948	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 1948	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 1424	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 1424	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 1424	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 1424	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 1424	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 1424	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 1424	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 1424	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 1424	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 1424	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 1424	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 1424	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 1424	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 1424	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 1424	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 1424	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 1424	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 1424	5076	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\csrss.vmp.exe
"C:\Users\Admin\AppData\Local\Temp\csrss.vmp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=csrss.vmp.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd244446f8,0x7ffd24444708,0x7ffd24444718
3⤵
PID:2712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9018911387758500729,3461154203231177247,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
3⤵
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,9018911387758500729,3461154203231177247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,9018911387758500729,3461154203231177247,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
3⤵
PID:1424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9018911387758500729,3461154203231177247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
3⤵
PID:928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9018911387758500729,3461154203231177247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
3⤵
PID:1772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9018911387758500729,3461154203231177247,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
3⤵
PID:2604

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9018911387758500729,3461154203231177247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
3⤵
PID:1580

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
3⤵
- Drops file in Program Files directory
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff69dda5460,0x7ff69dda5470,0x7ff69dda5480
4⤵
PID:1484

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9018911387758500729,3461154203231177247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9018911387758500729,3461154203231177247,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
3⤵
PID:3880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9018911387758500729,3461154203231177247,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
3⤵
PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9018911387758500729,3461154203231177247,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
3⤵
PID:3516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9018911387758500729,3461154203231177247,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
3⤵
PID:3636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9018911387758500729,3461154203231177247,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
3⤵
PID:3836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9018911387758500729,3461154203231177247,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
3⤵
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9018911387758500729,3461154203231177247,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5664 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=csrss.vmp.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
PID:944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd244446f8,0x7ffd24444708,0x7ffd24444718
3⤵
PID:964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4276

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
5a10efe23009825eadc90c37a38d9401

SHA1
fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

SHA256
05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

SHA512
89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4c7eb8599cb69ab9c2c93109119c1546

SHA1
ceb70768ad5f085994636ccfac0e123a0e9b66bd

SHA256
386fbed2ec27163dd16df71e9d04b30581431b75e43673ec879bf08740587642

SHA512
b5e758bb90e9adebff06f6189925acfb1a5dda3dc4c6f744ae8d8c9d708541f16abd630127d9a3c249115c4dabbeba432f39ee6b03e530632a0f3826193f5bc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
336B

MD5
3a4934e4a351ab567cb17bfc2595c33c

SHA1
740295f69d206f18e639cdbd8ce76a11ce8396eb

SHA256
2885ac54091a6a19955775947e8b4f3632a7e8913ac171f3bbef5da28b9faeab

SHA512
02a9c464e36a6b33da7fcf4773bd6d0470213c388f7d923d2a10b51d37e92a8afeac38004e5c932a0f57b6a7ffe8b98a305ecf5c2a93c0127bace8e3ab8e1fe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe571414.TMP
Filesize
48B

MD5
98d8df24b1c3acf26f9c53ee6192310d

SHA1
ce47d3b3515b9c854dd5b89ad892bdde36be3672

SHA256
89fb8b5649a1edaf4d009081d2c1bd18b51fcc575970d97c4675103e3c05b3d2

SHA512
746c101f8956020373ca136d458a852be9a4c07b8c8d047503eb5f09b7160e00ebe299be6028e3ac0c8fa5769b331aee2b4df3f4c4c609cf7ca439633a6261d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
Filesize
2KB

MD5
730f6208ccfb335641b2b827033a7352

SHA1
823795d3d87309fa126784c7a55021a49cb0065f

SHA256
169f3e2d784cf15be2c0b3e0164a84c340b72acf94fa79df58a3761e243287c2

SHA512
36af3952b256844fc4f3f235f338a09fa7fcd000de1fd0603aee5306f6ad010500d792221313f066837b8440b05ba77adfdc1e13aa3b6f9e37025d2d2b6ac5ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
566B

MD5
381ac45cdf7aedc98e646056ccde4a8d

SHA1
168e192b23a595e9f41cf8d107d6c1d601c3ca77

SHA256
9f056538358e029a4a7f13bab71dec7dcec6a9ac69b95c766a887849faf49e84

SHA512
98ab242ae61cbeefe9816b68044a15f7118e2576c6e559fb1fb801cc405d4c81310183c6c6a31ab46791a1477d0f61ce113d98311f9858619e91a03935e8a4ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
4KB

MD5
2390714a41436a59d8ec53f6741d1105

SHA1
b231356e00cf47891b648dd79e978d620b50561d

SHA256
2f44d496cc0d90748347a7bb18ec92bba4bf0dc72a6ddf4885b44fb9a0e7b855

SHA512
84db64258d41e0c9420528868b146a8822d782b4fa888f2ad08699f2e58a2205ad3148e6bb00acb532138c9df471b9618089a60ab8daae999c7493cc3eadfd76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
fe952669fded9fea6ff27e41d576de52

SHA1
8858300462a4771b2bc026e94060b49e1f382a8f

SHA256
6d5d9958fe8b7e47ebad6ada14061fa4307e30cec7fdb6d554dc6ed0e3c495b0

SHA512
34739fac268593160dbee157a1a2afa05006051d02f31895e9a8aabd69af8191bd5a2f5bb416cedb738623636c99488e47556b689d0397c42e4cb4740fd6510b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
2ef9ee8b474b4fdba698d7c4aa399c14

SHA1
503865fdeecf8235053c7d1ab66d0baf07c7bd3d

SHA256
b647cc99556b77b94e4db2c1a5bf5af887d63905c2a45fc406825d42ed932cbe

SHA512
09fb138e7f76a1a040550c66ce654b2291a806439989145c7fdc2eaadfbf3e7a9b87dece77feea6682f445a0b28367ac632b9af02c9b297454f35d6ff25b1913

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
5edab6d3ffbeee247ccb4423f929a323

SHA1
a4ad201d149d59392a2a3163bd86ee900e20f3d9

SHA256
460cddb95ea1d9bc8d95d295dd051b49a1436437a91ddec5f131235b2d516933

SHA512
263fa99f03ea1ef381ca19f10fbe0362c1f9c129502dc6b730b076cafcf34b40a70ee8a0ee9446ec9c89c3a2d9855450609ec0f8cf9d0a1b2aebdd12be58d38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
538B

MD5
4dc88157aa269f865233ec1940103ffd

SHA1
9121fbc52c2c18845fea89c353cfedebff014e0c

SHA256
55307d5334b525b25dbd73ff99aa066b1b1bcd05106249943d3a68cc3e452052

SHA512
28255d796a99b05660d234a09fedaba1f6a9a1915be767294b1b930f7420378c30f64c3ab14abe41252dd8a1acf8ecd1dc91727096a9fa21f68b05c9d5e167f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe56f050.TMP
Filesize
538B

MD5
4dd38487be0ee013e7e2bd880b18cd85

SHA1
d30f88b71696a8b47ae7257780be1dc263a65b6c

SHA256
62240ffc08e6b8fc8b168340734ca66d7fd2ca1306ffcd999ac97870aae28ace

SHA512
035c2517b33e641012013ea1332c3828a66ecb9fa5eb929b6ccb770b204dd632f872e14ada74e580fd893ff4811d48a9ae9aa1cfca5461b335da328c33466dbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
3e62e87f7c37ca25a6982b7900c46d5f

SHA1
7ca2cdb7b8fe5a785ff5a8eddd5c958c52a91864

SHA256
503ad35bb87149853636a71f19ac7fdd1c945059722ea7c39b8c5a125aa07a6d

SHA512
e07a13d387bfd75539b862a65e78cee7a35fe05bceba12a6ae248f205299cf96c43cb4f907f60e86e83f83085f23b07451018ea7f863fc4344c16bfc31541baf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
87c8ff6a555eadf46218ca663c838085

SHA1
8e38086a08ca6778bb1aa1f6f0eeea4d690d9942

SHA256
50c7726e5f3a77a5ad48750e1b0981e25dbdc9d9bcb307b05f0bd85dd06eab75

SHA512
97e7f02428cf9627563f2cde82eea8eaf5671ec3dfd2c51a24a0dd04eaf0cd345b42085ba92079456e27f72626f296d74298bac4ddf2a68a3e73c9f28ad12c4f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
3KB

MD5
ce73e628ab3cc14bb5e4a1de1d1c53f0

SHA1
5544b0ee5fed144e00bdd1e616b6eb80b43d720a

SHA256
f088535a545272852e4f2f8b20df7d20b02088aaed7c1c7d79ac4bceab0956df

SHA512
fe0e98e4cc11298bd56c6f5e07c8f99051920de1005c31c7c1dcd5eec7008abea4d8051766c44ccabff2f004a0ec03a2f4ed72464d6db3915f328a079eda2841

Download Submit
\??\pipe\LOCAL\crashpad_5076_ELUOETVFGUYQOUHM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit