c3783943d3d8f30412d2dad4763254310ca19c9f0ec89645238d241365367cef

Analysis

max time kernel
136s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2023, 04:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58856027edfc0c76d0fe84236f4ad2de.doc
Size

117KB
MD5

56205a4bd00dbbfb132c03f9cc56a494
SHA1

d92161f1ab1b465d88bb6c0279e119d419f42e52
SHA256

c3783943d3d8f30412d2dad4763254310ca19c9f0ec89645238d241365367cef
SHA512

0272eba313a8e978c4c163ee368e1fb243c7869784e57496314a10192e94230b583412e61048c0548140131bc4d13b41691da5f5d48ac609c742d414cf09fd8d
SSDEEP

768:Lag+I2XklB1W8gQgTMu1dFkE4qXAKv6RFryV0q0lc2PrdzKzbAyzXz0wzNzu0wsN:2Fx/6zqGlccGrLlZ07hZJ

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	1048	2184	msedge.exe	81

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2184	WINWORD.EXE
2184	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1756	msedge.exe
1756	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2184	WINWORD.EXE
2184	WINWORD.EXE
2184	WINWORD.EXE
2184	WINWORD.EXE
2184	WINWORD.EXE
2184	WINWORD.EXE
2184	WINWORD.EXE
2184	WINWORD.EXE
2184	WINWORD.EXE
2184	WINWORD.EXE
2184	WINWORD.EXE
2184	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1048	2184	WINWORD.EXE	92
PID 2184 wrote to memory of 1048	2184	WINWORD.EXE	92
PID 1048 wrote to memory of 1304	1048	msedge.exe	93
PID 1048 wrote to memory of 1304	1048	msedge.exe	93
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 2000	1048	msedge.exe	95
PID 1048 wrote to memory of 1756	1048	msedge.exe	94
PID 1048 wrote to memory of 1756	1048	msedge.exe	94
PID 1048 wrote to memory of 2732	1048	msedge.exe	97
PID 1048 wrote to memory of 2732	1048	msedge.exe	97
PID 1048 wrote to memory of 2732	1048	msedge.exe	97
PID 1048 wrote to memory of 2732	1048	msedge.exe	97
PID 1048 wrote to memory of 2732	1048	msedge.exe	97
PID 1048 wrote to memory of 2732	1048	msedge.exe	97
PID 1048 wrote to memory of 2732	1048	msedge.exe	97
PID 1048 wrote to memory of 2732	1048	msedge.exe	97
PID 1048 wrote to memory of 2732	1048	msedge.exe	97
PID 1048 wrote to memory of 2732	1048	msedge.exe	97
PID 1048 wrote to memory of 2732	1048	msedge.exe	97
PID 1048 wrote to memory of 2732	1048	msedge.exe	97
PID 1048 wrote to memory of 2732	1048	msedge.exe	97
PID 1048 wrote to memory of 2732	1048	msedge.exe	97
PID 1048 wrote to memory of 2732	1048	msedge.exe	97
PID 1048 wrote to memory of 2732	1048	msedge.exe	97
PID 1048 wrote to memory of 2732	1048	msedge.exe	97
PID 1048 wrote to memory of 2732	1048	msedge.exe	97

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\58856027edfc0c76d0fe84236f4ad2de.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?LinkId=614981
  2⤵
  - Process spawned unexpected child process
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc1c0846f8,0x7ffc1c084708,0x7ffc1c084718
    3⤵
    PID:1304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,14046578513926489510,10109411705657085457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14046578513926489510,10109411705657085457,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,14046578513926489510,10109411705657085457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14046578513926489510,10109411705657085457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14046578513926489510,10109411705657085457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14046578513926489510,10109411705657085457,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:2944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14046578513926489510,10109411705657085457,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
    3⤵
    PID:3348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868

Filesize
471B

MD5
1d50b1280fadfff88426e924fc0d5239

SHA1
09d8ed135eff4cb65ab595dc9400d4a9a0b9324a

SHA256
c752248a6b8c4675d205e4a0f1293550c7e5c407b3b200cb843f74fd970eda41

SHA512
b3eb3fff5224bd2623920427df9c3f697fcff6347f5ae8fdb4ee5314bbfda43349f7bba8dc2eeda21c7f80be35297f8e6c9461128ee64d6f0f1bc0dbd791532a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868

Filesize
442B

MD5
d3e9570952c659d1db708e7ba8dd6ab5

SHA1
36d9ef2b127b6203eb6e166f89c1e5567151b23f

SHA256
1f78cac2e4041b37e32b9673cdd42998d994182e34bdf2b7669bc766b7694822

SHA512
f4589a427d8218ca921e4c13a7202294e2c74266c2f430c81729864ade43460b0c726491e85a5f827f5d9ea04cfe8bc5a956b8ce9b0f984250aca9cedfddb5ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
462f3c1360a4b5e319363930bc4806f6

SHA1
9ba5e43d833c284b89519423f6b6dab5a859a8d0

SHA256
fec64069c72a8d223ed89a816501b3950f5e4f5dd88f289a923c5f961d259f85

SHA512
5584ef75dfb8a1907c071a194fa78f56d10d1555948dffb8afcacaaa2645fd9d842a923437d0e94fad1d1919dcef5b25bf065863405c8d2a28216df27c87a417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d2642245b1e4572ba7d7cd13a0675bb8

SHA1
96456510884685146d3fa2e19202fd2035d64833

SHA256
3763676934b31fe2e3078256adb25b01fdf899db6616b6b41dff3062b68e20a1

SHA512
99e35f5eefc1e654ecfcf0493ccc02475ca679d3527293f35c3adea66879e21575ab037bec77775915ec42ac53e30416c3928bc3c57910ce02f3addd880392e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
ec1f49ec82df5f58c3c5df63eb198410

SHA1
4f356b7aebc66da99ce0178c179919182e377944

SHA256
de32dc3a49b18cc1495b65130248061790fe62c8b1d5a259b634f02432475b1b

SHA512
fcea3f206283befd7cfe08917611b3ff722a5e8a2e0b21e07618038fae71cbc35c30f103cab0d784ee12fa7d57e4b30ebd509d99fa4cf40faef4dadd50df767a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5735b6.TMP

Filesize
48B

MD5
d74f2acbc3db8bdb977b6ad164e1f2d3

SHA1
75415298589a8662102dbc045416796ae2cec451

SHA256
241dbe38035643263d06bd49a0b92d93542a8ad1b81b9a04ff7455074bd83b9d

SHA512
061af509b3a5067477a6f8f77b07873fb89d7246b3058c8e17f4da6bab37bce5a09ec7b11fb4ee792b3cff5c70eb597f3d946680c50f05eb94454f9fa2a6010d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
a9e0254d47f2fed49d3e764c19a9d0e8

SHA1
bd5041e6b54da442b48c010e0a85d5aad40e97ae

SHA256
3be4c0a5ecb4e3073835eaa8265cfbfa33d8b426d3856bae41cc1b96c013e534

SHA512
8d010333f1112089dce6148cc0b56730d0ec9279ed5e0a72d0b55dace8d71070a90e6f133fc10425bdfdcbaab0a495aaa24465685afdc1213a76e97a86c80c04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
951B

MD5
e5b14d9d8990cc4df267992fadaa0aec

SHA1
11a144d9e212e3664ed5fac0198e1d8f32ffc1d8

SHA256
a81743b7e3e4beeaaf28c19fddd6c398d8900947e5f90cd710079498a147d83d

SHA512
b6493cd487168d20bee0416ad9a3bb6b7a82ec724157ca2516ad205acc7cec0eb40b7f4934c78d85740a30b44470fd63388c7829b745131162d71d1b9feb223e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
076d1606c24bf0ef8266aa8b75a9f655

SHA1
eb928d7dd7beb993561e50ac84e64df84560acda

SHA256
d145533d1f65f6f03f0c27df81fb1211df1cfe2bcd2d313df24d55cea3cfa1e5

SHA512
c2f1cd1f9617e0e47e19b50d600f6bdbbb4a93906fa1a263599fc3501632a88d89f086a9dcb73880c0725cc3d3eb4d5627b8ef879662027b60a76513b580bcaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
821717bd2a6c5e94dd7c74c7096ffebe

SHA1
df973f4ddd5578abed622b8e2d1767d6d8d8eeaf

SHA256
ba3bea9ab859c4725984a0748cdb17f1e3a0d83150edf18a28f234253a1ecd80

SHA512
622917e3beb27fccc365af716cab63cb89f273b4283844578369c765165a743fd38cd777e5ade2e76d25e508a2f16c73ed9326b531cceeb2aef72d42a37a3352

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
945dc19d27eae064a025fba5c627b4b2

SHA1
2a49253adbcb1696bd12e973f8830eb8a41d9bcc

SHA256
99b6168866ab08089da33a7aa6fef7ac31324c387e9ede764ac81be9b29d3cfd

SHA512
db69c33c2180d6aa45dd93e79a9062dbf4720064efc2f9feb0128feef264faaec28d632e988b1b8b168283704e5650de942abb12f391a17ff30eb9eb106d730e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
130644a5f79b27202a13879460f2c31a

SHA1
29e213847a017531e849139c7449bce6b39cb2fa

SHA256
1306a93179e1eaf354d9daa6043ae8ffb37b76a1d1396e7b8df671485582bcd1

SHA512
fbc8606bf988cf0a6dea28c16d4394c9b1e47f6b68256132b5c85caf1ec7b516c0e3d33034db275adf267d5a84af2854f50bd38a9ed5e86eb392144c63252e01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
d65fede80426dabed98e2acb4717231f

SHA1
c87c410040a7433bc629f21b476cd4bdf526e137

SHA256
7c7f0a4a42b2d782b5356f163c43d8f69730b7cbb3fea93431798daa0cc941f8

SHA512
31f8ce563d6574279403458a5680832aa46a4756456cbbb95f8b6a1ca12a1ec48c51f30732903e46e6ddaa32fe2cda0989d97cc542cce756358c5a91ef141aa1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Bibliography\Style\APASixthEditionOfficeOnline.xsl

Filesize
325KB

MD5
58aafddc9c9fc6a422c6b29e8c4fcca3

SHA1
1a83a0297fe83d91950b71114f06ce42f4978316

SHA256
9095fe60c9f5a135dfc22b23082574fbf2f223bd3551e75456f57787abc5797b

SHA512
1ebb116bae9fe02ca942366c8e55d479743abb549965f4f4302e27a21b28cdf8b75c8730508f045ba4954a5aa0b7eb593ee88226de3c94bf4e821dbe4513118a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/2184-134-0x00007FFC07B10000-0x00007FFC07B20000-memory.dmp

Filesize
64KB

Download
memory/2184-136-0x00007FFC07B10000-0x00007FFC07B20000-memory.dmp

Filesize
64KB

Download
memory/2184-135-0x00007FFC07B10000-0x00007FFC07B20000-memory.dmp

Filesize
64KB

Download
memory/2184-137-0x00007FFC07B10000-0x00007FFC07B20000-memory.dmp

Filesize
64KB

Download
memory/2184-139-0x00007FFC051B0000-0x00007FFC051C0000-memory.dmp

Filesize
64KB

Download
memory/2184-138-0x00007FFC051B0000-0x00007FFC051C0000-memory.dmp

Filesize
64KB

Download
memory/2184-133-0x00007FFC07B10000-0x00007FFC07B20000-memory.dmp

Filesize
64KB

Download