b26071ffb729b8cad52d3555a4c95e57df34159fbe2f084cd5efcd3ae26b37a9

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2023, 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

crackSOTF/OnlineFix.url
Size

46B
MD5

59bf167dc52a52f6e45f418f8c73ffa1
SHA1

fa006950a6a971e89d4a1c23070d458a30463999
SHA256

3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
SHA512

00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230530022737.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4003d057-00dd-492c-bbaf-c78be8fc1eac.tmp	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
2516	msedge.exe
2516	msedge.exe
4844	identity_helper.exe
4844	identity_helper.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 2516	1000	rundll32.exe	82
PID 1000 wrote to memory of 2516	1000	rundll32.exe	82
PID 2516 wrote to memory of 4056	2516	msedge.exe	84
PID 2516 wrote to memory of 4056	2516	msedge.exe	84
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 3532	2516	msedge.exe	85
PID 2516 wrote to memory of 1264	2516	msedge.exe	86
PID 2516 wrote to memory of 1264	2516	msedge.exe	86
PID 2516 wrote to memory of 1660	2516	msedge.exe	87
PID 2516 wrote to memory of 1660	2516	msedge.exe	87
PID 2516 wrote to memory of 1660	2516	msedge.exe	87
PID 2516 wrote to memory of 1660	2516	msedge.exe	87
PID 2516 wrote to memory of 1660	2516	msedge.exe	87
PID 2516 wrote to memory of 1660	2516	msedge.exe	87
PID 2516 wrote to memory of 1660	2516	msedge.exe	87
PID 2516 wrote to memory of 1660	2516	msedge.exe	87
PID 2516 wrote to memory of 1660	2516	msedge.exe	87
PID 2516 wrote to memory of 1660	2516	msedge.exe	87
PID 2516 wrote to memory of 1660	2516	msedge.exe	87
PID 2516 wrote to memory of 1660	2516	msedge.exe	87
PID 2516 wrote to memory of 1660	2516	msedge.exe	87
PID 2516 wrote to memory of 1660	2516	msedge.exe	87
PID 2516 wrote to memory of 1660	2516	msedge.exe	87
PID 2516 wrote to memory of 1660	2516	msedge.exe	87
PID 2516 wrote to memory of 1660	2516	msedge.exe	87
PID 2516 wrote to memory of 1660	2516	msedge.exe	87

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\crackSOTF\OnlineFix.url
1⤵
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://online-fix.me/
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ffa4beb46f8,0x7ffa4beb4708,0x7ffa4beb4718
    3⤵
    PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1476,8619522532170059825,2460479717520082812,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1476,8619522532170059825,2460479717520082812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1476,8619522532170059825,2460479717520082812,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 /prefetch:8
    3⤵
    PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,8619522532170059825,2460479717520082812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,8619522532170059825,2460479717520082812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:1340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,8619522532170059825,2460479717520082812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,8619522532170059825,2460479717520082812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
    3⤵
    PID:2748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,8619522532170059825,2460479717520082812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,8619522532170059825,2460479717520082812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,8619522532170059825,2460479717520082812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,8619522532170059825,2460479717520082812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:1
    3⤵
    PID:388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1476,8619522532170059825,2460479717520082812,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6824 /prefetch:8
    3⤵
    PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,8619522532170059825,2460479717520082812,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5692 /prefetch:8
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,8619522532170059825,2460479717520082812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7124 /prefetch:1
    3⤵
    PID:636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,8619522532170059825,2460479717520082812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7108 /prefetch:1
    3⤵
    PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1476,8619522532170059825,2460479717520082812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7548 /prefetch:8
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:3584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff66dbf5460,0x7ff66dbf5470,0x7ff66dbf5480
      4⤵
      PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1476,8619522532170059825,2460479717520082812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7548 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,8619522532170059825,2460479717520082812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7352 /prefetch:1
    3⤵
    PID:616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,8619522532170059825,2460479717520082812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7384 /prefetch:1
    3⤵
    PID:852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1476,8619522532170059825,2460479717520082812,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=212 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3880

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x37c 0x380
1⤵
PID:1684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a10efe23009825eadc90c37a38d9401

SHA1
fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

SHA256
05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

SHA512
89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e8fc1667882ca34f16f9ab437404c0ca

SHA1
6b799094ebce71ec2d08534ceaa457839fac1eaf

SHA256
81e584fdd85de1816a538aa71b22d965f46a6f146e3188d90b57d8d216d2e51a

SHA512
e9eb818ef38ee56693dacc13f56c128c6cc6719690587f6b7fd5bde6cc5b5057461097ccad07cbfb1f58a68a96701603b269a86d8249ea6e6f1b4f910d21d555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
96B

MD5
fbc37d2b7ff08847a702a1f8b2b8a777

SHA1
ee4a4f9a87b88d0c34732382745e4f03f110a521

SHA256
6d62cb2a51c15e37b21009db331c6789b976ab74dc72936e6540c6a1453d06b0

SHA512
5f5b5a40f5a725fffd5ba0efd0f855bff819440303c7d266ecbeba7a3b51f488da206f81dde07374c2c770f193a77368c7d8a1b2ebc9388784de8ff2718a1c6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
344de1e49e14368325af329f312d5efd

SHA1
8c01025d7719a2de2475441d17e21c6f01131319

SHA256
1f789124a9137ad21d795b37a6b52585dbce6af68d1531d0179219ae089f40e0

SHA512
a5cf6ca9e549d0e4ee7edc576daa9ee1ea0d110520ad0b7d4f86954354c75bd30508980f2c1f19d0d7e13acd5d7d22da4e7d56dddfc8343a71c82ac5cc9e5c26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
19793e45e75ee3fc9cd1183b11107d15

SHA1
a68cbc6b48a3676d8d6df53404b2a10773e15d8e

SHA256
f7376244fa77432b97aa3f759c7305736aaab666eee709fbe4dd4233c97d33c5

SHA512
edf09474933167ffb7e57dc6e72666234da2b87a10fcc829e80cb77651d6535e304ff63565a7ed7028eae8dc5ecbfd4e9d7ad3e81f2d0379369d9ac120962a59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
45f2c9dc5f56fb2106293f718e577675

SHA1
803795535c7a0b454543c050e812ce3d5b5460c7

SHA256
9689e2e3b1c4f4e07a9cb152dcda393139b876f153852b16d5ee862bb3faa559

SHA512
242b71bcff850263bd09854fbf30d883e90057a811a4e7595226037bbb66bc1da87964fd409397df99f56328223d81aba63f82243a0bab8d5727a391a4cb65a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
af9b68f6a51798ff91ede69b0837d249

SHA1
f3b89aca9a4abbeca78b7264bec6d2d861e0008c

SHA256
d7af8acb24e5943a18b2d6d3945f6f76c789bdf704e3f5eff2fa646dd443d89e

SHA512
8b25f7bcabc631f45c2f2589d1f64281105d596750148417d372837f42e96afd789807ae640747243f0c523fc69a993bb27b736a0614a8a991085984bc8e67a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
4862639ba40f57fa3b2633615132a372

SHA1
a7ffc72abc60e704394c1840a9fbec19ad2152ca

SHA256
02354977b9a81c3fbfa02ec5ffd440041dce181a597888ba53e62789dea351d8

SHA512
056e7efc32d397235a7f0a5583ef7217c971d5e6acbb42c5ed0357b42965a577335b53dea99fe9acf7fa41da296b44adf4d06d29b8883435a513c2abd09d4612

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
04eb43225df5463ee870eae2d888b9e9

SHA1
f7a4634a08bdfe52f88cbbbee33fe923065f6b36

SHA256
0b6660325f92cfe6c3179ab2ebf623e2ccfbc79836584a6762cde475e1613fbf

SHA512
dacc0e4f04cdbf008313554199609fa599b639d7c16fb060d4734bbd63cf59f2b7a37d458ee825d65d430be6b12ee9fcc3ad14fbe1b329adfefaa826fe9abea5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5edab6d3ffbeee247ccb4423f929a323

SHA1
a4ad201d149d59392a2a3163bd86ee900e20f3d9

SHA256
460cddb95ea1d9bc8d95d295dd051b49a1436437a91ddec5f131235b2d516933

SHA512
263fa99f03ea1ef381ca19f10fbe0362c1f9c129502dc6b730b076cafcf34b40a70ee8a0ee9446ec9c89c3a2d9855450609ec0f8cf9d0a1b2aebdd12be58d38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
784a51387993e9aeb34d4ad4ed93ab48

SHA1
1cbf9ea1b6c2ea18c8670f26ebf9c11d7d245bc4

SHA256
567af49b26f4676e8c8ad07b34db13ae7a9e19ba01e6bd1af390a611b44413f8

SHA512
ba34c55cea5840723b16f09f0a790f823a5a65657f8163018cbfcbc3a13c83b1b4b6a1f8ca0fe188c1ba7d78cc9319889235c0f6042a2013755fc6d820e4b9e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6f5b43704165f94d8f233faf33611f1f

SHA1
9531ed25b15f568cc401816e5abf37d0ad2fa546

SHA256
072c016737aeabe50694648b94f09d90ffb9fba9f516047185fc94dae8c9267d

SHA512
d73d278f1651555d35a80c661d72e8d611a67e99317c69b10ab3a57d3cebd4d68e9f89ba8c35fd21b5adc63c69ec2a6761ec93b97a6510e25b71a32fc3b5dbe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe56e8bf.TMP

Filesize
1KB

MD5
21dbd5ae813aee220825dcb2360e4595

SHA1
8dbbbdbda1f6f7b1274e54e83e1ce55005c769ea

SHA256
9775e8241b59d1678e78b07c5627edc2002909f9fec78d938cdb1251c3d6bb82

SHA512
4a66e2f9411e9de1a5b581cbb35f583064e18ac7025bcdf3e276b769bb606e833bb698adb6043d610c1f0c9280405ebd63b3a8d86642f08be4c2668cbc93d230

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c66cdd2f-b758-4d7b-afdb-f6a7c6aa31b2.tmp

Filesize
7KB

MD5
2769a9973849bbf9ac1e0dd795874d19

SHA1
ee10a1446ad5f711bdd9013a8f6c1e90a3c10250

SHA256
70341f9d5920b9ac690735a046a97d019e9371f85da4a23f647e9f7ef0e44514

SHA512
87dd9f51f81409191f8ff85f427026d4d8a17f609ed1a7b93411bf48bc62d0f29d813f4fc0439adc8ff5ac694c9f5fc93f1440a901bf4dc7d79c067820b4dc46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
c23bcd4e0a40f245dd5b0a24c6d7cf0e

SHA1
da545eba439e1944814c8d1e65695349a45cc38e

SHA256
43298d1857cdc0450c85305983f1d1162e9a24cb9ff169ac4608f393185f9535

SHA512
dfea85edb248935124714339b505ad004dd71d1d9e1a6c8e469eef3cd2af7106a131984e7ff0cefdf3e67abfb6b65660d410106bc4ba92aafe5831fe5208e954

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0091c875331294601811d829e9c014d9

SHA1
16ab3c6f711f9c7f06a1541e50782bfaecd4cc76

SHA256
97d896a70d57206b78ac15f2ccd36ecb192ec702b5c411c3a00064b3c677d019

SHA512
d074eb45e2841a9503d92ea771ce51b8cc59fd3097db2983ed9d5f5a868f2432841c50cac1d51fe141f87d8928e2cbd0071558feef5873c847b8a725719664a3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
b6c2f40a1d772476889d3994d952e837

SHA1
a279853c34552c8144492210ca0dbe08b2568b8d

SHA256
013da84c0eb1c37e4c9d56816a6acf8e1eeeba2fb31a16092915ca26c0e4475c

SHA512
ec2f153b694efd7751d2c2499403900708f0043b5e6aa4b79833349a79f077a8077f86985c55727f8bdb5d17b5d20c1518e0008f14e59f1f9a0de279135a0ad5

Download Submit