a808fa784618a7f6a9e2b593efd3975116e31d30734d77a8a5a49dc7b0b08244

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2023 00:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1844-118-0x0000000000260000-0x0000000000290000-memory.exe
Size

192KB
MD5

4e92229ae7b9e2b696dfb5402160c4cc
SHA1

744a4f90977971457b884290e6d95df684ff46c3
SHA256

a808fa784618a7f6a9e2b593efd3975116e31d30734d77a8a5a49dc7b0b08244
SHA512

5f3af8ad1baa9307ac03a2722e4d859179cbe2f66f46b48872ada6393f60c51a185d179bb55c368c441301c919c4353672ad76f7d09ef1f1f6289f24f636eaee
SSDEEP

3072:BSWYcGwly5Ci0oxNnGSbEUu/ggOW8e8hD:wGWB00ZqggOW

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5d49c446-d137-4c2a-bec5-f825f1d70550.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230617004326.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
932	msedge.exe
932	msedge.exe
3936	msedge.exe
3936	msedge.exe
3524	identity_helper.exe
3524	identity_helper.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3936 msedge.exe
3936 msedge.exe
3936 msedge.exe
3936 msedge.exe
3936 msedge.exe
3936 msedge.exe
3936 msedge.exe
3936 msedge.exe
3936 msedge.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msedge.exe

pid process

3936 msedge.exe
3936 msedge.exe
3936 msedge.exe

pid	process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

pid	process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1844-118-0x0000000000260000-0x0000000000290000-memory.exemsedge.exe

description	pid	process	target process
PID 4232 wrote to memory of 3936	4232	1844-118-0x0000000000260000-0x0000000000290000-memory.exe	msedge.exe
PID 4232 wrote to memory of 3936	4232	1844-118-0x0000000000260000-0x0000000000290000-memory.exe	msedge.exe
PID 3936 wrote to memory of 4028	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 4028	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 1396	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 932	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 932	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 2540	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 2540	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 2540	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 2540	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 2540	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 2540	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 2540	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 2540	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 2540	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 2540	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 2540	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 2540	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 2540	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 2540	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 2540	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 2540	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 2540	3936	msedge.exe	msedge.exe
PID 3936 wrote to memory of 2540	3936	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\1844-118-0x0000000000260000-0x0000000000290000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1844-118-0x0000000000260000-0x0000000000290000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1844-118-0x0000000000260000-0x0000000000290000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdae7546f8,0x7ffdae754708,0x7ffdae754718
3⤵
PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7375086153655213825,5010113105150000860,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
3⤵
PID:1396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7375086153655213825,5010113105150000860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,7375086153655213825,5010113105150000860,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
3⤵
PID:2540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7375086153655213825,5010113105150000860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
3⤵
PID:3020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7375086153655213825,5010113105150000860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
3⤵
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7375086153655213825,5010113105150000860,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
3⤵
PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7375086153655213825,5010113105150000860,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
3⤵
PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7375086153655213825,5010113105150000860,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
3⤵
PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7375086153655213825,5010113105150000860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:8
3⤵
PID:1784

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
3⤵
- Drops file in Program Files directory
PID:2644

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff64cfd5460,0x7ff64cfd5470,0x7ff64cfd5480
4⤵
PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7375086153655213825,5010113105150000860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7375086153655213825,5010113105150000860,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
3⤵
PID:1624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7375086153655213825,5010113105150000860,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
3⤵
PID:1592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7375086153655213825,5010113105150000860,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
3⤵
PID:1576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7375086153655213825,5010113105150000860,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
3⤵
PID:1760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7375086153655213825,5010113105150000860,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3160 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1844-118-0x0000000000260000-0x0000000000290000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
PID:640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdae7546f8,0x7ffdae754708,0x7ffdae754718
3⤵
PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:320

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ae2c65ccf1085f2a624551421576a3ee

SHA1
f1dea6ccfbd7803cc4489b9260758b8ad053e08e

SHA256
49bfbbfbdb367d1c91863108c87b4f2f2cfffbbbb5e9c1256344bc7f52038c54

SHA512
3abbfbb4804c6b1d1a579e56a04057f5d9c52cfd48ecbae42d919398f70da2eacd5a35cb3c3d0a559ad3515fadb1734b0d47be48dce0fdd9fd11578948a6c7ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c3770be634be8da92e71a3f9f76d79d3

SHA1
f4538b79d313dd46e55d1fd3e6ca3d4681fe4c3f

SHA256
23549094c00feed7abf21e56caae3c8b22a7bd89cfc2f5ea369cf13259273432

SHA512
09c1a087be6dcb49fd0725936571946266f31298f8ae141d59b9ac60f3f0fe8e7d964f661818d72682633845b48dbb906d8c89bb33bd2060bb4971b3e14fc4a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
cb2ff64f73629938a4349480a8654f8c

SHA1
72cdc3e5a55cb9b29beb17f643e0ccfe32d11fba

SHA256
745c0c49f261cfb2caf19fa38574e4a9245a6f6ca1caa66b8220db26117b7f0a

SHA512
75cc8eca1dca5077fb278870d4f4e0dee7cb4a180fe43c3d19522b94605dbe34daf9f19faa09fba4bfd6ae098e3643fb3cd022a91000d99f62f43f004d757b59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
48B

MD5
bf2e7c83744c85930ff30df3307672bb

SHA1
8d69f5a40eb87ea8dbb43dd5c88349e8019436ec

SHA256
98c2f6a20c4b72a04f9d305903ccb1b40912d95712426825a600282238216f79

SHA512
b60ab0beeee6117b2c92616e0f44ab05139cd57c8908d5173a1924fef09bc28fad0643f04079de56644eb8084b4bbe517a1c40d060792a9afc2f707f64701d77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
336B

MD5
f259e97b39d9bef1856f5dd1d5c612e7

SHA1
d9fe55cfebb9599744a7d12175f8a4fae69b93af

SHA256
61d1a707ea0b6c7b37e892259981ae19aaa77b20344a77eb6260cac607941bd0

SHA512
7c01ed77f1725b1ea3aa1281a1f11f32d61c2fa64838ab7fce2697383a914cf622eb89c6f119992b229846799f8e1b74a41778abdeb4479b6de062bffa2e54d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
Filesize
2KB

MD5
4defe30c30da62909a90a09b2f1e029d

SHA1
8d28b8ac27d154b8b531441ae79cbe6f34f9ea29

SHA256
0d67b5e42fdffa84d02e575982d35d7e335c25242ca9d747c7605f42e5b30025

SHA512
0805d4c1a0e52becb919f724dad4169d32d68cd5b73ddd99ac5f8a13209a3ec3897e9d86f545f05f7cd86130b606349369721e8f4d2b897f4f2c3003b6a9af43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
566B

MD5
381ac45cdf7aedc98e646056ccde4a8d

SHA1
168e192b23a595e9f41cf8d107d6c1d601c3ca77

SHA256
9f056538358e029a4a7f13bab71dec7dcec6a9ac69b95c766a887849faf49e84

SHA512
98ab242ae61cbeefe9816b68044a15f7118e2576c6e559fb1fb801cc405d4c81310183c6c6a31ab46791a1477d0f61ce113d98311f9858619e91a03935e8a4ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
4KB

MD5
e9098a09ff5a5f2742df366e60c213c2

SHA1
aba2a72ededfec0fe16932db429fb256268b762f

SHA256
af85a3ac51375a6254278203e8f2c0b7bbe0a63eb69e476963f74b965cb78e2e

SHA512
bc551b044fda0d76eda5fbf2f23bb91626ac2e6e094df4030f91c460dd38297ef877d48f24b8d7926934119093007cd834def7e548ea32569f986cd8ef3d7b67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
8a18435b0ae55a3ab1aa84dfdc24b476

SHA1
e295113c980927153848262667d0c694d6570e4e

SHA256
d2911a9fc606ee9d08f9228275d63b1782c53148e65a58733f83a624fa2a57aa

SHA512
51b8d32a00267a6135cf8b06e0ca4b4b6e15582765640f92cb3c9bea668e99151b4ad4f885c1dfc69c4c5bae0ebd9f6e2bced9c8b76dace1310f6d4be8f0576f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
248b5da18e83beabf37bf6827ac7018e

SHA1
5c57b8290933345ee57b7bd7a4a82235020a45fe

SHA256
83e1e2b124fb3b68ae6261f551ca6efc78fb157025ce037938508921a4b82364

SHA512
248453deeefa9879f99571908c14e07b615e09fade0cfd4af428eb5baae9bc6900f57968249639778affb4a0887a6cd6b10960a33fd650f201c0ef734265184e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
b3fbb8a02260d5e41407a7e1af3ee2f6

SHA1
9180c8b9593405936b0fe52272571b63829525d4

SHA256
8c1434a31409aa606a51bdae37e0853597cb408a2cf199f05e02705df3fc15de

SHA512
8a6ec40722054025a8969a80e795b026fc806a0710eb2f9e016feb68cc09a19333404a8a62910e9b0335729fd64e8e1b6250513ffc334dc8d669d96de62eb5d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
cfd585ce0db9a1484f8223dc2cfce2f8

SHA1
4e5e287160c05ecdff8acdfa0899faa5bad4de82

SHA256
0bcae3ddcadfadb917e4f910daefde07af8d2708b7795f3a1146102dcf6cf445

SHA512
b45dd6c3231a79155508d807d4b6f839d49e6120841c4f31147a83039515d3358822fa1fa4ae6f770b4369b96f221326c0b80dc2f0cd99d605440b12c93fb648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
534B

MD5
4b46d0348aad9865ef4c3c22d70a3422

SHA1
33f7b0fd2071f9addcbe6c690a1391f5fecca31c

SHA256
703496ec80a1d7423283679bd0f1a74f947f1ecce533d91a1cf1f1ff5d9d34a1

SHA512
a4f17e756978e3cc41d4e7dbdee673fa100a892fe6fc4feff7434818c7d93cbcaffabe36b3107ac3e29657a1689fdba3a046f4aba9b5db9bbbbd0504646bd931

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe56ffa2.TMP
Filesize
534B

MD5
0cfbd7c7855df2ec9befcfee83f90166

SHA1
6854be6b3241fb7c3dc1f73ccb90b248d89deaaa

SHA256
9c476096657854b3130bac1726e8137993020f42c0a697f14c8d9b0abd3e7bbd

SHA512
639f604d9c49d15872b9613d5858821bd6ebe0eb86e8c03f498deade2896b1b68df72df67424c9e2ae8b9a1b3fbb921d633147af1a9d10b314bd7cbf86b327e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
9KB

MD5
5f2d4afe9c2af4f22ba7fb9a9f890584

SHA1
4cb81ab624f0e47b563853a2229f0fea2e5537a0

SHA256
6fe35fbf2ada4c53ddd5fb6b1f2f13fc749fad4a5d4edfb34959c0e8bc7033ee

SHA512
7c5177213b54837261de9adf1080de34ae36623deefd397beb0fbec6cf62ef86e7d4d93abf5581b0ffa83f0ff887f9c3538a014b5e213c0e6173a4d0e2b135bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
57765ecefdbf4c0d0ebae9ba67fd98c0

SHA1
a2935e0886caee6d1ae19b2dd83b1d57c37944c4

SHA256
7c03efbcaf0a7060211f7137c10d7e57a47390280cdff29c70d63b41af10fe19

SHA512
c9a22f8018b0440492620d9fd3dadb6fbd23dd363f1d74f145c62fe59c797cd059a8982ebec657c61207778ef44134b9ff973d274af1b0a61f376c8f4d50e522

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
3KB

MD5
4860f75d86a3739ecc093cd1d0baf78f

SHA1
a7b52a96a84f5a7d651fc1b737976b1c9a045909

SHA256
74a75d8853de00ea3ea4126ef92784a3a3d1503a1b7a3084e7e39bd24638e463

SHA512
ecf0860ca11eb2d970d19df70aeec7b1dcd656ba0137ee75bc260eaec707047887706e2fb8a6c40b5592ecfb0d210a19ebbf996b4d48f970fa6a6251b7beae4b

Download Submit
\??\pipe\LOCAL\crashpad_3936_TDXZRRQQTJOMOQXI
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit