b1995e2dfdb813f22f4004d6c12efc1986cd04c9c92579f8433426ad53f9a09f

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2023, 20:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1312-97-0x00000000002A0000-0x00000000002D0000-memory.exe
Size

192KB
MD5

015969247952dc3d825f8068a4412a64
SHA1

9dd53143ff3349204fd5b02bd51889b474fcd4d2
SHA256

b1995e2dfdb813f22f4004d6c12efc1986cd04c9c92579f8433426ad53f9a09f
SHA512

ad573ac25cc826d06d143c69ed11cf31620265f85b011ce13ef4990de14a608f021252e86d95f25800473d042429bf109c725c7a946e2a6b84474bea0fae5b57
SSDEEP

3072:7SsCziRmKPvwL/2rSlllF+HxN6AtjJXO+8e8hB:7SHqXwaWlllF+CMXO+

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\e12ec506-ddfc-4362-959b-324d5424cbc1.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230626203736.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
32	msedge.exe
32	msedge.exe
4776	msedge.exe
4776	msedge.exe
4252	identity_helper.exe
4252	identity_helper.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 4776	4924	1312-97-0x00000000002A0000-0x00000000002D0000-memory.exe	84
PID 4924 wrote to memory of 4776	4924	1312-97-0x00000000002A0000-0x00000000002D0000-memory.exe	84
PID 4776 wrote to memory of 2024	4776	msedge.exe	85
PID 4776 wrote to memory of 2024	4776	msedge.exe	85
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 224	4776	msedge.exe	86
PID 4776 wrote to memory of 32	4776	msedge.exe	87
PID 4776 wrote to memory of 32	4776	msedge.exe	87
PID 4776 wrote to memory of 2740	4776	msedge.exe	89
PID 4776 wrote to memory of 2740	4776	msedge.exe	89
PID 4776 wrote to memory of 2740	4776	msedge.exe	89
PID 4776 wrote to memory of 2740	4776	msedge.exe	89
PID 4776 wrote to memory of 2740	4776	msedge.exe	89
PID 4776 wrote to memory of 2740	4776	msedge.exe	89
PID 4776 wrote to memory of 2740	4776	msedge.exe	89
PID 4776 wrote to memory of 2740	4776	msedge.exe	89
PID 4776 wrote to memory of 2740	4776	msedge.exe	89
PID 4776 wrote to memory of 2740	4776	msedge.exe	89
PID 4776 wrote to memory of 2740	4776	msedge.exe	89
PID 4776 wrote to memory of 2740	4776	msedge.exe	89
PID 4776 wrote to memory of 2740	4776	msedge.exe	89
PID 4776 wrote to memory of 2740	4776	msedge.exe	89
PID 4776 wrote to memory of 2740	4776	msedge.exe	89
PID 4776 wrote to memory of 2740	4776	msedge.exe	89
PID 4776 wrote to memory of 2740	4776	msedge.exe	89
PID 4776 wrote to memory of 2740	4776	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\1312-97-0x00000000002A0000-0x00000000002D0000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1312-97-0x00000000002A0000-0x00000000002D0000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1312-97-0x00000000002A0000-0x00000000002D0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff347346f8,0x7fff34734708,0x7fff34734718
    3⤵
    PID:2024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,15471757142756775488,14120597752758405033,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,15471757142756775488,14120597752758405033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:32
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,15471757142756775488,14120597752758405033,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
    3⤵
    PID:2740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15471757142756775488,14120597752758405033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15471757142756775488,14120597752758405033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15471757142756775488,14120597752758405033,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2916 /prefetch:1
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15471757142756775488,14120597752758405033,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
    3⤵
    PID:1956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15471757142756775488,14120597752758405033,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
    3⤵
    PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,15471757142756775488,14120597752758405033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2752 /prefetch:8
    3⤵
    PID:1356
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:1272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6428f5460,0x7ff6428f5470,0x7ff6428f5480
      4⤵
      PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,15471757142756775488,14120597752758405033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2752 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15471757142756775488,14120597752758405033,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15471757142756775488,14120597752758405033,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4420 /prefetch:1
    3⤵
    PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15471757142756775488,14120597752758405033,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15471757142756775488,14120597752758405033,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,15471757142756775488,14120597752758405033,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2632 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1312-97-0x00000000002A0000-0x00000000002D0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff347346f8,0x7fff34734708,0x7fff34734718
    3⤵
    PID:3776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
610003c56a177b0384d6fb52bddd79da

SHA1
dee64128972597ba8c0ae9f4ac502c1065c670d9

SHA256
750ed9c6bf8f2155b43e1e9684ab39c383ef2bdf375ae7820a488b59f0495877

SHA512
c8394769c6ed907ba07a087ee29c62e61f1aa490cc11a431831010221cd789a8f8a8be33c8894e76dc1bbeea7c512b2ce6db76427c470c1a74c9d5bfd3ef6298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
055413454fe994a1f2a4356edeffe33b

SHA1
4d85afe3b54e1f79e8fc882fbd37dc89bccaceed

SHA256
e6e9f98b886ea24be09b9630e64d2b666d34723c5730aad53d1dc6ecb2859425

SHA512
865bc1dc6e679d5022f9308adc4908b4e75733c960fcd727dbb4e033a7d1a58b76e2dbd0a80f0fecc4d4086d12736204ef4df9e14f338a777505bd49569309e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5311e8420389486471705f84d787e03e

SHA1
f9c99768aea9760678c7eeb2e8d3b6b1e49154e5

SHA256
a50f718feebfdf573fa475504994352d12ba10edadae058512d3693bab4c0264

SHA512
c852b7cc07288374f14728d8ebe600a2436c57f1326f805f9ec07429cfed6cbffdac7ff0d26bfd0898cf630e525bf49b7b8aeb2bf48b9bf987224dd3bca0d614

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
5a67fe3e430b5b55359b7c0f3ec08c31

SHA1
bdf56e79e1b74f86436d309c1664e58ba8edcd29

SHA256
4c6eaa5ec0311f32b7601d8d18034e2a7a00fbef67026070a5390de1f1f0b4be

SHA512
13f1ccb458eeaabd5b1e4efd2b9c2307658b584bec5b20f51985a4def6308f7f8d2f5c5d1bf1487fae85b0f358a8837525d37368004931528d881789c5a2ba4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
182fe9b79700f9468fb09c9bbdb07d58

SHA1
403ed6530d89a41b7154cb251a0d08286ff9063b

SHA256
1d11cae14c7109c1602301a75fc92f81cd328a766c15cbe7db6027d08c9fa48d

SHA512
4a97e9117f273ef58c71d84fad7561e8a524f0bd8a25a075bf79e15887db3066e2910f894129aafb0b23dc9e26c4d49aba6f16b8a0b8013dd8adb248cdfadd07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
2e9deb28f355045d2f14848b4e3ccd4e

SHA1
13f7da2086e203daf31f34197903b667ccee269a

SHA256
82127c8a85ff50776e388d9c1b3acc88635df2db467a43948b698ec1e8056871

SHA512
a60ef065d6e45f046fed2e76c9df82c8beb7b370a1fc0b8b294ee71b9ceb4072e3f6400edc15af5f31a0c95aa4ee7d44bb533941f1edbaac13b9563e4bb54257

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
346B

MD5
172a03f1e073cbc347cb5102d038fa13

SHA1
83a95a02491a4b046ea79fd04ccf6c5c24b29d60

SHA256
b8193a8bbd8d5c6b71977d040537ea555fc414cb3f7c2d4166e9bd3ac1ef4e89

SHA512
2a47a09a51fbf77f8b2bcc2d3e46db628d45ebabb9bb4033965b3409810e9a6c55c1008a62bfab5d3ca2a64d8b67f5c726f3682da0132738065c14ff77c1f5bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
53464f3b7e85b49d96bceb3459bcb92b

SHA1
cbdc93aaecbaa47dd3ba0c814431e8f0e42ac7da

SHA256
2c92bb35fb57fc946af5b46494ce447b268ca4a9bf7ce83615c6e1ed75f2dcc9

SHA512
1b980f45e29f299720729d5219ca397792f966503504e3f25ca32541cb4464ffbf385959150fa7827bf89e49c6580bbe6976f9f6daf223ff1fd45a2bc24f3ecd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3df378f53ebeff6e06ceba63136e9026

SHA1
3db8a94451b4138c4f089c49cfc90e92e5207a42

SHA256
d8b540e4b5897a1cd59b0306556705e23d30ae3312c49b9c31ac6f731bd083d8

SHA512
18fe0a6293dc76c409a48adf045c8ecd96afaee7dd9e5265d64e5c21c88e1bf03a470bf7318764255a989e2c67829cf4c22ee071c7f27155e40eba46cd8c97ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
430d151fd066775fdfaaddc1f455491f

SHA1
cd45b66edc0dd726af424c2a8466a74b7607041d

SHA256
d7769e2d833678a8ad902246d5778c2d9ff412880063483d9d88deabc28ee6c3

SHA512
64b07b74a236fc1b40afa24cb73435a0d51c109bf9caa169d9b259382c9e9dcfa061c8210055e96bd33170c9ab58d9582de7c9d16b129019631f35f8e7700148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
b19b048548718e5ec507132a64ae96af

SHA1
95b7e9da11ae6d6abc367e8a37e3bcc203eeedbf

SHA256
b48eb5eb7e44576078ed25adfa3f819949a29cda229776860aca77c19107f892

SHA512
942d72f9f25550a31bcaf134f41c612f08392adc112d9d58e4187bca76f26d7e012cdd0bffadb1dce574254a6474ee604ca8dff2335d812566fc0fdb1155124d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
4fd054c69665ea437b1a20e418c64443

SHA1
e8d9eee4354ebfe06180117f718441784241577e

SHA256
3019dfc3ad41088ef51f0c69004e66fd2e97176ca542fa07cad3ed9b2c00eaa5

SHA512
8b2067e825a1cbb619519a1d07ecca6aed7751f7690042108a6cc48241a734f1e0d1f027baa07d6fe27ad58c5dd7da41a0daa749edd2a0c18921cece1b08e12c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
aef403b889092e7775024a787ea7ebaa

SHA1
9ac41b6013f426597ffdf43d18eccd6002ab3689

SHA256
370df17c3eeafa8c17cc2c27480a6c0a65758fc0da43de08b5d4a4d753672719

SHA512
8d5f978a323fed3e379b0a21afce6575919a803a8f0d13606cf257c8a590c99f619bfb7c2c427194ddf7444facfa58c5e8273064bec7669ac4b71ebd1b846f9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57084d.TMP

Filesize
371B

MD5
b284242220ae53fdbeb158aa962a3350

SHA1
b485e5825c680583b59af9c54c7331160f0f8799

SHA256
d5540a084f59562c8d2e7d0aaa3e3ce6e13f5a49c1d91b5f3c39bbc32863eac5

SHA512
5c9337814c7291c76f75d71817e60ee01504ad353a59ef3a46e0bf0a2a0c65a33613cbbc90acf25867854a15c1d3434eaf2ea596b6efd3b2c60f198f96f44178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
d451bdac5bceede81d511733dfba89b5

SHA1
b6241496b0e2febbff044fb38531aa8708c49eeb

SHA256
c23b667fa501a7d870601572ba017f1d67d803b8fd5cf7878f1f6b29ae5664e3

SHA512
6a0647777798078abf8ef67aabe2bb40076035f085f857eaecd338ec0ffd4bff01fcdfac9ab6bc74d526b85bef3bf69d38d7c75cad1c7bac6ce9e3baff4f7ca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
9db1c154b42762168f199e0ca7c7002e

SHA1
2e6a1be49ca61f8d844678c4505d8c48346017fc

SHA256
7de4a7fcb4c7c7ae4c27d183e1a4e53fadc2b7ca0e74641e7d558b1a36d27aa0

SHA512
800efb2a6f4c803708f37b851cbd0f3c0f17a695ac01883b73ceae909e046a049e2d56446a3feacee988e500604059e9c16b35d49a67458875f66179d23c089c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
3db6cd5a520d5e060add00fff7f057d0

SHA1
b6a9a0bec6825ad5cd5f340408c669c324734ddc

SHA256
dd89178f1fcb780cae7ea373f05db0bd01972ca5e6573115127a558580e5600d

SHA512
9f6886ab123ca3ddcb47adef13a45cb3607af7d5c3d007f16cefbac92603acbd5eb385ae916d4ffe8e061d2b1e5b3244e0ce11d4507285f229bfc211f340cc09

Download Submit