9dc7861100e70ad6f4c5cd2f00af2fe510a7e64adc90188e6c4f22e01e022902

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2023, 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8361070x00000000002800000.exe
Size

192KB
MD5

9a99d7caf79b7b8b550015c595c922b1
SHA1

6fc91a2c99df9fce594c2fcc218fbf573c00ee15
SHA256

9dc7861100e70ad6f4c5cd2f00af2fe510a7e64adc90188e6c4f22e01e022902
SHA512

78ba2bd04a7bc95242101458d146cd34e10dc4b3cf3c434a0da194552cfc1000696b5746b978503c5c539b5f9a8c40366e0c7d6ea08e33ed13f20155b4a0393f
SSDEEP

3072:UUUUEa9Te3JQBf8td3/oxN1ULH0tyz8e8h4:y7QRyi1tyz

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{DA44ED51-DC8C-40DC-ACC8-3667E72E49D2}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{D304F8B1-2D20-4220-A794-32049421FB04}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{211091C1-C138-403E-9F32-462EBD217472}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{D0647322-1C9D-471F-8990-D0FC9AC039B5}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{0FA871B7-0669-4541-8F09-A5E52C6F7A99}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{EC3220A5-FFA4-4D0E-967C-D8863D7D5280}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{A37DD883-8FE5-43C3-8B9D-2429BB148FAA}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{11743136-F890-4041-8FEF-F50D078262FF}.catalogItem	svchost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230630120534.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\96e1798c-94a6-4757-a66a-07633f9ca426.tmp	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4960	msedge.exe
4960	msedge.exe
3124	identity_helper.exe
3124	identity_helper.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 4960	1440	8361070x00000000002800000.exe	85
PID 1440 wrote to memory of 4960	1440	8361070x00000000002800000.exe	85
PID 4960 wrote to memory of 3824	4960	msedge.exe	86
PID 4960 wrote to memory of 3824	4960	msedge.exe	86
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4104	4960	msedge.exe	87
PID 4960 wrote to memory of 4416	4960	msedge.exe	88
PID 4960 wrote to memory of 4416	4960	msedge.exe	88
PID 4960 wrote to memory of 5040	4960	msedge.exe	89
PID 4960 wrote to memory of 5040	4960	msedge.exe	89
PID 4960 wrote to memory of 5040	4960	msedge.exe	89
PID 4960 wrote to memory of 5040	4960	msedge.exe	89
PID 4960 wrote to memory of 5040	4960	msedge.exe	89
PID 4960 wrote to memory of 5040	4960	msedge.exe	89
PID 4960 wrote to memory of 5040	4960	msedge.exe	89
PID 4960 wrote to memory of 5040	4960	msedge.exe	89
PID 4960 wrote to memory of 5040	4960	msedge.exe	89
PID 4960 wrote to memory of 5040	4960	msedge.exe	89
PID 4960 wrote to memory of 5040	4960	msedge.exe	89
PID 4960 wrote to memory of 5040	4960	msedge.exe	89
PID 4960 wrote to memory of 5040	4960	msedge.exe	89
PID 4960 wrote to memory of 5040	4960	msedge.exe	89
PID 4960 wrote to memory of 5040	4960	msedge.exe	89
PID 4960 wrote to memory of 5040	4960	msedge.exe	89
PID 4960 wrote to memory of 5040	4960	msedge.exe	89
PID 4960 wrote to memory of 5040	4960	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\8361070x00000000002800000.exe
"C:\Users\Admin\AppData\Local\Temp\8361070x00000000002800000.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=8361070x00000000002800000.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaff8146f8,0x7ffaff814708,0x7ffaff814718
    3⤵
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15685146422420196998,6330908374970462145,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,15685146422420196998,6330908374970462145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,15685146422420196998,6330908374970462145,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15685146422420196998,6330908374970462145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:3948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15685146422420196998,6330908374970462145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15685146422420196998,6330908374970462145,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15685146422420196998,6330908374970462145,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15685146422420196998,6330908374970462145,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:1
    3⤵
    PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15685146422420196998,6330908374970462145,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,15685146422420196998,6330908374970462145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x7ff6751b5460,0x7ff6751b5470,0x7ff6751b5480
      4⤵
      PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,15685146422420196998,6330908374970462145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15685146422420196998,6330908374970462145,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
    3⤵
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15685146422420196998,6330908374970462145,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15685146422420196998,6330908374970462145,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
    3⤵
    PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15685146422420196998,6330908374970462145,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1312 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=8361070x00000000002800000.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaff8146f8,0x7ffaff814708,0x7ffaff814718
    3⤵
    PID:3800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a9f76dde5876d055fc0a4a821de6d02

SHA1
3cb30f2ff875cff6a4e4be0c7506254e076ad4df

SHA256
323204c96cf3ed35bb893c2f20a444cd0c7aa0b44749174b7b22ab351b2edf1a

SHA512
b805309fbbc622f2e47c9d4397662713b37879d0ea0602675c0894e655b9dcd34d483a02c6bdb73b5c6ce084ca7523e038104bce428a5bc7be3569c0d18b9091

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f03d46fea5560c1399efc6cd761bf186

SHA1
45150c0022e365fef587661b2f30e4c19d1d1eb1

SHA256
949ee14af970685452570ac9f7459d11c4b4ea5c5166b462bd8b89ff7d597df7

SHA512
3e59314f0cc679a53eddeb6eb4356e3a4f77f47a30496d7184b2720e9b7e5abe67af3edd346b57df0db56d8f12d3969931b5b6ed5876cc9a4a531c81bd60853e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
02ebd926a19f04bb177b2e3f88df6a3b

SHA1
db3fd0d56a8f68431ab43d91a889d32700245b93

SHA256
aff9edab028f6658f56f4446bf9ebf5b1352d30b85262f8d15dad2b7a367e554

SHA512
30f8b6716ce59d7a64eec5234843c55e95dfd3e5ec9080d661d5713f2811459dfe9029cd252b94e586717274e139c9b77ae43446ef58217d4f078c1698e5dfb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
55f5243be313d82ac078287d8771cbbe

SHA1
d9f4a4281d3105a10b9956f58da627292a747aa0

SHA256
a806995e363dce0745da1f2e6f47dd3a81b63125b0626dfdfc9f0d74f745481e

SHA512
1a1c0acbfb04751825fb4ccd9adca760c963e3da97146e5a5a4f16c9cbab0f8324fd38ebd5d137d9fd3a55a2140e9bea227ba993da35a98486be1411a288d92c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
164b7fabe561d162dc6dd7b3432cb0af

SHA1
d1bd083baf16a8f26abda2b153ef035670a1d086

SHA256
2613e787b2597b77ec57a41d596f3b58e484e7626477a4d65ddf34e88bcbfbb1

SHA512
9d09be87ad8a7410314415a0560fc11d74a553007983d38a0cc178583f506d7a6d44a7dc90fbed20da337da2c3a15362b4a86134b4d536b2f3b5f173c06cb50a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
346B

MD5
172a03f1e073cbc347cb5102d038fa13

SHA1
83a95a02491a4b046ea79fd04ccf6c5c24b29d60

SHA256
b8193a8bbd8d5c6b71977d040537ea555fc414cb3f7c2d4166e9bd3ac1ef4e89

SHA512
2a47a09a51fbf77f8b2bcc2d3e46db628d45ebabb9bb4033965b3409810e9a6c55c1008a62bfab5d3ca2a64d8b67f5c726f3682da0132738065c14ff77c1f5bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
37414268f7a90084ebcc3d879c5984c5

SHA1
03a7de984f472720a34718bd02ddcd0fcdea5906

SHA256
cfb58244a9ede02e354304e8d45443f3256c6cd26c1837b46a4f6439832fba4c

SHA512
36ae4f0a38ecbdd7e51a5fb1d3834b494e8c8e5b87f25f586c6466312ecb0e4a3a3359563980f5abd69c1def3a2f6c6e2eeb69285828df27f9c30640a25dd744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8463aff6a468bb033f075769eb8870b8

SHA1
23859045f9d6e39f0f370e3fbe5d64ff5203c5e5

SHA256
ba7951af64d32b263d5f2e1c2197e1d575dcd9b5c338df08a1efedea7df4cbfc

SHA512
78a2026be5c2ac31ad561629cc03705c2e63d3e1e4c5eb8f15a9fe6aa12e3c9cc760913307b4a3b962e7e418f345e1ee4a5dad017ec6bee8e448dc4285185ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
587345c43d1d04623b400bd94034d6af

SHA1
1c9c3efb97366589c683c184896ed8feaa164a2c

SHA256
ab1c015804a3f1ae305ab873d2e5857a7e51b76f3aa49b48585c3bf1045abfb5

SHA512
12eb0786d63c1040e7658b2ee24fdad07e9a794df4b41f83915b39bc9042b634cbee0ac6343e1085e93da32a1340e793b81d6bb0b6ad44e0b6da7c990876eb15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3922931a21a66290ecb769f2d79cc417

SHA1
d72bc5af3b2da078125ce71512249f67765624c3

SHA256
0eb33cdbc3b30f2dd68d3e4de912b61c6f29f3ddbf17b8e83948e9243763b8d4

SHA512
e4b1c22b64afa2120c2ae1385374747b04ea4b509fef1a27384755d57cfd4a86008cbf9af7095a1955c9934148b38cf7aa32b036d08702cbaa0ec9f5f59c3987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
b359167b3568d1b4953adefdef0deb24

SHA1
98405d3ec52edeed62f8a42bfe766ecf395a95b6

SHA256
177289a899357233597b059fde47b7e54aba35ca95e2a2201fd8d3ca68273578

SHA512
28efc3e9bb0350c2229ffdfc0578c0ebc8276405849480c1762c75d616998f6ff654f7ffde3cf0676b62b583b5ec207e514040de1a809b465bb9e734e29c96b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
df7da7b7ab62b122adf8bcbe9fadc48e

SHA1
8c675d45bb34d8903e2a5981b272aff082647ae6

SHA256
a751ee5c285555fd9fcd86587533ca43852485fd5e5e0e1d4aafdcaabaa8b310

SHA512
ee688d811827bc3e1945b7f41e15ed2820933e03674f61324c956f28a71ba0f26ff61c561f793c8823df9d81215bad4d74efd14b37104e65ca9db61c9a143201

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe56e6da.TMP

Filesize
371B

MD5
576e661a40eb4ef0b2062d775d1e3024

SHA1
fb4193a613d2c1e2c45cf91ee0d013bb56d7e7ba

SHA256
cad8f677fc0e2c9c7e70470eda9f0468f7f21d3fe85ee005e90716f57fd3b55f

SHA512
d0c58f0f02a171f35d06b95604fce3275dd46ce6c0e4522db30003d1bb37b3219c4040fc912e51c585f72ae91a91820f1994464c3581bea89074107ce204147e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
73b93bcb7f6d037919d0270bc88bdf5f

SHA1
bc3fac5b0aed2e668415f728befc6fa2e07c64d5

SHA256
5a652f525fd8952acfdd784bdbd1bc92437d138113335a50127d3a97e2d4f565

SHA512
0bad7845206ef317e6f19ab83fbab2a94ad4a7a6999f3b0a652e484900e25f8defbe7b30ee3708c13eac6da2d277b5b8912130c01f04aad59bcfa273eca57fd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
bd87671da6e63da869a0c07ba865b654

SHA1
f020c713479f812ee98ad1dce8adb604bae796c3

SHA256
ccbf947237e2a599c2717d3c5619e3fc8f177857b8b514994a4d29eab6f7440f

SHA512
92399b387833989d3771dd31c81cc6cbfa5510dd4a33fd200026b7449480409162b7130852ce0a0af11f066b7bb92cedf5aaab15bb489e3b444f1855cfc55cfe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
d2b0a19934037e5d7ce4817ae32ad588

SHA1
8a7c40cc79d1ce7ac8e4dcddb15331e195975d2d

SHA256
871da9884d3aaba2e830c791d8fcb4b0b205b9796e8c2de9f2ebff3d80b98b45

SHA512
367688afa00b16c2d22963e4f2c4cce4ed35bd5c10e71a07722dd3ef6af1cae461e004d8348c31fbaf2274263a88f52361e034b1b59902b81d25549510c7e8cb

Download Submit