72d80fd19f7cb28089ce4a37d4250e6903ad00dd09e1ead3fd596ae46ebec8ba

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2023, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7561230x00000000002500000.exe
Size

192KB
MD5

c480a049f88fe5388c16ece7b0880aff
SHA1

204b377a96fb15dd5146eab9008c9dcb1202e003
SHA256

72d80fd19f7cb28089ce4a37d4250e6903ad00dd09e1ead3fd596ae46ebec8ba
SHA512

b640ba9b21efabc69b8507d6c4666d613e51a9e898e1c86c75de76601f85c66f47c4bdfacb8cb014a3fb915d7c317270e2f0ad48c1bba521160dc99bc566b311
SSDEEP

3072:PUUEa9Te3JQBf8td3/oxN1ULH0tys8e8h4:87QRyi1tys

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\94c45d40-dd8b-4a21-8fe4-a81b0148c381.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230630134620.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
4860	msedge.exe
4860	msedge.exe
1764	identity_helper.exe
1764	identity_helper.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4860	4136	7561230x00000000002500000.exe	85
PID 4136 wrote to memory of 4860	4136	7561230x00000000002500000.exe	85
PID 4860 wrote to memory of 3980	4860	msedge.exe	86
PID 4860 wrote to memory of 3980	4860	msedge.exe	86
PID 4136 wrote to memory of 4728	4136	7561230x00000000002500000.exe	87
PID 4136 wrote to memory of 4728	4136	7561230x00000000002500000.exe	87
PID 4728 wrote to memory of 4588	4728	msedge.exe	88
PID 4728 wrote to memory of 4588	4728	msedge.exe	88
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 4128	4860	msedge.exe	89
PID 4860 wrote to memory of 3000	4860	msedge.exe	90
PID 4860 wrote to memory of 3000	4860	msedge.exe	90
PID 4860 wrote to memory of 2156	4860	msedge.exe	91
PID 4860 wrote to memory of 2156	4860	msedge.exe	91
PID 4860 wrote to memory of 2156	4860	msedge.exe	91
PID 4860 wrote to memory of 2156	4860	msedge.exe	91
PID 4860 wrote to memory of 2156	4860	msedge.exe	91
PID 4860 wrote to memory of 2156	4860	msedge.exe	91
PID 4860 wrote to memory of 2156	4860	msedge.exe	91
PID 4860 wrote to memory of 2156	4860	msedge.exe	91
PID 4860 wrote to memory of 2156	4860	msedge.exe	91
PID 4860 wrote to memory of 2156	4860	msedge.exe	91
PID 4860 wrote to memory of 2156	4860	msedge.exe	91
PID 4860 wrote to memory of 2156	4860	msedge.exe	91
PID 4860 wrote to memory of 2156	4860	msedge.exe	91
PID 4860 wrote to memory of 2156	4860	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\7561230x00000000002500000.exe
"C:\Users\Admin\AppData\Local\Temp\7561230x00000000002500000.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7561230x00000000002500000.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff80e9e46f8,0x7ff80e9e4708,0x7ff80e9e4718
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,2984516257623825271,17782685109262749063,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,2984516257623825271,17782685109262749063,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,2984516257623825271,17782685109262749063,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3060 /prefetch:8
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,2984516257623825271,17782685109262749063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:2248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,2984516257623825271,17782685109262749063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,2984516257623825271,17782685109262749063,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,2984516257623825271,17782685109262749063,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,2984516257623825271,17782685109262749063,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
    3⤵
    PID:1908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,2984516257623825271,17782685109262749063,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
    3⤵
    PID:336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,2984516257623825271,17782685109262749063,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,2984516257623825271,17782685109262749063,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6444 /prefetch:8
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6d5f45460,0x7ff6d5f45470,0x7ff6d5f45480
      4⤵
      PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,2984516257623825271,17782685109262749063,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6444 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,2984516257623825271,17782685109262749063,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
    3⤵
    PID:800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,2984516257623825271,17782685109262749063,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,2984516257623825271,17782685109262749063,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2700 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7561230x00000000002500000.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff80e9e46f8,0x7ff80e9e4708,0x7ff80e9e4718
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,12195047592434748250,18373464313899304637,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,12195047592434748250,18373464313899304637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
    3⤵
    PID:4048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
09932bc072dfd2591f537c31e7f7c5bc

SHA1
5992d292629688f3b98db35a6274f9b9ef8baef1

SHA256
41de587416d72dd9c2e27745572592deb76b2646b7c6491a6041019662a10c32

SHA512
0141ddf09fbef149d342e48c3fc98231a707b9d95f52e65c530e3a7d7f4172a68bd15c270eb44759063b528a938a14ab19c5ff400c6f7092aff793d8a93e1a47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
09932bc072dfd2591f537c31e7f7c5bc

SHA1
5992d292629688f3b98db35a6274f9b9ef8baef1

SHA256
41de587416d72dd9c2e27745572592deb76b2646b7c6491a6041019662a10c32

SHA512
0141ddf09fbef149d342e48c3fc98231a707b9d95f52e65c530e3a7d7f4172a68bd15c270eb44759063b528a938a14ab19c5ff400c6f7092aff793d8a93e1a47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
218e449501e9bc2755a9758e17de9cde

SHA1
b29d3810fddc119b996275825d0d6b6bfe00129f

SHA256
6d27f9bfbdbb874d2e62a7e5276ff2405fefb4971374b6b593aaf0e408b15c86

SHA512
5d0fa1934bfe03f54332134d07aad59044b05510c38b2ebd98f963867f2efc1e52aaca23e26925b395e7b5a6ae1a0c95c98d51050c909ae6a2d78ddc8f02cf68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
218e449501e9bc2755a9758e17de9cde

SHA1
b29d3810fddc119b996275825d0d6b6bfe00129f

SHA256
6d27f9bfbdbb874d2e62a7e5276ff2405fefb4971374b6b593aaf0e408b15c86

SHA512
5d0fa1934bfe03f54332134d07aad59044b05510c38b2ebd98f963867f2efc1e52aaca23e26925b395e7b5a6ae1a0c95c98d51050c909ae6a2d78ddc8f02cf68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
218e449501e9bc2755a9758e17de9cde

SHA1
b29d3810fddc119b996275825d0d6b6bfe00129f

SHA256
6d27f9bfbdbb874d2e62a7e5276ff2405fefb4971374b6b593aaf0e408b15c86

SHA512
5d0fa1934bfe03f54332134d07aad59044b05510c38b2ebd98f963867f2efc1e52aaca23e26925b395e7b5a6ae1a0c95c98d51050c909ae6a2d78ddc8f02cf68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
218e449501e9bc2755a9758e17de9cde

SHA1
b29d3810fddc119b996275825d0d6b6bfe00129f

SHA256
6d27f9bfbdbb874d2e62a7e5276ff2405fefb4971374b6b593aaf0e408b15c86

SHA512
5d0fa1934bfe03f54332134d07aad59044b05510c38b2ebd98f963867f2efc1e52aaca23e26925b395e7b5a6ae1a0c95c98d51050c909ae6a2d78ddc8f02cf68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
468d875602724cdc85916ebea3287243

SHA1
55a0d7cb27ec29a788659e5956d39bd34ecd5055

SHA256
0f55ea278534aa7d32f34ac33c217e32663feb25eb6fcfddceb1f5d3af4c741b

SHA512
744e0500a84c605877e080aa9aecb928582b19bd82839448a2a4705c3529bc091bb336497c3ad240cefb59fe765982827360e101846fa78efbb2d0f29e71319d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5802ca.TMP

Filesize
48B

MD5
0a4c34bcf7f306e11f37c416aec49ab8

SHA1
2b18df2ef0e55cebcc321561837b36f4bf1d8403

SHA256
818bad7680ddb4e1d4aa8c00f391947f599ae1d5d70f7ab41ee7b48486bbe3ee

SHA512
35a918cbc0f3c764cc884eb5af008978d86a62da7fd26049b88f43e66d878230cd9ad2b7c7265756e98990f48738e0ad0db73cd23873c091e6e0a1dc225c7b27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
8c5135c327b2b11d85f622738dd32d87

SHA1
0e29534a61c16c2a69648d81e33fde4fd67b914a

SHA256
4475ccd5ccc040eef45e28f1c9b59250a2a5b4df7e4774f545df372ddfc32d3a

SHA512
364605204fb35213d0c894bf14d78d02c56599ae1eb3b8502fdaabfb35e9f8688d4ab2e0386dda08808727a05b97fe415f1e8a508152eb6253d69bd7eb616ba1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
346B

MD5
172a03f1e073cbc347cb5102d038fa13

SHA1
83a95a02491a4b046ea79fd04ccf6c5c24b29d60

SHA256
b8193a8bbd8d5c6b71977d040537ea555fc414cb3f7c2d4166e9bd3ac1ef4e89

SHA512
2a47a09a51fbf77f8b2bcc2d3e46db628d45ebabb9bb4033965b3409810e9a6c55c1008a62bfab5d3ca2a64d8b67f5c726f3682da0132738065c14ff77c1f5bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
00f8adc7460ea41a2d673c93058ef93a

SHA1
1ed90f7659152d6192f18569f7ce8c01f95c347e

SHA256
34d10f515cc3bed3e011175a8fc8cf35ec4c8b8b4a998ffee9118ec6fa1cc629

SHA512
5a5f3ecfdbdeb5c634714315479b3ac95d87607770c9b7b2cff79dd71f104f2be19473281a97f79d01a1750be6d786f5288a9480f785a03f7e24b21087599526

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
264bf61f755b97a0a5d2e7755b733ec3

SHA1
a4115b749faaaf363352bfe35bd23a2697889824

SHA256
e029d3fccc68f9dc949e5776a3bec12dd6617c4efa044e17ec818c72e5cf5655

SHA512
3ca471a606e4a880d4d93ce04bff6130fbdd74debca23b53e3082a5bace7958ca6b6a39b93d402361f69679dd51626b4de514b95a5e4cb416450ae449a5de1d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8e5cbe8b58bc2aae23f0a57121045fd1

SHA1
2d8f1dd709d1728cd0981432b7220774c786c85f

SHA256
b4faea2699551c60dbeb589cabd7bd76f12a71c1ccbc20541d8454bd2963af77

SHA512
0e561d3c13fdaa2932d46f73340747e3f433ba799abde81a51d38407484dadede97763dc7eb842fa3dc4416d03ae153a19cc19b9a3f5d3426252534260058b05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
06031cccee6e1ce17966c1b80f33d9ef

SHA1
8bde290327d41dc22ce2fa24bac69f4e849af953

SHA256
3f5e917be6bfc9311f21bd4a8e702938814a3da67c1220db142cc94976fa4c90

SHA512
1a8875afb7f567c16a1ea01318bd97a06dcffd7470fb80f154dbdc57487c1a50ab21127e8af433f2fb0b1e753813b24d789a4fdfd9992267ff75ef0b15fc7322

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
44cd4fa724374501adca73ffb091cdc1

SHA1
14bc6c4792b3bb6251e689c791c49a1b5a11653a

SHA256
3078de386831fd08b2ee7f7c0c2693daed7f685e02bf71a6a54bc3f4c1f658df

SHA512
2f4485d44043507714f85c959fc628969c51c7695adc75b17c4ddd99680171a964af2714bd25f69c21adfa7ddf8b042b81f54b02226de221bb944f8e823ae917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb888624-2830-4bc5-bbd3-8024fee4bbcf.tmp

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
51737220744ae998a647f63fc44a958e

SHA1
ef1a45055370dc9e854174afcf4e7b1e379ac9b1

SHA256
c1e1f9471ddf219d57ec2cf50d9d407c360cf40c0f1b3aaca9ba6dffa82dc73e

SHA512
0cae16cd39718592cbd0e3347a4714f12f79b6e7dc5c89537ea9fa49f4b83e7a99e436f7c4f1bdb05031ca209abff2316a5860650250d881a241a01c5465b6b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
51737220744ae998a647f63fc44a958e

SHA1
ef1a45055370dc9e854174afcf4e7b1e379ac9b1

SHA256
c1e1f9471ddf219d57ec2cf50d9d407c360cf40c0f1b3aaca9ba6dffa82dc73e

SHA512
0cae16cd39718592cbd0e3347a4714f12f79b6e7dc5c89537ea9fa49f4b83e7a99e436f7c4f1bdb05031ca209abff2316a5860650250d881a241a01c5465b6b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
fcb41ad58ce95a5e47637950596882f2

SHA1
9283b323dfeb67d76f7236cd8fa49c235c6f919b

SHA256
0278d65cbae7d3ef2e22d60b6a663c5eb4ca7c53d80c882cff0eeca86c990788

SHA512
cc7fe7ee1bb287a34464bfde6888fcced1a488f0e5dff45dd40864f99c7425a233181184e0e7e2018a9e5a40ecaa257a03f4e7849c1338ab766f3b35b25d729a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
06ef9a6382f860e6159df943bb4981ae

SHA1
5ef4aa4655bacdcd19b8432521e01a2bc0ba6f0a

SHA256
07e35644881d5b5184e1bd9cc079b7c92d7efc6e0e84781560da36450ceda4ba

SHA512
d8d686a2176e7257565a21c40e6e8b2f8ee9aad4cb9d986077be2f8eb91d19466522000272ef083cb0f76f570478fa803397711ebc7a9f13baf7505d52704994

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
96420236f805262e3f87d863e23f6d51

SHA1
4bdcb150aa7133e07935efe9260a5924cff0cfa3

SHA256
4c73e677b6f0d8687204daf25c42f86cf138dd52a36addd77e2ecea1ec9342e3

SHA512
d2521929b34913f1da00017b698529ecec4ce524916834eb6ccbd0f2795e692f13a08015aa47eeab5ac3816131ff3a1d0b543ac169b15fd675bf8c11e1736de0

Download Submit