5564e95b135b335602654079af93b02b717735ff362b19638671461d5dad66ca

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2023, 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1976-123-0x0000000000270000-0x00000000002A0000-memory.exe
Size

192KB
MD5

c8c4a136e22a26c3fa7d0bba9b7b9fa9
SHA1

910eded4f13cacccac46b57c8e881cb897b3aaa3
SHA256

5564e95b135b335602654079af93b02b717735ff362b19638671461d5dad66ca
SHA512

fd3ada302acff2efac6116f8aada15e06bd54bec1c2d80992a53f9bfe000665953d649dc88b770e4634479bb7ca9f0616789d8f2b99823b0081944cb837a5f16
SSDEEP

3072:JUUEa9Te3JQBf8td3/oxN1ULH0tyq8e8h4:K7QRyi1tyq

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\c9390be6-5ad5-438a-ac7b-1e9d2eb6387c.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230701191750.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3420	msedge.exe
3420	msedge.exe
3844	msedge.exe
3844	msedge.exe
884	identity_helper.exe
884	identity_helper.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe
5912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 3844	4348	1976-123-0x0000000000270000-0x00000000002A0000-memory.exe	87
PID 4348 wrote to memory of 3844	4348	1976-123-0x0000000000270000-0x00000000002A0000-memory.exe	87
PID 3844 wrote to memory of 4776	3844	msedge.exe	89
PID 3844 wrote to memory of 4776	3844	msedge.exe	89
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 852	3844	msedge.exe	90
PID 3844 wrote to memory of 3420	3844	msedge.exe	91
PID 3844 wrote to memory of 3420	3844	msedge.exe	91
PID 3844 wrote to memory of 4492	3844	msedge.exe	92
PID 3844 wrote to memory of 4492	3844	msedge.exe	92
PID 3844 wrote to memory of 4492	3844	msedge.exe	92
PID 3844 wrote to memory of 4492	3844	msedge.exe	92
PID 3844 wrote to memory of 4492	3844	msedge.exe	92
PID 3844 wrote to memory of 4492	3844	msedge.exe	92
PID 3844 wrote to memory of 4492	3844	msedge.exe	92
PID 3844 wrote to memory of 4492	3844	msedge.exe	92
PID 3844 wrote to memory of 4492	3844	msedge.exe	92
PID 3844 wrote to memory of 4492	3844	msedge.exe	92
PID 3844 wrote to memory of 4492	3844	msedge.exe	92
PID 3844 wrote to memory of 4492	3844	msedge.exe	92
PID 3844 wrote to memory of 4492	3844	msedge.exe	92
PID 3844 wrote to memory of 4492	3844	msedge.exe	92
PID 3844 wrote to memory of 4492	3844	msedge.exe	92
PID 3844 wrote to memory of 4492	3844	msedge.exe	92
PID 3844 wrote to memory of 4492	3844	msedge.exe	92
PID 3844 wrote to memory of 4492	3844	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\1976-123-0x0000000000270000-0x00000000002A0000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1976-123-0x0000000000270000-0x00000000002A0000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1976-123-0x0000000000270000-0x00000000002A0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xb0,0x104,0x7ffbecbd46f8,0x7ffbecbd4708,0x7ffbecbd4718
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,3899981357117690698,2861941052340559591,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
    3⤵
    PID:852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,3899981357117690698,2861941052340559591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,3899981357117690698,2861941052340559591,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
    3⤵
    PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3899981357117690698,2861941052340559591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3899981357117690698,2861941052340559591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3899981357117690698,2861941052340559591,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
    3⤵
    PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3899981357117690698,2861941052340559591,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
    3⤵
    PID:904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3899981357117690698,2861941052340559591,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,3899981357117690698,2861941052340559591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:2364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7b8d95460,0x7ff7b8d95470,0x7ff7b8d95480
      4⤵
      PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,3899981357117690698,2861941052340559591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3899981357117690698,2861941052340559591,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3899981357117690698,2861941052340559591,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3899981357117690698,2861941052340559591,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,3899981357117690698,2861941052340559591,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,3899981357117690698,2861941052340559591,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4812 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1976-123-0x0000000000270000-0x00000000002A0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffbecbd46f8,0x7ffbecbd4708,0x7ffbecbd4718
    3⤵
    PID:4024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ed9cfbe2b6990431cadc59eee86c6000

SHA1
cb656fb2480b9f2869949be67cbd662d635bf5fe

SHA256
3b7a8f91da1d21e3a6967f49eab6e6e2c187b12c5fe06669ed3d0f9068128f69

SHA512
32b4181083628ed6d5d18ca56c6b79ff8685d8f18cc598f96b64a9070bccf4d466e79b3c5a56d03c265ea303bcc0b76dc1992d725303b0126667b8b93cd87d8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e479233da77016935baabcddd19fdd3d

SHA1
d09799ad7a9cb76c66dbdcb02a2824676d676b0c

SHA256
3a2196aa6d57fe0af58a13f3a73bc8e65b9a118863d7ed26beaf6616128f8575

SHA512
9e5a63eecf7aa6ded9f02be9bec7a561c092ca7e33c1ecb722bb5763719a0adff9976d75ac1e1b8a634656147b304ae9451bcf4bd417550e8081e5d57e22c33c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e583a28f09b5d3d61367a3a0ea2df00

SHA1
01d0a0e11d0508f2926cb089d2a17f3eb68d27a0

SHA256
1d022371732e494625ae7f505ae26cea8185433e5b3a826dd7f5bb892d324788

SHA512
01e83d7bc2dd807613edddb1e724eaa3a0674a9cd0c33072d05e537b97ee6c7526cced5a8918f9909039d14f0f79a766ef8857d3d026a06ae6193f5358e9fa41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
87130163754e781f58ceab3573fa5d56

SHA1
884be5287a897d868d557acddbbf4aecd7ca5a9c

SHA256
c70113d6cfa3e3924bc3a0a974bef8c5d905633e0d74166021141993590b46ec

SHA512
f7fd60244e0761f7886754aa7812a6852751c33153fb0eb5533920d32605e4552a8f5fa30686b19d27d773c15a0dd2ae65ee6db22255b62e095150aa4081b55f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
954d0f99d27c3977e979ab856f15d26c

SHA1
c84fc4a36d2260a9da6b8ba38564c42591849897

SHA256
750666c85fafa4f6549e5d3529ff4215b24290851c70624c30a7ed86f75a6865

SHA512
c894c308919fb2d40ac2d70cfb2428c741733e66bb0e755064109cad085fb662af6701884522dd54c383c7716e0929649ff3ab539e79272a097f074e45479d1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
3e29dca7d5fcb001b663e2b040c402e3

SHA1
9afb66986f9ccb5d103a9fe86dc52c0f4be86464

SHA256
0e0413bb8dfe52e1d1196c7eb4c4d90cec51f37806f1df608765e619f00f17d7

SHA512
02c9664ac7eb795c6fe849ab53b24c930bf3fdcfdd43ad478b7ac8c49e086eb7cafb3918bb67b5b2015e9af92a04a8b4a56ea2b42efd8233af1b3bfc25ecf627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
346B

MD5
172a03f1e073cbc347cb5102d038fa13

SHA1
83a95a02491a4b046ea79fd04ccf6c5c24b29d60

SHA256
b8193a8bbd8d5c6b71977d040537ea555fc414cb3f7c2d4166e9bd3ac1ef4e89

SHA512
2a47a09a51fbf77f8b2bcc2d3e46db628d45ebabb9bb4033965b3409810e9a6c55c1008a62bfab5d3ca2a64d8b67f5c726f3682da0132738065c14ff77c1f5bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
c30a23111889050d66247d99e9e7d3eb

SHA1
4571418fa01342745cdef1d2c3a4c1c9d80e9773

SHA256
2a22c9ed1fa88c0f8d51a1c83ce4399d507a5bbd07122210e21d3f29a3255642

SHA512
fe12cd26a4ec5e7b7e3d4ec851539000f40a2dfd5b19c69ae38de97affc791e45b5e37ca3696559c654123c3c56bab521fa69dd235b6b47a6476b419ea01eacf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
09b34d2866f17b6f2071df327331c969

SHA1
5b2014bbd01349c3c760bec8c663598026c56af6

SHA256
fa78146c2af862594e2b851107d3077d2b16c343076aec3aa7d3fd33f7be7cef

SHA512
212f938fe06717a7180945e881272d080bfb329121077b26b9120de86c68493b07c9587047a420bd1e6547640ba2a8cce5f4a4c1f1ae03e0124c9853281fea92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
97be0321729aa5a048fbde13cbe80adb

SHA1
15d1e7c2a0df296531e8c1702d187ba95201c0e2

SHA256
952e70b474a2293487123cad73378aad5a4399af4fdcdb998aa2ecc62bbd3e52

SHA512
aefac62acadaffbf3bf44a41e3bd20bcdb12638aa6e0ae42717f675e711780993e625851609e8e309665e345173446109961205f83b72c7cb84c8fbd921dd8e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c7e3ef66babd460268e7ff8846ad5392

SHA1
1f1df8f52b64d8faf6e7408e37b427828ffa1bc0

SHA256
18adc63cb792f32e070a5ed545bb177e7b8f76d51b877418f487275bc5173941

SHA512
8f768d6190236946db40e647c05c1cc52249c20cd6b3490f2d5114ffe86a542a3e2f27612e6c0486234af8235c7f7f709de37023e5b65503fa97ddc7ac251aa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f1e05306f1cdc82fba51a674a801a193

SHA1
819e8799911cd6aebacd0d90ce28538e5c4edd5c

SHA256
f78d41f65b348543bbc3b8b64e1723fce63adcfcdf9fb8eb015bb1a70ef01813

SHA512
8a46e69ba3c5d81ed63c91b41e28a7941ae878fbb5117d9902484c519e096aab3943c8e5e635b5e5ba8f36e90328559ecbab36e450d754261c1e94073f2fc74f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
1c784f204a85c2e11adb5596aa278a73

SHA1
850721962d55eadf53a0a36d8c903f8b6cf1e6aa

SHA256
363b153ffcdd3abbf71e0a5025b8fc7700822ece5c0f0f102e354cd22805d1c7

SHA512
a33dfa9038ff7e3ae3741d05ff7dd2933df994c4c8f328cbd49ebb70bd92d0624ae5c6bb28e2168319967926938e1605055cb45b817e7b988a51777a09b8c850

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57327a.TMP

Filesize
371B

MD5
5746f87d727b8deef6307b7265dcc6fd

SHA1
d13813de5e408fd85fbd503763a3ec2dbc7bef42

SHA256
22e0cedad8c408769138b374bce266f54c6c8f6a23c85ce61877dfe0663c1a64

SHA512
c1a6b55c909120be9cd0971973bbeb59e6543034985bf870e45e3840e569c3da3df9dae1912e417fc9712887d236308c29b5b5ccec75986ae36518b75127c32a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
87d9462aad17ac10afb8ec0286020468

SHA1
01b69b0decc7b5aaa309c6e8c789f25377b1f9ae

SHA256
f46df001b9dba57a34c093d2a809273eabf6c9c262bb3f8128e59a93b5eef60c

SHA512
c016ba1514c151a7ebdb0422be8f435a0c3b94478db438165e5325b41456916ddcc6a899c015a489de453cccca6b42fe20153d6d0c44b60acd2a6e629b413ff5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
47fab26987d006b3e2e7eca506876ca5

SHA1
1053c2d5db304f9f38cffa57754266c1d7d652b6

SHA256
0af6bede516b321eeb89b0359d2ae94fa20bf5fd503297fc07251c1e8b2a9d48

SHA512
77b1bc4b0a86058e741dc16326e03059d8cc8977aee68b457f639dcc372eeda54d3d018a2053484d7aab9feb673acd6989319b2203a75c0fc017b81c08195885

Download Submit