c6af29a06b2276173fc80a0b71f3c5400dc89c243c516ca598c71db41c8ad9d9

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2023, 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1312-97-0x0000000000270000-0x00000000002A0000-memory.exe
Size

192KB
MD5

210acfbebe73480cd1d5df6564618ab8
SHA1

b10897e8d9ee1cec2ff55d11768c709a77cb326f
SHA256

c6af29a06b2276173fc80a0b71f3c5400dc89c243c516ca598c71db41c8ad9d9
SHA512

daf1eb0607edbbe5645cfe65ab9ebec16975596130bab4f3803c789f3e0e6e0d8a0e741f7808fe975fe090e7887d5087a87fba1096642bb292197cabafa27e03
SSDEEP

1536:fhbEey6y36sv0W7TDGOIrHuyk7xk2W5/uGxNFVYQffbuclGHQ4N0GkRe8e8h3:flEebE6Cyk9i5/uGxNMS3azNJ8e8h3

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\bf368c4a-8901-4068-b826-687c6ac11dbf.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230702021135.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2408	msedge.exe
2408	msedge.exe
220	msedge.exe
220	msedge.exe
4820	identity_helper.exe
4820	identity_helper.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
220	msedge.exe
220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 220	1508	1312-97-0x0000000000270000-0x00000000002A0000-memory.exe	85
PID 1508 wrote to memory of 220	1508	1312-97-0x0000000000270000-0x00000000002A0000-memory.exe	85
PID 220 wrote to memory of 4044	220	msedge.exe	88
PID 220 wrote to memory of 4044	220	msedge.exe	88
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 1896	220	msedge.exe	90
PID 220 wrote to memory of 2408	220	msedge.exe	89
PID 220 wrote to memory of 2408	220	msedge.exe	89
PID 220 wrote to memory of 3736	220	msedge.exe	91
PID 220 wrote to memory of 3736	220	msedge.exe	91
PID 220 wrote to memory of 3736	220	msedge.exe	91
PID 220 wrote to memory of 3736	220	msedge.exe	91
PID 220 wrote to memory of 3736	220	msedge.exe	91
PID 220 wrote to memory of 3736	220	msedge.exe	91
PID 220 wrote to memory of 3736	220	msedge.exe	91
PID 220 wrote to memory of 3736	220	msedge.exe	91
PID 220 wrote to memory of 3736	220	msedge.exe	91
PID 220 wrote to memory of 3736	220	msedge.exe	91
PID 220 wrote to memory of 3736	220	msedge.exe	91
PID 220 wrote to memory of 3736	220	msedge.exe	91
PID 220 wrote to memory of 3736	220	msedge.exe	91
PID 220 wrote to memory of 3736	220	msedge.exe	91
PID 220 wrote to memory of 3736	220	msedge.exe	91
PID 220 wrote to memory of 3736	220	msedge.exe	91
PID 220 wrote to memory of 3736	220	msedge.exe	91
PID 220 wrote to memory of 3736	220	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\1312-97-0x0000000000270000-0x00000000002A0000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1312-97-0x0000000000270000-0x00000000002A0000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1312-97-0x0000000000270000-0x00000000002A0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe455546f8,0x7ffe45554708,0x7ffe45554718
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2
    3⤵
    PID:1896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
    3⤵
    PID:3736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
    3⤵
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:1
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:1
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
    3⤵
    PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
    3⤵
    PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
    3⤵
    PID:1864
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7039f5460,0x7ff7039f5470,0x7ff7039f5480
      4⤵
      PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,4962490297319289887,6622805547314608029,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3212 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1312-97-0x0000000000270000-0x00000000002A0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe455546f8,0x7ffe45554708,0x7ffe45554718
    3⤵
    PID:2948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
09932bc072dfd2591f537c31e7f7c5bc

SHA1
5992d292629688f3b98db35a6274f9b9ef8baef1

SHA256
41de587416d72dd9c2e27745572592deb76b2646b7c6491a6041019662a10c32

SHA512
0141ddf09fbef149d342e48c3fc98231a707b9d95f52e65c530e3a7d7f4172a68bd15c270eb44759063b528a938a14ab19c5ff400c6f7092aff793d8a93e1a47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
218e449501e9bc2755a9758e17de9cde

SHA1
b29d3810fddc119b996275825d0d6b6bfe00129f

SHA256
6d27f9bfbdbb874d2e62a7e5276ff2405fefb4971374b6b593aaf0e408b15c86

SHA512
5d0fa1934bfe03f54332134d07aad59044b05510c38b2ebd98f963867f2efc1e52aaca23e26925b395e7b5a6ae1a0c95c98d51050c909ae6a2d78ddc8f02cf68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
218e449501e9bc2755a9758e17de9cde

SHA1
b29d3810fddc119b996275825d0d6b6bfe00129f

SHA256
6d27f9bfbdbb874d2e62a7e5276ff2405fefb4971374b6b593aaf0e408b15c86

SHA512
5d0fa1934bfe03f54332134d07aad59044b05510c38b2ebd98f963867f2efc1e52aaca23e26925b395e7b5a6ae1a0c95c98d51050c909ae6a2d78ddc8f02cf68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
066e8a0872f382108700e7fad8e1e9b6

SHA1
787876f5ad5bba98fb2f24798215bf33abc1f0a0

SHA256
1f586616c41c6a19342b0c2d556aab0a5c03ab73640e193713f86cb319b09cd2

SHA512
3ca4a224bf32005bc84dc6b12b89a1895425aa8b43ea507ebb3a771fff42ea2937ab249b7f7fe9948f5aa31944f951deaccd5e54d0056f72b3cfe25c364a46fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
cc801235a81c26e85fc29526d6d531c0

SHA1
16c6ac78a579886c2e0b9f06955ea53906c1af3e

SHA256
e5e10c542c3ed0ee54e974dcea4d303ebff3cf0c2502d6490041ae85c34f4a54

SHA512
155c26387ac1b6463763e3f4b57b72e98c21dc3e9f4b9b148de7818b896a75975a1b69d1268de06fd7bb3d9595f2a095c975140d0218b0b0b581dc99b0e5dfc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe578bf4.TMP

Filesize
48B

MD5
16c6f2facd1a8176a60463f22533b2cf

SHA1
82c4809768ebe2774d354bdc3d9b0d2778368cfd

SHA256
2cd2bdf66f7040abbe5fe6e3166cd09e3be84de2ebd505b9fceaf6c30f9d42ac

SHA512
22d20de4ca960843842266ac62ac2c91b14dc816e127e04e91fc8451b10bf188ac703ab1ea82d59eed86fda821a44c69476f6affed5cf99443f64525b5af083a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
5ffd39373be70a6e05107647e75f9271

SHA1
5a86978aa991a19b647fd9f76dd96272a661d336

SHA256
55f0f9a6068750ec589cb7e73b9662e9243208059c880402f50ee8ef5c0c7570

SHA512
7511f57d2b0835496de5a05b6509a7882a618470e6a0fc5802b88ec30462ad361682675b5d6d521eee01a9bff0611193b1b253f7f4c86e7b1a4eb8d39786beee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
346B

MD5
172a03f1e073cbc347cb5102d038fa13

SHA1
83a95a02491a4b046ea79fd04ccf6c5c24b29d60

SHA256
b8193a8bbd8d5c6b71977d040537ea555fc414cb3f7c2d4166e9bd3ac1ef4e89

SHA512
2a47a09a51fbf77f8b2bcc2d3e46db628d45ebabb9bb4033965b3409810e9a6c55c1008a62bfab5d3ca2a64d8b67f5c726f3682da0132738065c14ff77c1f5bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
1c220ab17f97dbbc9bb6088225a31c63

SHA1
39c869a9080886c93b4e7d075a54b2bdffbb4bf2

SHA256
8912b0709f3c59662791f338b68ac4643fa83e4fa3f34a22f666c588780e66cd

SHA512
54592081a9dd622f61e453ebd146921cd8bda19f58d144318077b77e799cba903254e8065cfff7a8127decd04c3636d21a2ad3aa607ec1d4fbf12f9abdfa4d96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
77d33e02689f7910b202f32e95c197a7

SHA1
e7c794dad4e9510a2f439d22f689c260ac5cffa4

SHA256
78c05356f81b2348348e55d9493b82dff7eee664923f1e03a3f90753cb1b3b4f

SHA512
96c866ac16a0c93a1e71e6bf9420f7960dcaf4a0c8e0fd816668f2adddb3d5dc62068b10c70605bc87dcb54e79a1c80a2e82f04a125430b93b45bc71638d5f77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3e2d7e875b71c77e7c3b7f6373019b62

SHA1
e803c1e028e9fae9522646f6057bd6f8853b5d9d

SHA256
7af5b889035c284b1bff3d10f35f76007d88e6877c579540749708d8ba7fc8ff

SHA512
dac73e50ec6473073bad38b986f8912992020e286a8011e5e6ade0a16fddfc77615b2d72f16ebeae61d3c141d85e4327f6cde80246597997259f57f4d979ee02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
06031cccee6e1ce17966c1b80f33d9ef

SHA1
8bde290327d41dc22ce2fa24bac69f4e849af953

SHA256
3f5e917be6bfc9311f21bd4a8e702938814a3da67c1220db142cc94976fa4c90

SHA512
1a8875afb7f567c16a1ea01318bd97a06dcffd7470fb80f154dbdc57487c1a50ab21127e8af433f2fb0b1e753813b24d789a4fdfd9992267ff75ef0b15fc7322

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
44cd4fa724374501adca73ffb091cdc1

SHA1
14bc6c4792b3bb6251e689c791c49a1b5a11653a

SHA256
3078de386831fd08b2ee7f7c0c2693daed7f685e02bf71a6a54bc3f4c1f658df

SHA512
2f4485d44043507714f85c959fc628969c51c7695adc75b17c4ddd99680171a964af2714bd25f69c21adfa7ddf8b042b81f54b02226de221bb944f8e823ae917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
367B

MD5
f7b226bcf6a0409d16b00080af69668c

SHA1
8d0061594dce4451732f11ce852385b78b706f17

SHA256
e5017872d17c0f58564c39c85f5af3049afc7d38bcc8a3a0dda22b4818f3d8e2

SHA512
33d4cafdbd5a3eba890875adab6e6d1b71a1fc7028cd4b3743110a6e9a6e7b97bf14f21ff944db0a8ff4978533aa9117a9aac0abead195b693afc35a56dddd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5774f1.TMP

Filesize
367B

MD5
7d8e360be80d7a00dcc8894db7afd5ec

SHA1
00451304ffc24637d136c30e53b63d7407fd8a12

SHA256
86679e591c195211455416bdf804c4b49b632098228566ad78690a090ccb2a9b

SHA512
a3c32b037d99d9f501eab2b6255e58fc71e6e378c0428b03438510256343be611713d4533b8bc913507bd7b6a44d4f6f373314860df5a81473bc29b1009dcaec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
b9b09ca72b315075eb5b402b4e4f2c25

SHA1
ed86b2cdfd3c9073daaa91fe3054ef088ee05043

SHA256
f8fbdd9cc0ab75783c275ae3deb6fe67448f48b01326b2eb5601e033896f3b7c

SHA512
fc0ccf5c773961f2d282d7683a1754ca52b9b0946dacb97daef7fa38567269d89ec36a10713410eac8c7e7fced398e118324ce3330c38a9f64dd7b387820dc9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
9fdc7622ca238d9163890b354e1b6a41

SHA1
3cb4700f072bd183780721ab8d21ad402db6bb4d

SHA256
4e5a2a6de5fa023455c7855d63c59b3b6dda2dc37ef96343b5a6eb082d903939

SHA512
2b131e059f10095a1ffc6051050d6181df1fb041942a0a507bb28c57ded019d7ddfdafe1cd1b05fe8344238621bc9fcaf1c37ce871d0683d10435f9e043edbf0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
3a9c57ea0cd76fb31e40b3d2b2a79ff9

SHA1
23acd2d8a83121868ef1e8bffc29df18f799f61f

SHA256
8e2663ad72e0e84f7947741e1140fe25b845a150951b4a2958e2c688b30f475a

SHA512
85502c1e6e3dcda4751428f11ef1eb0bb12f089ec933a022b8a9f93763a5045525fbff27f164d468d659c179dc3afaa29e70b5dc6b365c3e9ff6d866cfc37d58

Download Submit