7a8ecee4a39a1fcff06ca7383018b0e491277e47dd9da60d894aa1e2f94b8275

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2023, 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

544-97-0x0000000000350000-0x0000000000380000-memory.exe
Size

192KB
MD5

6e4749f81706b38ad6e4734dea4611c6
SHA1

4f76a2c0c744ee00b05c6a0c454d1aa9144a0b3e
SHA256

7a8ecee4a39a1fcff06ca7383018b0e491277e47dd9da60d894aa1e2f94b8275
SHA512

5ba7fc3976e81530a76709e0b0a03292f77895b1f12fc6e39bbb31777410fea642dd65be6dfb5e1aa383906388258dbff8dc9610343a41151ba80a2d05d4942c
SSDEEP

1536:+hbEey6y36sv0W7TDGOIrHuyk7xk2W5/uGxNFVYQffbuclGHQ4N0GkRQ8e8h3:+lEebE6Cyk9i5/uGxNMS3azNj8e8h3

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\d4ae7a21-5bbb-457a-a10b-410b23527a49.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230702184215.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
976	msedge.exe
976	msedge.exe
996	identity_helper.exe
996	identity_helper.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
976	msedge.exe
976	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 976	2204	544-97-0x0000000000350000-0x0000000000380000-memory.exe	85
PID 2204 wrote to memory of 976	2204	544-97-0x0000000000350000-0x0000000000380000-memory.exe	85
PID 976 wrote to memory of 2364	976	msedge.exe	88
PID 976 wrote to memory of 2364	976	msedge.exe	88
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 3748	976	msedge.exe	90
PID 976 wrote to memory of 4924	976	msedge.exe	91
PID 976 wrote to memory of 4924	976	msedge.exe	91
PID 976 wrote to memory of 3040	976	msedge.exe	92
PID 976 wrote to memory of 3040	976	msedge.exe	92
PID 976 wrote to memory of 3040	976	msedge.exe	92
PID 976 wrote to memory of 3040	976	msedge.exe	92
PID 976 wrote to memory of 3040	976	msedge.exe	92
PID 976 wrote to memory of 3040	976	msedge.exe	92
PID 976 wrote to memory of 3040	976	msedge.exe	92
PID 976 wrote to memory of 3040	976	msedge.exe	92
PID 976 wrote to memory of 3040	976	msedge.exe	92
PID 976 wrote to memory of 3040	976	msedge.exe	92
PID 976 wrote to memory of 3040	976	msedge.exe	92
PID 976 wrote to memory of 3040	976	msedge.exe	92
PID 976 wrote to memory of 3040	976	msedge.exe	92
PID 976 wrote to memory of 3040	976	msedge.exe	92
PID 976 wrote to memory of 3040	976	msedge.exe	92
PID 976 wrote to memory of 3040	976	msedge.exe	92
PID 976 wrote to memory of 3040	976	msedge.exe	92
PID 976 wrote to memory of 3040	976	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\544-97-0x0000000000350000-0x0000000000380000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\544-97-0x0000000000350000-0x0000000000380000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=544-97-0x0000000000350000-0x0000000000380000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe399146f8,0x7ffe39914708,0x7ffe39914718
    3⤵
    PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,17664718434750914280,4215962258965945446,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,17664718434750914280,4215962258965945446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,17664718434750914280,4215962258965945446,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
    3⤵
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17664718434750914280,4215962258965945446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
    3⤵
    PID:2200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17664718434750914280,4215962258965945446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:1
    3⤵
    PID:1620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17664718434750914280,4215962258965945446,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:1
    3⤵
    PID:312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17664718434750914280,4215962258965945446,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
    3⤵
    PID:1164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17664718434750914280,4215962258965945446,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
    3⤵
    PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17664718434750914280,4215962258965945446,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17664718434750914280,4215962258965945446,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,17664718434750914280,4215962258965945446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
    3⤵
    PID:3948
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:1532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff65f5b5460,0x7ff65f5b5470,0x7ff65f5b5480
      4⤵
      PID:2848
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,17664718434750914280,4215962258965945446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17664718434750914280,4215962258965945446,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17664718434750914280,4215962258965945446,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
    3⤵
    PID:2824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,17664718434750914280,4215962258965945446,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5508 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=544-97-0x0000000000350000-0x0000000000380000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:60
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xd4,0x110,0x7ffe399146f8,0x7ffe39914708,0x7ffe39914718
    3⤵
    PID:4108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
09932bc072dfd2591f537c31e7f7c5bc

SHA1
5992d292629688f3b98db35a6274f9b9ef8baef1

SHA256
41de587416d72dd9c2e27745572592deb76b2646b7c6491a6041019662a10c32

SHA512
0141ddf09fbef149d342e48c3fc98231a707b9d95f52e65c530e3a7d7f4172a68bd15c270eb44759063b528a938a14ab19c5ff400c6f7092aff793d8a93e1a47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
218e449501e9bc2755a9758e17de9cde

SHA1
b29d3810fddc119b996275825d0d6b6bfe00129f

SHA256
6d27f9bfbdbb874d2e62a7e5276ff2405fefb4971374b6b593aaf0e408b15c86

SHA512
5d0fa1934bfe03f54332134d07aad59044b05510c38b2ebd98f963867f2efc1e52aaca23e26925b395e7b5a6ae1a0c95c98d51050c909ae6a2d78ddc8f02cf68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
218e449501e9bc2755a9758e17de9cde

SHA1
b29d3810fddc119b996275825d0d6b6bfe00129f

SHA256
6d27f9bfbdbb874d2e62a7e5276ff2405fefb4971374b6b593aaf0e408b15c86

SHA512
5d0fa1934bfe03f54332134d07aad59044b05510c38b2ebd98f963867f2efc1e52aaca23e26925b395e7b5a6ae1a0c95c98d51050c909ae6a2d78ddc8f02cf68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
218e449501e9bc2755a9758e17de9cde

SHA1
b29d3810fddc119b996275825d0d6b6bfe00129f

SHA256
6d27f9bfbdbb874d2e62a7e5276ff2405fefb4971374b6b593aaf0e408b15c86

SHA512
5d0fa1934bfe03f54332134d07aad59044b05510c38b2ebd98f963867f2efc1e52aaca23e26925b395e7b5a6ae1a0c95c98d51050c909ae6a2d78ddc8f02cf68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
34e3e01fde6f281fbd7eee2385d3d528

SHA1
2dfa7fbda1100929da8f8db7fc1c8f9b50724a34

SHA256
244acf8d65f3094cb00f0189fc9776559c14704230416f645dc4597a1d07521a

SHA512
08eef767eedfcabacd57a4166a12103046bb1b531cd08120787099115e8b34cc276f658d949a2e05d43063dcfeff3ff1dd72ff64a0b7a1a4dc259dc9fa342f86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
46e474448022456d1c67bf53b42c8294

SHA1
a57de1f5b09ec44489b0449c0aee267a7f64924c

SHA256
1858e41d8c674e9bc1a88952258f0386220884e150ebec483955763bac57e018

SHA512
914c8b05c9471e4790975e21decd608fe66cda027cc356c85d6aa753a8eff6829771663c675f0188ee911361cbbc040b44686ba683237ec567b4940f15e252dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
0116966009fa705d2befc41f060fccbe

SHA1
744d3d9364741abf974d9d7c4d246f6de3b5df9b

SHA256
83c8d6a5f115058f1d64aae1c0895d432dbbaa13208760adea411e43c85fdacd

SHA512
53acf173e643f3261f3bdc943aae32cce1ef93830cafc27be0b894ea172c0c97f87f9ef23e145e86433c15125833f1a8abdf15a8f0fe9dab2f9f124b2a66dc93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
346B

MD5
172a03f1e073cbc347cb5102d038fa13

SHA1
83a95a02491a4b046ea79fd04ccf6c5c24b29d60

SHA256
b8193a8bbd8d5c6b71977d040537ea555fc414cb3f7c2d4166e9bd3ac1ef4e89

SHA512
2a47a09a51fbf77f8b2bcc2d3e46db628d45ebabb9bb4033965b3409810e9a6c55c1008a62bfab5d3ca2a64d8b67f5c726f3682da0132738065c14ff77c1f5bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
f87b5cf29e6145b4414400458492813c

SHA1
8cd5a152620a308fff7ced5b04062840a6ff4e2c

SHA256
9c6548202fcb01ed81709b3413b073b4ff935c5fd896a00647dd8a3886447934

SHA512
e7355d0a62850401c22d0fb423157e59183a51212719503a254dafaf4b2468761cd5b151f29bfdc0f25bcadf7425c63c63ad2f49a420eae0c9160cb88158ef8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
98c59c8d4f1e1124f7e172f744ed2ee0

SHA1
57ebf731498f7faa5c615c9860ca7141db995d80

SHA256
8af64bf4948d7c2346cb269ecca66a52235d47751812588ec3cc53eef2c97e2d

SHA512
5afe5a8895e922d7011d523b57d833e3938496391e807df91ea514dde8bd7755a714c11e651fe08fbc8cff439012cf6eed9f5a77378a75045532a4e718f93789

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ece057bc855367a3aba1f630af9b1c31

SHA1
0105572f4d8270b33125079cd944e773e26b9ea1

SHA256
b492af9790d39620244fd66f9c72c960ca4c8b91b99c42e9943f5ffc64398f6c

SHA512
e732ff0765f4c027877b208b60bdcd90dd50f98c067737f9685f2c6d95605bba56deed4091a84092c1dafd49d48630235999728024b39f6a02669e31e286f22b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
06031cccee6e1ce17966c1b80f33d9ef

SHA1
8bde290327d41dc22ce2fa24bac69f4e849af953

SHA256
3f5e917be6bfc9311f21bd4a8e702938814a3da67c1220db142cc94976fa4c90

SHA512
1a8875afb7f567c16a1ea01318bd97a06dcffd7470fb80f154dbdc57487c1a50ab21127e8af433f2fb0b1e753813b24d789a4fdfd9992267ff75ef0b15fc7322

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
44cd4fa724374501adca73ffb091cdc1

SHA1
14bc6c4792b3bb6251e689c791c49a1b5a11653a

SHA256
3078de386831fd08b2ee7f7c0c2693daed7f685e02bf71a6a54bc3f4c1f658df

SHA512
2f4485d44043507714f85c959fc628969c51c7695adc75b17c4ddd99680171a964af2714bd25f69c21adfa7ddf8b042b81f54b02226de221bb944f8e823ae917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
369B

MD5
e9b8cead73cd61cd84f56a1c87616547

SHA1
01089e411133577a8a654726a7f2a9ebf2b16d1c

SHA256
1a350c1edefeec3e9697a15b948ce7fe2806f0c205d72f7a79809ba52c163faa

SHA512
97faf7e913b7a807ec4aad87bcdf367557883182e8586fc356176b8ac03be8b57989e058862b1a13843d65167fc7b7c0a6acdee9874823178c9cefc40466f1b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ae22.TMP

Filesize
369B

MD5
a997e270776ff9e5bd3e8d60c83e9018

SHA1
95231aea76aa4e51e339b5b38690a305086628de

SHA256
c2777dbb7163e159daba37d1829b80c2f3808890be96d981d38655e72d48019c

SHA512
f5bd3de443558b60b2e6e360f39639236d74e5baa1619e879bf6129efc25e203983b379792a7e01840d22a44b486df090d4dac43b31d562f6670affc62e59399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
bf8c2e4866275aae9ba8a2c824348919

SHA1
fd7891c5941b4ef74be64803fa8afbce57f42cd6

SHA256
cf423676c575910a8f6a8b447940540385905fb6bad8eb1dee3c884d9009428e

SHA512
2f3f0fa07cd7f8a98c98d2bc940babacd93e9bd5f910a3c874ad8c98425e31e645bc459f738f210bfdcd4891e6c236e9c08a80dcd249baeccacbde2948ce9de6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
36f0886c0d13f238e53193720072a062

SHA1
4d2fd4eb40361768a87b17598373e5236e4a4793

SHA256
8d888d66369f9e51494ec659e60772377a3c926b0f5f1509c6e335c2a537f791

SHA512
5b9270f0855126f498bef93f13e7452f8fa0aecaa620eecb366e7d9bb05d19b4b9ac1717ea9377eade190dd683b8ec46013b3589d29774f3a00b38ae1fe99f2c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
472f67b34c27a2c789e40a9643b6df91

SHA1
dda56efe1245aace87e779a657a89c820dbd5446

SHA256
9a50abe4a2ca23b2a5c0744d9847612996df70c0d3bb783e1b30f1a6e6c86678

SHA512
ed2f86ab5f8451efe9e57efb0bd76c6e056b7e43e007327afa0fe82512052231aa61d3fcdfdaafb63796e2ba6e6ee7af3b08594f06e8d546e7d71d1b6ca40256

Download Submit