hxxp://canarytokens[.]com/stuff/csyvn8lv2uue13cib4gqnwuo7/contact[.]php

Resubmissions

02-08-2023 15:51

230802-takwkafd75 1

02-08-2023 15:47

230802-s76zmafd63 1

Analysis

max time kernel
166s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
02-08-2023 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://canarytokens.com/stuff/csyvn8lv2uue13cib4gqnwuo7/contact.php

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
4064	msedge.exe
4064	msedge.exe
4080	identity_helper.exe
4080	identity_helper.exe
4044	msedge.exe
4044	msedge.exe
2652	msedge.exe
2652	msedge.exe
3684	identity_helper.exe
3684	identity_helper.exe
1096	msedge.exe
1096	msedge.exe
224	msedge.exe
224	msedge.exe
1412	identity_helper.exe
1412	identity_helper.exe
4240	msedge.exe
4240	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
5056	identity_helper.exe
5056	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 1272	3616	msedge.exe	57
PID 3616 wrote to memory of 1272	3616	msedge.exe	57
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 1328	3616	msedge.exe	89
PID 3616 wrote to memory of 4064	3616	msedge.exe	86
PID 3616 wrote to memory of 4064	3616	msedge.exe	86
PID 3616 wrote to memory of 1972	3616	msedge.exe	85
PID 3616 wrote to memory of 1972	3616	msedge.exe	85
PID 3616 wrote to memory of 1972	3616	msedge.exe	85
PID 3616 wrote to memory of 1972	3616	msedge.exe	85
PID 3616 wrote to memory of 1972	3616	msedge.exe	85
PID 3616 wrote to memory of 1972	3616	msedge.exe	85
PID 3616 wrote to memory of 1972	3616	msedge.exe	85
PID 3616 wrote to memory of 1972	3616	msedge.exe	85
PID 3616 wrote to memory of 1972	3616	msedge.exe	85
PID 3616 wrote to memory of 1972	3616	msedge.exe	85
PID 3616 wrote to memory of 1972	3616	msedge.exe	85
PID 3616 wrote to memory of 1972	3616	msedge.exe	85
PID 3616 wrote to memory of 1972	3616	msedge.exe	85
PID 3616 wrote to memory of 1972	3616	msedge.exe	85
PID 3616 wrote to memory of 1972	3616	msedge.exe	85
PID 3616 wrote to memory of 1972	3616	msedge.exe	85
PID 3616 wrote to memory of 1972	3616	msedge.exe	85
PID 3616 wrote to memory of 1972	3616	msedge.exe	85
PID 3616 wrote to memory of 1972	3616	msedge.exe	85
PID 3616 wrote to memory of 1972	3616	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://canarytokens.com/stuff/csyvn8lv2uue13cib4gqnwuo7/contact.php
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7c6a46f8,0x7ffc7c6a4708,0x7ffc7c6a4718
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2348,10392887445351558810,10789381773164979920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2348,10392887445351558810,10789381773164979920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2348,10392887445351558810,10789381773164979920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2348,10392887445351558810,10789381773164979920,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2348,10392887445351558810,10789381773164979920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2348,10392887445351558810,10789381773164979920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2348,10392887445351558810,10789381773164979920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2348,10392887445351558810,10789381773164979920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2348,10392887445351558810,10789381773164979920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2348,10392887445351558810,10789381773164979920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2348,10392887445351558810,10789381773164979920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1972 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2348,10392887445351558810,10789381773164979920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2348,10392887445351558810,10789381773164979920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2348,10392887445351558810,10789381773164979920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2348,10392887445351558810,10789381773164979920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2348,10392887445351558810,10789381773164979920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2932 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2348,10392887445351558810,10789381773164979920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:2400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc7c6a46f8,0x7ffc7c6a4708,0x7ffc7c6a4718
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,8470073849257715894,11471894914854307483,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,8470073849257715894,11471894914854307483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,8470073849257715894,11471894914854307483,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,8470073849257715894,11471894914854307483,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,8470073849257715894,11471894914854307483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,8470073849257715894,11471894914854307483,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,8470073849257715894,11471894914854307483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,8470073849257715894,11471894914854307483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,8470073849257715894,11471894914854307483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2216,8470073849257715894,11471894914854307483,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,8470073849257715894,11471894914854307483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:3044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://microsoftedgetips.microsoft.com/en-us/collections/editor-picks/i152?form=M5006R&OCID=M5006R
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7c6a46f8,0x7ffc7c6a4708,0x7ffc7c6a4718
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,17882675723384849018,12059101433710396998,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,17882675723384849018,12059101433710396998,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17882675723384849018,12059101433710396998,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17882675723384849018,12059101433710396998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17882675723384849018,12059101433710396998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17882675723384849018,12059101433710396998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17882675723384849018,12059101433710396998,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17882675723384849018,12059101433710396998,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17882675723384849018,12059101433710396998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17882675723384849018,12059101433710396998,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17882675723384849018,12059101433710396998,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17882675723384849018,12059101433710396998,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17882675723384849018,12059101433710396998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:1896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7c6a46f8,0x7ffc7c6a4708,0x7ffc7c6a4718
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,14084055040604682797,11003113653936642921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,14084055040604682797,11003113653936642921,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1500 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,14084055040604682797,11003113653936642921,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,14084055040604682797,11003113653936642921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,14084055040604682797,11003113653936642921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2252 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,14084055040604682797,11003113653936642921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,14084055040604682797,11003113653936642921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,14084055040604682797,11003113653936642921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2192,14084055040604682797,11003113653936642921,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,14084055040604682797,11003113653936642921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,14084055040604682797,11003113653936642921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,14084055040604682797,11003113653936642921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,14084055040604682797,11003113653936642921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,14084055040604682797,11003113653936642921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:1812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6b909b26-54d4-4498-a9c9-168d43a1b5a7.tmp

Filesize
14KB

MD5
0d098cc3c8199c19e7415f5bea27a9b7

SHA1
1737fce8eddcdee711a13275417241af47d32ba8

SHA256
e01a3f523a92e01a64a5c9dd31a667c076908dbd5bc6966b4e6a0f715cfbc36a

SHA512
46868c831d3a400098bb9a36134ee89bf723bbf83b67b5a3d54730a156068e119410ac8dff690531d531f383ed1c04f9e141da35c23384a3d1e149aa3dc847f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7ad9bb1054aa03e39b3554833d0c3ec

SHA1
cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9

SHA256
0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189

SHA512
d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7ad9bb1054aa03e39b3554833d0c3ec

SHA1
cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9

SHA256
0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189

SHA512
d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5f8c35b1cfe162686585620d98b8e61a

SHA1
8d73dd3db2a01bbda90967614c4374f86ada01d3

SHA256
4d3519fc702bf1a61dd9d334a285b9ad94622cb1c63999bbaf50cfa0592abe3e

SHA512
3be97c9452fea357014946bb2100e081716205a266ebb5443840bd0eb5d16237b85b5a02b75e2b6f018f0662428f506a6e48fe8c4b9903be7a20b90d73a67f7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ef7e3f77012999a589652438b896a209

SHA1
d566d4618b1d926952ec77a404d44a06242c9268

SHA256
d0896ff63565557c9768ebb15bd7715d0497076b45bf48929f8c2f34903bdc10

SHA512
3d6eb161d0cf821814f019d0cc3fab57d5a2646db90ff0d1c752842db011e1394d2d564305135f571eea133effb4b53f0894654a19c5f7ea3f64a39b65c3170b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0212804026b944f89b5f2fa3557137c2

SHA1
319b54cc667bc966e9439b42fd9c212f001f4b45

SHA256
d89c7ba78fdb557f293f9b233fe26ba0d0ddccf4a16a1a1aca710c66bd8fa039

SHA512
81e426322d6eeec5268fdd5a92056b43ac70082857ea7f061c17985946812120fa48547b9a28f407cd6950f3311f40b468a33e8d20f524c9674b84c7c1948c6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
95f5e75961c4ea039d0d2dd8e5b4f04b

SHA1
7b71f7bea873ae12f83f70c80a60b4ad74ff40bc

SHA256
39951ee14c8bba4f94e9b59efd8a91abb60c710fe0cd7798514369c678600d23

SHA512
5aa7451854a2aa50c7e96bd08c94f2cb6a5c1c9d01aadb730221b80f17b35d6be3e9adcdee6f02151b7154362209d9c98738cbdf34820763913209b355cbc0ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
ba94d8c0f6c9a75e9e6c538b1dbad5d7

SHA1
52f28e61a68f0dabd55cd5e15eef9766aa5577d4

SHA256
6a6a8e817b4f0799adb1f73bbbf0080655975d2adb604f8cb80878a305f0fa27

SHA512
e06e89ea32db40c25f64239e3741e2b0cd4f9975437285a028c1485f2fb3a2b97e6770f091c26a4424fe62cecaf7262aa7cdd1addf6a61ceeaa6a11012b12a81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
12cf89db8ab773e5d030ffdff3148271

SHA1
633b03cc4980ae754b6fd4d4aac7b93104a61fcc

SHA256
ff881a511c072a0a86d2113ab86f91b3b051a8f1bdbecb561f7a24fc8c83bc7d

SHA512
4dc48bb3329fac4dee2b23d20a1caecb45569bf6a61f51df30b83ac5cb667c28f27769b0c36c71625697ed36cb426a6c36efe7dbf4b54146138e01208097655f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
52cb6d2f499de46d8c76490574cc118e

SHA1
c02a04cafd0a28c9a9e511c1e84e60224957a135

SHA256
ae37b4ff10cd8afe921c608bb364d6e12b04329b0d144708daa2cc7f82cba6cb

SHA512
a294c2ce55c22f972d62a411093df82d252bf69ef537ac9a0698bb48d07cb0f506671dddc93aeff41b835838a0fb1141f129550977847233488b5de30f009bfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
e9a9d7f226df90339cf5ec1f08a38f68

SHA1
0fadfffe1facdfd060158ad949e2a38a20d07abe

SHA256
63eb0e5d6bfe1d5f250896e8dbbf9cd95297f1f6c28521d46a657161e15661eb

SHA512
e5e5d097f1b3c93251d89fa3de3b5d94122e66dbcaf2246c05a9b4256ea4ee2cf359c2750fd2afccd710948ec7629f529bdc8df0f3538767853445f77e95b221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
fc5006ffca16a612dc0e8cf17fdfb524

SHA1
8de3cdd9d4b1ff4a8f37dcb84b72d0ae001a617f

SHA256
68df2ae0b6cfecb3650414a5dfdc46a5d8a364b6275c5b7ccc00e3219f903403

SHA512
dfceee4373e0a3f7c58bcafe19e469b88faeaf6bb7ee583c900e6477d1a3b0b663581151e6de5348b94d39f3add669fdfc85c9384093308c4f96169509d6bed9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
0da58dccdb68aa3483ac0e3ad8a86f8e

SHA1
f92574e12abc8c8c339ef2bae50984f9c5e67186

SHA256
03ddce909a73b118c9a7d1d78e9639aecdaec473af2d14a01f0d9bd99058c028

SHA512
5c78a4fedeea552b98562e29c7cf13b1103068501494b65aab86f23fbbf4cf620c5204587523fd952735ba937fbb2aa4673fa072df588cae14c5ff87c51b0a30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
24KB

MD5
0998b1ec2cda2899d10fcfaaf4e8b506

SHA1
61da6a087d8c3a092a656762f0f83aa10e36ebc7

SHA256
db7bc63f581dab390e59c7607261e74aea267a2e6c80f9e44fa14d8e8ef5ac1f

SHA512
e407a3890d7fb3a78133f0ec3d27955e1ba4abb5b79f0c10fc787d0d28dc8911ac226ff94e7516489e6d45b9d51cc4f73be2e3b00980f427b84effb204f2bf02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
aedf167db17a9d7dc6695f9f093a57d7

SHA1
837ac2e44ef229b71ceb0152ca65405cc31bf89e

SHA256
ed2c84092245f61a4365f7db0af3cb9dd8573e8914a310b87b8c178dacbc2f09

SHA512
f8c0b3df6f6143617cd5c98bd478e6940d4bc451d526da5ac6bb1b612cb8adb608f2e197aa9905f4479fcfc7dbd22431cf1d524fcf58d43024162d6424f577e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
aedf167db17a9d7dc6695f9f093a57d7

SHA1
837ac2e44ef229b71ceb0152ca65405cc31bf89e

SHA256
ed2c84092245f61a4365f7db0af3cb9dd8573e8914a310b87b8c178dacbc2f09

SHA512
f8c0b3df6f6143617cd5c98bd478e6940d4bc451d526da5ac6bb1b612cb8adb608f2e197aa9905f4479fcfc7dbd22431cf1d524fcf58d43024162d6424f577e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
182065e2450c36314d3864edff0a89bf

SHA1
6691bbc701ca888849252fd4a66bb2bfb3e33e1b

SHA256
75c07d8dc27fbbbb1621c7da5ef6694ac118cb95eaa3ff261087bfff2959eeff

SHA512
482999836157a184db02d03a23a9ce8ba1422898aac821e9d5a465cc4c3f4481be775c587782e8d0314ac8cb870466aa377f32c6a6c1d002adf9b9120ba698b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
729B

MD5
510955a94908c5fd6725b85352226cbc

SHA1
c1319f112bcb4eb09e0ae3b4620376ff417ed4e9

SHA256
01bc7e2fb8b4444e1128c4d0adc107cc2d384e72f54fd194d0f19a42d6c0c514

SHA512
0ce26f0f7219014d5ae6bfd5f33bc35e4417de77ce52bc8ac7e7974788171d370d4c235346030a1ef589bd8ad48ae89d1476fc4841f30b5b0de9f766cc32bddc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
29c3bbbd81a51858d61878ab43914a9a

SHA1
631578fb03c5106a432f74c6fbb50f88a393d33f

SHA256
f8f1e408bca227b7e038f0f31b700905bfb4ccd3922606665a22ca402b6097fb

SHA512
c063994d89fc7040eb3eed70ef746e4035030a46a762d7581e680b606cf79a6e2d70874480c952d8d6b1729de52a77d9cf70cc598185d8a09049efbc311f4308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Filesize
36KB

MD5
76055a0fb22aca8b4cb37005ef38b0bb

SHA1
b610d5ba87c6e6c5f91468f8c7d97f54c3f36e19

SHA256
8c5b9f55dd7d2875225057cb35ef7e8b5a2b9271f9f0d3a34f3d4bb0a79b8af3

SHA512
228e25941b11936a963a52324b484c96f68a6d97289267271924b34afcca779d88053cb80a4cd2fd4b8965eb50b0b5b5da79b1f277e491cd520eb9b77354f6e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
507B

MD5
34e243dfd76bdc5b83b4cb2ceb7bc937

SHA1
907a05f9d082d0ee4476008194829ba5f906d622

SHA256
a6612d949ddd3244bef4aab394b8f96f2054abc354c5bc22d82ad9a00f7dc9a8

SHA512
d637c0f15414632423204fd2ed4a7931232908f1c1f0e8ea5c707b1d73fd868b995c40602f226ec2c661023316cef54f5781c55ce36b8a1e7c654d2ed5ca26e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
507B

MD5
7840d890d895f69494cb31a5204ae77b

SHA1
04109e50ee3abbde9b2e0de174a4329c143e94f5

SHA256
80567f70c2a606adaa1a048bcb66ab5929881938c77b1123cf750c04fd381893

SHA512
fa21faaa4b3bd60769bee05e412a889cb97c3186b940c2de9c39d37ed998f1b2f634f0020f2ce638e7e604c31af7a9d520830bf207e59b6e859b316181bd80df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d2466cf93e1a7bab88576dfe01438ccf

SHA1
6762108301fe9ae5b7799cbcfd77cb72a14516d4

SHA256
973388b8c27dd3708d7da69deec5e8fad8f56d5795825e952736b3bb38e065a8

SHA512
5cd8a0412cbd01ad6c1f151b608dec12a78eb18d58cc9f063263ea7de68737160dc7e8904f60559fae35e4c1b29ab391bcc562630ed6f5f35a26802836cccc2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5bc90e88c34d60042535430f10716aaf

SHA1
bbb80fbe5dbc36f9a00ab040d2504a0866a3a659

SHA256
a9085335e154b3cc3e5a1e7a6ba67e32978efd104f496226ee15baeb1a3fcdd2

SHA512
6f11faedf39af5cd07ce022905e17ce819e715f600afc32f733356c9c2de9e71c98dab7076fd6e042bdd0993d385ff96fe78da2d4a5d0c77a8cd8e9c77150e24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cbccdca4b9acd12b95f14aed6897fbfc

SHA1
62bc35df6010db6318fffc3c2e59a528724c240d

SHA256
ebcc9cb62485f67d5b4d0eb5c71f472cfbfd811e7b57a939dc47ce590ccc2588

SHA512
609af826970e41b1795af72a814c192e03bc9e9813be7b321292392bd1c0621273117c9ed148ecbc5f62f0cffac9021a7a0e4cdc29394e78652a9365f25548c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9ab169865477a9fff23447b1eb7f602d

SHA1
7cf671768b2779a8bcd43d6af35db266ab39df74

SHA256
dfd3a9699286fc3098283974628693b533747faf38c3a54a4774d3934100dbf2

SHA512
8ce657991ed4fca5ab7273d7a46ecb767b3b80683e08b31845d78ac01bce3b43f6450721fb7ff0b7b0ab8445917af01b83564f90f254067f7462cc6cbb63bc95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
be19914af3646b642fe6e89b8fe7864d

SHA1
676ad0feb3929a534f62b5bd570ae5202ab67fc2

SHA256
ef6b48ebad31e05191a4a5ff6a11c2d71e4b53ad9c6b13d2cc7ab02673b89ab2

SHA512
6c0816c7c5ebe70a5c70e8d338fc54b21679d8db621cc0ac9f963288aa8f1147c8f3d9ec4fbd90879abd20a7542477195d49d42292270e7def8cea5f2922c275

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e109558d729955fd85e849f9477f6b26

SHA1
b9042d28642a29bcc050814f73aa28ec9f7939e2

SHA256
188aeb0f0e5e78f53aada9208afece259cf409c20d4863b8da1287bf54e8820a

SHA512
906baaac13c4d07c6403c1f06e20ddafcfa1905fab3b3d6e243fe6352359ba8b74a8693e138f1e310f7f63f59a6674b3023bd5952880348215055ecc36afc9bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
23fe9e361f10abfc2a0cde81b0689f4f

SHA1
64d17ddfc3262685228c8cf9a9b5d6c8b7e750c7

SHA256
b72f9b0c352b6e16b93b5eff343c1669f4d7eab07ed4f75a8f2cc9073f01be18

SHA512
dbcb9a88f86fb5bf61511387de6b1448aadc8266672e445d972cdf74a20f3c61c9523fb82efd0623c17e797549099d8822241ef698cdcec9f80d2cb7e1ec99f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f83f2e8ac8a22dc20e081292493bbe70

SHA1
a964906d8497f2b45e0cb62885086245096a04a3

SHA256
d217ce68de66fc40a5e199d2b5a5b0cda0d23283f0f149795d14381ad071a0f3

SHA512
5e0e9f5baaea0c80d97c3d8bde26247e6911cd3e3ea394e0f5ee24b8dec26f5c3741705656af9c8195a24450f993076db65a83dba07223ecc0866b1b1ed404ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
124ec10e6b778f9590c2eb35715f1583

SHA1
31eac893a0000d305a81e3b137ecae664ea27069

SHA256
064fb130a98cce0117852a363deae7210041bccf9049553d3f3787ac0bb6d34f

SHA512
e9471805e8c284c14d2b569bae02d3fa8a9be5a8278d763ab3ec54d170f35ee5a3de412d5e1a9665d180cacad91b549b65dd11a0a8a835dc6c45c183a612c47f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
70e9eb43f55e78137de103781f422d55

SHA1
f622f7e7617906ecb08c1161cf3951c55e46b115

SHA256
742f3e79247bd276a72814ed991fa0be60ff191ca5549d98217e0df7281ced8d

SHA512
f638f5150a1976b03884d06c42d11f37b824d1cc51c5e23d511171da8381f186dba7e03f93f3ef8cdcd1668a3b0e17bb42bd214ffad1fc890609b8eb09e722ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
43fb90ba62504e4eeffcf0acaf2e3e4d

SHA1
a148f179b18c9b0a10479f54d9727904a3aed738

SHA256
f894394eb48daa615708d3cc3400f484dff048041c2bfacbd00e30a935819f97

SHA512
2108587b1c584e081a1b55380f906c2e9633edbce58936097bde30af5a0c5b5fcefbf7a59fe91e385fe0f2552a03272eca4bc3a83ea53a7b9a070cef4cf3fcca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dbdcd9668b12839f35aae84b2b920c1d

SHA1
b897565d949b2a3c7913b20044f339e2f36b2f15

SHA256
79386089fbaafd7e2655173c77f215d82ce64b072fbce8eedbf52b9d0610e469

SHA512
57cebf51d95e002cfe9ab72dd37687b0f745abefaccffb9945ba48add36ee3eedba8ab262627dc89d42fc723230df0163d9d18c10d476ef6898f4e1a7ad94565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3410b1df452536b0e15528f2c9e109c

SHA1
5b124eceed0a1a262f5b7916ae400ac93ae3adce

SHA256
85456e0fb6180ea7156c4878cae4ff4b1deb064dbb6c5a1ca73bd44f4c023a18

SHA512
9caf0d010be54047e825d39f4189b29e252162e7a33367efe3d9d668c708cdb2156abb173a067c5e22da920fd4c42d90a74b5f9f206bd2c685aad669a71587da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3410b1df452536b0e15528f2c9e109c

SHA1
5b124eceed0a1a262f5b7916ae400ac93ae3adce

SHA256
85456e0fb6180ea7156c4878cae4ff4b1deb064dbb6c5a1ca73bd44f4c023a18

SHA512
9caf0d010be54047e825d39f4189b29e252162e7a33367efe3d9d668c708cdb2156abb173a067c5e22da920fd4c42d90a74b5f9f206bd2c685aad669a71587da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
458a8c67069a9f7bdcaac991fec635b6

SHA1
02e982b427c6f6714b71d597e49912c3d4506d12

SHA256
d7c36c7c629374fc0c123b6aaf2fe3c90b4216ed16828ad160abd4bd9e08fdc0

SHA512
b901982a5c4b0bb578984001e3170f35548c73cb2bdbb1182dd49489aed2dba048dc0c178385176400c59e02644ecbf905506e84cc691c2af8c125f304c0e2aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Reporting and NEL

Filesize
36KB

MD5
47dba30d945bd637c56c12bbe1dd7017

SHA1
daa41a8d8b80f001ff4f3d1679f820349e99870a

SHA256
a79d89a9ebe6964b03cc5a08f7aa7227d71d68f01a3e507dd9492dfef92dadf4

SHA512
e30a0d96e531f7d6bc946bf6eeca7bb678e1f1fd7ddcce05a0b45546ff6c1d4fa7e37ad45cefc4db800cc38c07c24c17700d457d71086853367cad7619c7cf6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
2816b0ac86deb18ed9d903725dcae378

SHA1
10c507eaedc2c140aa365341a1bbf4638d16cc07

SHA256
842334ac74ca1a5a0feb28c1f969434eda950a12701147fac6485fe5215b80f2

SHA512
f620bbecf185b4fee3409a715774c24839b238dd84e0dda21179d4387b7c0c239411da68a77c8977e17479e556c98efde55f52ac2ff12c9fef01384184157e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e62cc4051e1f8eaa0abda5d730a2496b

SHA1
d15346e40b196bc313cbfe5ac96b3c90b83345be

SHA256
ffb5b740b8777d010f0d32a120092084c3cd32eaceb937188d698ddc22df2fcb

SHA512
3e8f6d89c7c153177b2149d86cd8602ceafedf66f5335a86b19dfa46fc38c47f6ff9a272c3b71b4464a5921ebdf2461fba25692ca916b9715bac520bf1e81a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
175B

MD5
6153ae3a389cfba4b2fe34025943ec59

SHA1
c5762dbae34261a19ec867ffea81551757373785

SHA256
93c2b2b9ce1d2a2f28fac5aadc19c713b567df08eaeef4167b6543a1cd094a61

SHA512
f2367664799162966368c4a480df6eb4205522eaae32d861217ba8ed7cfabacbfbb0f7c66433ff6d31ec9638da66e727e04c2239d7c6a0d5fd3356230e09ab6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
322B

MD5
2b8416bceb7d87ba1076d7865b9febb6

SHA1
60d7ada151cf904aa003a4631461c43f9a035c59

SHA256
bed7f21dc0e3debeff5ff2df41ade4b228f78848595b66ebbc4793f203aadff8

SHA512
ed81356f7fcfcbcf708019388f361fdcdad092f200f2a6dcd7c7be2e689b3b9eeaf52bff9d752cd59745ea9fb8d01bc872b717cdb50894a1b40c828af5163f34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13335464835900113

Filesize
3KB

MD5
ea3571110b8f6fb07cf9fddd049386ce

SHA1
f311903cf497230c0dd94ed2c7e31bb360e7885e

SHA256
69be7e0016f67ba2ce605730cb4241b196ecd3c87e0500e82be423487ec76ef9

SHA512
7250ed1d3f8ea29af5217d280bb07402983729834d9c3af34a65368bba48ebc3436923a70bef5701a21977bc5323c69ca35dc9cd749bbea325822c4b766d90f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13335464836093113

Filesize
3KB

MD5
7d100b8b379fc132109cf7d2124fe7c4

SHA1
cd1a138fb49e859e5d38b4c4c39f82d290f8c5ee

SHA256
46e90084cfc4cdf85d3ac138d4a025584d65e02c98af005b818fb81e90d57764

SHA512
c594deec44bf35ff8563eea8ce8300abf807ceaa8fe9c66ee5a3886080d0c5f64210210216fd48d4e7da280413133893fe03bd8e85cc9b2958c5b7370efd0e98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
cbed1cf8732e7906c778f903c46a42d5

SHA1
f94d80b328367e50b3173074656b72238d20d038

SHA256
323437d9418643b5b92a6eaea7bc2c98e041d20d24586bb072cefdf3fd9348b0

SHA512
86085042b1dfa085d6be34f2fa86702540764eef2533b5f416b349c243b4e6b586cab06d130dd8df99a1b402e54d4757ad8208d779429c0ee716e9350c9de2b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
fe82ae69537a2674f74f9d70e2818b18

SHA1
730237c5c4efda5c49d73f0d0043fe630d0d5d1f

SHA256
db31e6413921ddba41599bdde5d4a0f47a4807d4be48e8938f1c5c32bb67666f

SHA512
6fa513f5bcd0498edcddd3e2e25b76984b0d0d11e1ead327615fdf6ecb8bbc7c712b62ff1e26ca867bc4e91d4e22cec8ceca7d8a20eef6b4072046fb6aaf5300

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
7fadf133b185904693280f77658465bd

SHA1
7ed8f41977b9df17bd6948167e1acf063723f431

SHA256
419d90e8348e6438d69a8eebe17da04e0812aff5556d3086734f9e9d6df3aefc

SHA512
9307d2ca4ec39d7501e0fe4491afd07facd58b5660738476b9a5ba66e8b45a73027e0dafa7c0d639a1a69a1fa84d60482ad5424faf2c68c19c676b7d72e07b33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
b43787b0373ebe6500069a2378936a3f

SHA1
fd63a3a1ca0fedf1fa75927a6d6aebb4cc5fea62

SHA256
8df9cf4abf517038aa7fac6dd1dfbbdff7cca5ab2353c5bdeeb77ea1868374f6

SHA512
06d46475b77f2e8aaff30c9a91d5342863a5a566a797a3057bf15deda63d06c995712bf0a417bbc671268a1e745e378c3cee7bde1fa3a379641b79b19957f165

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a1a5bc88-4aa4-4c2a-9781-58e94fd575ef.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
60e3f691077715586b918375dd23c6b0

SHA1
476d3eab15649c40c6aebfb6ac2366db50283d1b

SHA256
e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

SHA512
d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
589c49f8a8e18ec6998a7a30b4958ebc

SHA1
cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e

SHA256
26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8

SHA512
e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG

Filesize
136B

MD5
80aa577616f9a5d4ad19e0d1f73b1697

SHA1
bb9e21d35d48a89702ec48c55499854d6e7a056d

SHA256
f8323b6cd9db3b229ac12350ad211276ece4db09a6f306eebc40ad9d4d46651c

SHA512
519edb7e200bdb55c1b18a55a5c2755686e40b6bd8f25be83545cfb5e83d2b37dfab1e151a9471c9b8a67f078a1614d9f9444b589fc2559404dd0c94636fe9ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000004

Filesize
50B

MD5
031d6d1e28fe41a9bdcbd8a21da92df1

SHA1
38cee81cb035a60a23d6e045e5d72116f2a58683

SHA256
b51bc53f3c43a5b800a723623c4e56a836367d6e2787c57d71184df5d24151da

SHA512
e994cd3a8ee3e3cf6304c33df5b7d6cc8207e0c08d568925afa9d46d42f6f1a5bdd7261f0fd1fcdf4df1a173ef4e159ee1de8125e54efee488a1220ce85af904

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
7acd830174245c39a6e49379e2493e53

SHA1
5ca5ceb83cf83e231bc6c2aab692a31427d4aa97

SHA256
38ba4189df8e1e10d0a2f3b5f68ebf1e09ad098afef9acd3a1b7c4e632ec248a

SHA512
74673b159b67c706f240702bafc01c89395629070805814b1606e1e9e2c8adb1df9243d8a9cd4a7a433938cc1097badd440902362509ec5bb23e83b8c95269b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
175B

MD5
7140945888249af2abed09b1c3495a89

SHA1
303a8761d934d621a88ea7967b9dce54b6eb5879

SHA256
a9cfdee7e2551dad37ac5e4d1352241742d268cbe5eb48326a9c0fc65e88ccd0

SHA512
5545f43400b071820521a6977147b63893f7372eb06850e40da488f67b2d44c7f44d855ce61dae85dbd90a1fbe8747dec8aecc4972e556f5a0aa88a46bc5f0a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
dfd23433042cdbdea9ccfe4d5bb3be28

SHA1
2fa41e35b72ec1a8145708ab45065eb1d0ac05b3

SHA256
09664669e592e410ef7e6f657926ece819de296a0bba6082201ed0f76f22624a

SHA512
fffc3d94dde3b1c06f21b72e86ca4a2179fb852c4317a6d9aa545b46ba80364e131e41d5f34eaa48951648c648d7c791718d3d9d036342e598c06973908d4f00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
536B

MD5
1d4019962e778c7ef7538522ea1d1cfa

SHA1
ac780c17bcf9e1ac2aeda37931c9e57720e55cbf

SHA256
03ecef001d325cd595c94e4796f8cacfd14ad3060c8618db0b9e1458aa0838f6

SHA512
11a90f6efe03e3c7813f2241be8bd70483dbea6b00ec0eb71d6da47ee83fea7d77ed88dfdd46090fbafb527e81e4b95c9e2c717299c56eb0cbc8de8655fb494e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
0a422078fd5b1f5740fa2c5cbbda8ccf

SHA1
136638f42c370f8d8550a8e8d22cf2a7ee9fd5d4

SHA256
dabbdc4903142b37f41f170273bad7e0e7b078427d5d456a68667f38a244951e

SHA512
d59d1e2cca2cdf0f03d589c9457d88a4d0468792cd72dab6e983c7e45a1a1726edc2b1cdf44d4657f841bea9135ce6b805df8f4fcf0136344ed115c190c7e970

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
0d418d0298e5dc379ed61b1ed0c6ab2f

SHA1
4b8ccce947970347683e5f8356017b52db701ff8

SHA256
cc309de513af190fa56297740548f087b5f3af552a8e60d121684b5ec2f5e262

SHA512
52277f3e41cde1ebdd5c35716a03a57a1cbd8b7e655684408e527fa83a9147430b3dbd57792e73d645cf7561e9b86f854faa181a6efb57bdd52bcd3344bcb012

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
db5a125212945af924f851164a2e33f2

SHA1
75274d48d8197c0eef74487a99347b50fc4ca7c4

SHA256
30b8ca2fd715fb35bd03c741e2d82710769250f664cf58a42a1f43bbb3359fbe

SHA512
2243fe12041ca7530f214c12b0a13a7e353c64fcba854ac9104974c813548e07e873ef9447fc814b7acb660a39721be28fc5f81d27a1b7fb3499601cd22f9647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
b6ef6e6ade83829a2de1664929b6aa8d

SHA1
ea4f3330bba4bc6f42419a3aa511cecb755e7db7

SHA256
38f73803d3c2d37769a60b382fa2d8dc85f13ee431d4ac993a81e419786d0536

SHA512
413c78f0a19c857423a998b4a2b16b3726a23af953ab6d1695ab202d60afade2715135aefb9b03373e8e08d3e0f610fd882af1097dee7caaec992591f03eafe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000001

Filesize
17KB

MD5
913728da90cf90d8e78af59c60b47c3d

SHA1
f42f2a545d4fcaf4f76d0f060f52e33a47df7f1e

SHA256
b0b478f9aa6aaf8d5811e296047ae1f8ee07f4c4998fe9d7b960755ea1fafb82

SHA512
3af86e053dd56aef03e6f967a49b1a0d492616a71e2e49090e0c8e5cbe58ff37ccc55e91f06bf34096059a49f3de84b0bca587f3f17c366f97c0f7a0fd17c974

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000002

Filesize
22KB

MD5
1ac9e744574f723e217fb139ef1e86a9

SHA1
4194dce485bd10f2a030d2499da5c796dd12630f

SHA256
4564be03e04002c5f6eaeaea0aff16c5d0bbdad45359aef64f4c199cda8b195e

SHA512
b8515fb4b9470a7ce678331bbd59f44da47b627f87ea5a30d92ec1c6d583f1607539cd9318a5bccf0a0c6c2bd2637992e0519bd37acdf876f7a11ed184fb5109

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
14KB

MD5
92b755fc1f6b9372fca86e9ee71fca2f

SHA1
9f874a9cc6024707b3440ce5a53f9de2f1791fd2

SHA256
6a3445a75c0ea0169c0961ef1e086f4fccdeb749885a44a6890925fc4fd12ef3

SHA512
188da479a7d4fd5ee54c7866ac5b45d3abc4ea0b07c7c2bfabdc41f2d70e6eb921a7eb255b3e9d18f912a94f988e3f2d98739c81d9836ed4f76c84d7f1c4446d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
449b9e8b2a24f1a9b9aa8801d7ce52e5

SHA1
0e059e8256134a4da58c85210aecc51b9d08e14d

SHA256
338a6eee2b4aa457aea77fabce22ca19ff29508691d47796e966814d991dd311

SHA512
0ecea8603a03c50f6d033c82125de1c02fef33a417d7cb6abfa913524388130c8acc04367c85a00448a9b973fce33ae4f4f94396140b3f5724dfc6e55e3330c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
449b9e8b2a24f1a9b9aa8801d7ce52e5

SHA1
0e059e8256134a4da58c85210aecc51b9d08e14d

SHA256
338a6eee2b4aa457aea77fabce22ca19ff29508691d47796e966814d991dd311

SHA512
0ecea8603a03c50f6d033c82125de1c02fef33a417d7cb6abfa913524388130c8acc04367c85a00448a9b973fce33ae4f4f94396140b3f5724dfc6e55e3330c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
14KB

MD5
0d52ebb9c34c89fe8062c4f1d77b214e

SHA1
0158209920bbe838a539f4bd0fc01ab4af640cfd

SHA256
77fb5025adf574376852fa149dc138982165551e5dec8490d1a9b24b65368c2f

SHA512
32bb6d38cac745118bd52c7e0fa2a5e1c2e455267ee6ca77b2e46e57205446f9ac11731857cd118e2cd80411de8fcd60df88b64f652daded8208484d81bb33ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a43f03c9a725448f08b41f551a87ec8a

SHA1
57ee24190d960ad591ccd894ab485b9a035280a6

SHA256
95f90e4627dc673e927aa4990016b90d82cfe153aac97755dfe75f76f8b24e7b

SHA512
4c9510f6745c7260b88c92af01a8433e43cfd8f7aa0cb1373e6844fc369f75799088ee272ca0f5fa8a87ad5d4b85d319ce47876e580aa5d8e36458547916f8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
14KB

MD5
ac1815571020a8680007f4579e0a9e64

SHA1
fcd738df27904fe797a24e4a215e1b9cacca50b9

SHA256
9a915b37c2c8f575bc0a86b84567355916cefb8fcc9857553befd41d8d94913c

SHA512
6f2b80160964a713332ffeb46fec3a4f99b1f873c77d496be2a0b4b633cb5f2fbe4d97a754ed401c42ece9007556ebd2e1c1ec90a6d2b7b7079d40c885e60e6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
e14b28868ee7396d82f0e417952d73ae

SHA1
5624c02ea4199216ad7c1bc102fdefba59920268

SHA256
e0a0ea1283f68f7656947fb7e89f7f2985a41a5ecbed2d93405f26be44228663

SHA512
8e016420d19cb55a747e3e5a475a15f00bbaa609a0386b39cfb024c5e70f0c14580221479e95717eda187eab01873e77394488348480b5c243a8df4e62026de5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

Filesize
4B

MD5
cc9b875991e25b3de02428c43b2b3850

SHA1
5b40dea5b28323f9339f386526ad6b45e4959351

SHA256
4bc74dc43cc06068e1b5d83acdcb20f18776528cbe558c0be3e30eadbd9fcf9e

SHA512
cfc164cd3b321c6b2131541d3b572ba26ff0f97702dba7fd673522f4d88861a5f47ed5261a308aafdad1a47a4ec6de1afb1fff8c215b324c4207fd2544c00b2e

Download Submit