hxxps://github[.]com/Endermanch/MalwareDatabase

max time kernel
66s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 64 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
4204	msedge.exe
4204	msedge.exe
908	msedge.exe
908	msedge.exe
972	identity_helper.exe
972	identity_helper.exe
5256	msedge.exe
5256	msedge.exe
5996	msedge.exe
5996	msedge.exe
2096	msedge.exe
2096	msedge.exe
5168	msedge.exe
5168	msedge.exe
5184	msedge.exe
5184	msedge.exe
2100	msedge.exe
2100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid process

5256 msedge.exe
5996 msedge.exe
2096 msedge.exe
5168 msedge.exe
5184 msedge.exe
2100 msedge.exe

pid	process
5256	msedge.exe
5996	msedge.exe
2096	msedge.exe
5168	msedge.exe
5184	msedge.exe
2100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4204 wrote to memory of 3368	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 3368	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 552	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 908	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 908	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 4424	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 4424	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 4424	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 4424	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 4424	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 4424	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 4424	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 4424	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 4424	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 4424	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 4424	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 4424	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 4424	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 4424	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 4424	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 4424	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 4424	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 4424	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 4424	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 4424	4204	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9eb5946f8,0x7ff9eb594708,0x7ff9eb594718
2⤵
PID:3368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
2⤵
PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
2⤵
PID:552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
2⤵
PID:3096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:2168

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
2⤵
PID:400

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
2⤵
PID:2484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
2⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
2⤵
PID:2232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
2⤵
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
2⤵
PID:1260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
2⤵
PID:3952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3596 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
2⤵
PID:5528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
2⤵
PID:5536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
2⤵
PID:5868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3644 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
2⤵
PID:2388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2112,10959447194291516038,17337493014624019995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3772 /prefetch:8
2⤵
PID:5508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:5220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9eb5946f8,0x7ff9eb594708,0x7ff9eb594718
2⤵
PID:5864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,789976381905200573,7220402336901944089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
2⤵
PID:5684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,789976381905200573,7220402336901944089,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
2⤵
PID:5736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,789976381905200573,7220402336901944089,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
2⤵
PID:5700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,789976381905200573,7220402336901944089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
2⤵
PID:2084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,789976381905200573,7220402336901944089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
2⤵
PID:5384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,789976381905200573,7220402336901944089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
2⤵
PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,789976381905200573,7220402336901944089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
2⤵
PID:4200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2116,789976381905200573,7220402336901944089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
2⤵
PID:1260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2116,789976381905200573,7220402336901944089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3540 /prefetch:8
2⤵
PID:6116

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,789976381905200573,7220402336901944089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3524 /prefetch:8
2⤵
PID:6088

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,789976381905200573,7220402336901944089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3524 /prefetch:8
2⤵
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,789976381905200573,7220402336901944089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
2⤵
PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,789976381905200573,7220402336901944089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
2⤵
PID:3652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5920

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
cc237328ce7a4ea78c736f04611f5f96

SHA1
fe4a0af5c9d318d01e35b04f5b176d3ac0f7472d

SHA256
5ac03ca94d2cddbaa529593b2746418c3e7f70a895e00c76b7ebaa57f94908d6

SHA512
2a842041f160ffb3361badb20369985e929f71d8ef4fcd84ce875444ecd475fc24a005b3c2382c3783740646cd5622619c913bc63722569e62078c79103cef0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
888243976e4d7f57f4cf608030243cc6

SHA1
2da4bcc10a4b55f4f8bd2ccdf8acb94bd4eac1ef

SHA256
dc3d294a1fd7193a0a60bd646cc19ed17d07d6dc7623dd636bad86dede54af8c

SHA512
823ee0264cbd91774d4bb5b8284b438ad6e8fc94dcb95c940123032f9ee01b9e398cd76165234088111a3f816c14e7f5c8ea645ebb55250bc76fe5dc84a840c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2b537e67-639e-4e54-8bfe-9ae3cc91a05c.tmp
Filesize
6KB

MD5
073d73f3d20eb8dfe3f1a724f76b5175

SHA1
b43e6bb7b9e69749c72520fe762707f6ba351723

SHA256
c075ce927d9694580639fe868e3999c382eabbf3f8d2fb3c896f6019015406c9

SHA512
03af5de73af54ff66b450ee281290ca62e6014a4f100f2807a1b8fbf4abf2800d5d54d0cea08c4612e866cf95a7582195d21a9faf06472a76cb62377b34e170f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
1672d2b97557abdfe090ba10089145c7

SHA1
2ad42d25ae40595d37652657d9b60721e99a1242

SHA256
c3a0da34577864e12c2b08b68ceae5f9c5355049dd6918fb8d5d20a9a20daa1c

SHA512
7de556ea0423c203a41e2f3f168902114e7ec0e85bb71f27bc4f5fb2910dedec6d335b291b79f4e1768f0ce95687ea042885c7d87faf32166392d2180a575b74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
1672d2b97557abdfe090ba10089145c7

SHA1
2ad42d25ae40595d37652657d9b60721e99a1242

SHA256
c3a0da34577864e12c2b08b68ceae5f9c5355049dd6918fb8d5d20a9a20daa1c

SHA512
7de556ea0423c203a41e2f3f168902114e7ec0e85bb71f27bc4f5fb2910dedec6d335b291b79f4e1768f0ce95687ea042885c7d87faf32166392d2180a575b74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies
Filesize
20KB

MD5
4cb72986203d52a4684d06fb61fbbf46

SHA1
fdc946846f45ad3610d9143dd8744c6eaafc3a27

SHA256
ced5f63b614202eeb3fed749573a4a6f347cfc65c3a3cabe29cdb8572b8c66b2

SHA512
247e15f8dbbd402a9a8594402c1fd13b07d34ea43667c2278c0696ced0c0d6c6b165a7a7d5b6a20176546a7211aa02b784ddd9f2ba9fe58456fdc03f034713b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Filesize
319B

MD5
4a7aeb69a13261ff957edc8ae02b5a68

SHA1
10cfd93cf5e098488c794483a387b142fa44b3cf

SHA256
76f3cc7049212baa646b0f60a4226a80845b136b7ab3b10c4ecb18ebaede03a6

SHA512
8834520037b3a148bceb6d2ad4fd8c313fe30b37543b86fa23b58ca954f0b49217c195d78abead209c4b29f764db5b3cb5b77fc1aa2e1e3bf8446a285ad9e6e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Filesize
20KB

MD5
2e8ec6891ac2058905ef2bcf7ede9199

SHA1
63f4471d6a30f609ea7dcce0fa66bb559494b52e

SHA256
f2feb66077172da6e1d88509a51fadd770a9495b3ee4a370c8db9535e2aa15bb

SHA512
ad7c66002a3d8a0e70ccc4a03e2d4ef51178990cf814fe209fdccf4c93e5e9ae2f0953cde29a180dc328c77ce6ba0cfcb9760c8d5cde6ba1f2fbb4e539fa164d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Filesize
264KB

MD5
f1502df4cb5c4be58095c12545aa8372

SHA1
8b2fffdbf1cec98d1f03845b3c856fc8621d696d

SHA256
97a1bd0bee6c746a260142741a79d7e3c6429f0a1241b00c4763e2cc5ead175a

SHA512
d11bae836020e90c115a9218373c3d27686e4409f7570ffc997095baf11da030e2ba4d5e26e55e493bedffe84cb77808329ad6ca72ca801ada1fb53cb74b8c53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Filesize
124KB

MD5
29028f75857d4144a4fae3d635c60622

SHA1
b0cc49751868d36882264c4ff52bb6464a1b33b4

SHA256
c47389c4fd7e344dfe527fe413661ad7316b1da4188884cb250fb62116e0ad80

SHA512
c5bb86b1a5a3e60ed9ca4509d1f1851592278d4046d37093bac5df622ad79733bc72ef9ab13c4341febc964af3ad5ec97be652da26e2f5080728c830b6223ae5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache
Filesize
1KB

MD5
9be85f361e6cb3797d18363fa4375667

SHA1
72af9b65b038ad885288eadbab1a1cf03e272460

SHA256
a637bdbe9e5bb45dfb71838194229ecc5ae8dd05a845286f7ff8b58e69cdf604

SHA512
f5fb156f4cc0f87bd5f6eb586f144157813bd4804137910a2dcc9a527922e55d3d37c6327b9581dd0e3f2704dd41657a11a418603f9f97a0a4fa69148827fb0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Filesize
9KB

MD5
f8e7b48fe2ecae286abf86a892d04f11

SHA1
eef120dcc98775ea37e23fb24cfa379b3b0522d5

SHA256
d770a7af2e16b8abc891616c697e509165a8715e02084aeac08eec9951ce2e1b

SHA512
57d91500e5a9d017283761fba3d6a4f32d2f822744b2035976247a38f4b6508ce3aaa4989e2ac35fc63c7522e2262a200b088e3f3ce5f7e362067323afd4d326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Filesize
331B

MD5
e23d4be328fc5e0e78114e0b0fef6f3f

SHA1
0b398f030ab034743454bdc726b50590634b9854

SHA256
74b8d4ed7137cdd6e464951f34abd9d98326e0ef6bb5d6a5beffedb78af2c960

SHA512
0de013b9a14a52a6b126378534e091cea6371aee74445dee6be294010cfe2606b89647ff6853140037209d147ec41d06b262c8bc94fefc2ac2ffecf1090812f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
566B

MD5
501500dd6919a72a3797439b50ad4b90

SHA1
81a4a9afa9e2152b4b82055a42c9942922212b42

SHA256
92f3896ed186f09f2b2d086a6b92bd4dd56b6b33621b1705dd554c688c5b0aff

SHA512
202c446f07f4dd52926320029409aa7072462105ac049fa8ae48b3c764e4c413e29987e423406a3d974bfca7f511ca17c3555c3470b8ccb6acc432bf368c7d2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
c70787766a4dbe9803c48d8f5b67b916

SHA1
9187de8bac7cd70afc51aa7fdfecaa53ad8b1ca2

SHA256
4cba005c42142e80077b51236e38124182a43a54385cdb6d9cbbc28d16480dac

SHA512
dfddee18328cc357bb77b356096885a541be1b2730d1c699bb9bfb15284812c9e4bf01bbde2a45911db6843eb9a9d68680af4f15b532e34fea21470c780068d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
47fb463894d14651469b00a09433f33f

SHA1
293905d82e08dd4181d02a176bc82530edc790b6

SHA256
aa50d4d32745a24adbe15dd4be22d874d16a1e22729bddd6c99716ff139b5b3d

SHA512
0fe532ce3a6ebf57af51f359444becd1970925a39d1ee4c3bccea26f32e20b6b74473b0ad8578b16bc79bdc57c91bb4eac23b1bb3a4fce11314b812ca66fc96b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
7352056a1cddef9c60349fe6b00037dd

SHA1
126c68a5f0c15e14d903093b09a78ea6fb2765ee

SHA256
c8c9a3e2b63e07cc207bd43e3d77d4b8e13827d836fff7c2d45b280865fcd023

SHA512
22f51089020a6c05501fdd56e856fa75c708af431574e93aafa3ad027ee67e9e352418f0c6e20140f0438855c82f6a3a3bdd43ea9afb0cf2867e4c68650ba9e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
ffe157ccbf756999ba8f60c74e5b9f5c

SHA1
955a78db0241f89d8ae2fbb9699fa0bf1edd2230

SHA256
4f2876ce9dbab5bcaf91c4510f7ba4a408d04d43fa711d2dab5cd3244819fcce

SHA512
f03407faea502afc20fa86cdd1b588000d50779e925e5959339907041c9192e51b8252f04ac57a8afb058b49d31201a24120a48505fc0d4fbb184124377c7f17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
12cf8a37767450c79343aea82b221144

SHA1
668ed5d0aea483652b3d3654e37868558887f63f

SHA256
3cd56c34aa41ea5be41a29fb37cc1e5061f0af80b85bac929d7f286f1c899d07

SHA512
11cf44c478620ee3e7fe6026c801015492ed5d4486315e2f92f53ce15e7d55d00c65d3e1588bddbc65c2a999d5e553388db37ca7336556997bbfcc9827d352d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
fe828dbde4ce1404f51fa013e9b0167c

SHA1
2ddf5e214bfa5ee7e77dd4d35f01d9bba83e028e

SHA256
f03b63a188f29b9a043fec32af75308595662cbfa422516cbd29f7a498fbc43f

SHA512
96d2dc4183dea9f02639c4eb0d84a417e48500441d4c25363a8dece9ea9e176fa8f83268abac7bb78d4fe7fd3ab726c8c334b93e5afb803c7d43f070c2058747

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
fe828dbde4ce1404f51fa013e9b0167c

SHA1
2ddf5e214bfa5ee7e77dd4d35f01d9bba83e028e

SHA256
f03b63a188f29b9a043fec32af75308595662cbfa422516cbd29f7a498fbc43f

SHA512
96d2dc4183dea9f02639c4eb0d84a417e48500441d4c25363a8dece9ea9e176fa8f83268abac7bb78d4fe7fd3ab726c8c334b93e5afb803c7d43f070c2058747

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
d555d038867542dfb2fb0575a0d3174e

SHA1
1a5868d6df0b5de26cf3fc7310b628ce0a3726f0

SHA256
044cac379dddf0c21b8e7ee4079d21c67e28795d14e678dbf3e35900f25a1e2e

SHA512
d8220966fe6c3ae4499bc95ab3aead087a3dd915853320648849d2fc123a4acd157b7dba64af0108802522575a822651ecc005523c731423d9131ee679c2712f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
d7fc3bba51e07f5e716ba479c11a7a64

SHA1
d64093e3a541ea92382f968d532958436cfab1a5

SHA256
7281a477fe2ded08adc3f997c1763199dc6e40d3b2d665e95e42edec9b46cb0f

SHA512
00eb7511c75c091036bba900d8bbee150e782f9d3b2e23cc4b0f581ef1ae431a81718f7a1cca1fbb808137cde2d19521cdfe3c493c4a4a3a8065bd646ff096e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Filesize
377B

MD5
f4929dc54a83d501b4855909fc5d0e11

SHA1
e1ad9a7bfbff2557f4831bbdc40fe73232fd4c24

SHA256
a5044503f9b5b18cbfe41c75249926581f05008b2b924a04b1a4f1011887f6c2

SHA512
1fde47abf85e758055db770de0370c65136c0bc45f3525af2f005e29fbdb9f0386fe703e54178bbdaacc4b8b7c2f53274bf884468a2a91ecfd716a5a409963ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Filesize
319B

MD5
3b5970b8682418d6ac6deeab4fcb4a9d

SHA1
ce24ec630296bfae91707a4b9f872e3539da5486

SHA256
db699e4e27e6166f86c60c315e166badfc8e342f325518c3fc4849edd88f202a

SHA512
b04323848f9bd0a0846088bd7d9aafbd0a79c8bd2e5bcacc5a95e303d4c64522ac99b69bf4fddd520972bc3ee12b0a1b658f15d994a3d349dcc0f4b54e4c5779

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13341602750353574
Filesize
8KB

MD5
72d3a9f1a0bffbf85970ae35dfe9fc3b

SHA1
a662f15d77db17d13f52d91416a37865831e70c6

SHA256
4b36a4f66bc9e6d89c0e4bdb227f7660e4b0ff4b767cb10666c5aa58653832f0

SHA512
34d853192c581680eed78d487b2108b93cfaaccb1213de85f11df9854aa3935f7003a65dbfe3e710e810f24a2f69a2206bdeff7798db94f47e9510971306355d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Filesize
172B

MD5
ba88bda8ab682788f9372186cf1a1817

SHA1
10de75130908c20e38c80a88be7a2d57a26678c4

SHA256
139c4fb094ea9f6401493aa758384f04e466bf7634afe87635368f9a33bba596

SHA512
81bb581cc2eb43f916b52ce9cffe8fdf37d52c3a0bf60350b8a9d98a25651b2cf97e4477e4535597bc70f3541a20db0e821881395caf176d0d588ac8879c9a1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Filesize
347B

MD5
df81d5fd9258171e299f4c31068b8fa4

SHA1
043bbcc87741a5e6617bc9b2ce53220741fd8c46

SHA256
a4cf5fb220d0db841afa7a01e8ac72dbb66df1bb805b5b1a965df34e1beb8294

SHA512
9858e2717e6cdf7becb8202cee3658be8a02e09d024b1f26c636dcbb51302a90e37c43ddc236e875a6482b605ba795c35ce490151ce601d2694d94d496dafd5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Filesize
326B

MD5
7a732e91dee85b1ee7a4a967846e08e8

SHA1
b34a820866af53ef344b20267f9a5f2177012b6b

SHA256
1d20d899181d53aa3279aae98ae4323d002db86ed72b2ece53ed9ef157fab9bb

SHA512
5579ba183581d2f83ae2bcbb3f379396666a386420190c8c55ffb7a4b35a67f45d7d81c857892983c729b1f225fe23a549239ce9274907444db37c7b56f37b98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites
Filesize
20KB

MD5
d1969a2befd6548d771566775728b6d1

SHA1
96dd0661121c8f6e92904e21cb866caf270f983f

SHA256
91bec1ed1735c6d563cc0a64c5bfbac30f929326492d6a2ab9dd6c44baaea905

SHA512
8114ccd37fb4634ec0c935f5d42dc96871ecc5e0d8b0494dcda1e15b8a08778ec59651508a07ea35188ffbbc3e215177530b47861830023c38badc45bf6e8a9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
404c47f59f0a354c5ec2ca2ea5d1568e

SHA1
c802c0867551dd70d80b3048bda3325a432de362

SHA256
c10250b824385c7a932f487a84cb68534904b6168883979748a53ca3d3587526

SHA512
30b2f49691049f841646c456d487f8e9d1afa84aa540aba72d0760f6dcebbe165cae033aa6d12568d1007dfa31d21532d027da5c5674e8b851ffc989f9ad2468

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587ed0.TMP
Filesize
1KB

MD5
1e83cb4a02603918d58fab6071409b9c

SHA1
c5dc425026255964fdee489d3c97a3df757f739b

SHA256
5b6286127adaecc50c0c91d04c6af60aac2019bf264525cf39313662bb5c8182

SHA512
cd62258a97092953258bf123d83423a5e50d46caa4ddee128560d2b012e0bbcdd528446c97b5c2debef9326afc0177c2b821de1fef99f09c596b63f8a9f8a5cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Filesize
128KB

MD5
7d6b02c7a240d5431bf49cc9507be008

SHA1
775811145671638f6da9d0c4da7f21cc6d1e2f39

SHA256
ab09c63b10260016799356785fdc97c5e633be6ec1d818671478816876d3f66b

SHA512
41c6d087b4ccb38d5ddee46a413c26bbb79e44a518724fec4ecd40942ecbfc24eb6f2bb526355589140dcff41c638edecebe51f73229a89722e39d0eacb7b057

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Filesize
60KB

MD5
29d88ffcf6cec56418ad7e9e47f20528

SHA1
ab7d059d1f16dbe245612d87f9bbd9705f591e53

SHA256
044c116d3f642ea718d27a9cbb43ba467b44e675e16a45d318789019ccd30ee4

SHA512
09cd1c93810847e00b3a53a06df66683dc41afee0e0753d7da25718a4476a34f054a68506bdffd9391342cc9cb00d6cd9731da03db2aad6e87c6b2459b4d023f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Filesize
206B

MD5
cbea63fc18a1b2491658fbabaab47e76

SHA1
ac7fbd662ee3c36bd3d75b304eac06d706ccb7a1

SHA256
b1c4c100a4263ed2c72dc893ae82022c1930624a0b062afc7199706ee9b66c1e

SHA512
0e953a281eb13dd51bf410103cb8d2a5514dfce347d803444bb95838f07668fb628d8d7c354e19c01d46d04386026dd2821ea119d725da5e3933925d13e6e2ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Filesize
322B

MD5
3dc773021a5f35fb38518d3f3d854ecf

SHA1
a4605797cdd2f4313813a9c229a26adcb982d88c

SHA256
6bd900f1a87b0c7229055877be19f0ca08bf218b0d4ad106d6d6aef34b4d6d76

SHA512
d00f69ac64a2617e42cc309f013b06c5083f14b09815d52f748301aca451b1fea1cefae870e9bdb2c1addc7f526425e74aeb4d3a1acb7f6a4b0a5bd70117084f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Filesize
594B

MD5
1d4a80b5d1443202e12ed00c760475b8

SHA1
a7a582049b477446602300a2da8bbc66209814b0

SHA256
9b6f2e8f304a70446b7bcb63eee94f6673c7c9b27eb7067db20bc5937d284408

SHA512
dbb8386b2b6b51c4ab4cae7c167a81ec9b3bfbdbec5d4777d6ff3dca8c3b5798d9e6dc7c1224103842a180c8176fbf073a4d2496a6240d2449c4d9463429b917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Filesize
340B

MD5
961464055a3b13759250f915249bb2ee

SHA1
96ef758d19aeedb540f00f9fa131f80ac641f322

SHA256
38ff7ada9190764b60247190a497d2edd6eb1d67fec959e8d78161bbcd7ad4fa

SHA512
1f4d170d7ce04365a496d957d8ee75a58441d354745c4fb7daff0f40d89b2b3a0cd8037f44d5425d32eb2b7b4e05673ff291d1049149592d1e2a3b7cc33c53f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
Filesize
44KB

MD5
5a7cfd6f69cb63bb07e08b5749ec4ce4

SHA1
a187a72c25f9dcd797600bff309049ef07130f5f

SHA256
456b31a1b72203c0d4df1fefb5a37e9106edf6d728f5a8d113da22e8009a8bc8

SHA512
bde8df28a386becf830d8ae4578f11331c8dae0368f7d67e6950bc084da6705c12547af06f2e703f25c383a256219dd9405ea99df29cf5ce773cee62c1ba4cc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
7b649006801800fb934786b988b534db

SHA1
a7867797b1a1a2abb7648357e8fb7d2993797b5b

SHA256
8cb5fb7e406a7437c3509c7061c03ba0db7d60801caf1cdb38bcdf6e43c81948

SHA512
84ba1a5c2397be9a85146f9c875da53b9dc2e4b3d0fbc26fe726776d296f08640cad97c325b26e605421bbacf595a5270c0ec7262449a98822e3f403394642f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
71bcc7a2f1c0cf3ef30960b7e9e8829c

SHA1
0171ab87924749946a43677e035adcf2ecdd2cfb

SHA256
aaf0fa52c6674fa8336d76f16d0ae5c8e85c4070dcbaa362230f269320c67599

SHA512
2f5dad917f7ecd86092b6864d7161aad00c843131ecd8ee0645e62fd668f8447a5b82827a6caf980d461b07a4bb95867d6f32e21d499200c2cc6b8b3a3f2c433

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
93df7e8331ab6185d29ebeea58f95342

SHA1
19678f1a5e59a12ecbfa4c4d86cda1d16bc8d87c

SHA256
4a79d9008d365a90b970597394b153ad5c039355dfd906d2a525da4f68abfdc9

SHA512
df026e3ab6ad508f90f58e5b855da662bd2a58b5ced96f5cc86975086d965458cc4f24c3ce53522390ef88a75be92e925a5c36dd903d8a0008c7155e82de709b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
7b649006801800fb934786b988b534db

SHA1
a7867797b1a1a2abb7648357e8fb7d2993797b5b

SHA256
8cb5fb7e406a7437c3509c7061c03ba0db7d60801caf1cdb38bcdf6e43c81948

SHA512
84ba1a5c2397be9a85146f9c875da53b9dc2e4b3d0fbc26fe726776d296f08640cad97c325b26e605421bbacf595a5270c0ec7262449a98822e3f403394642f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Filesize
264KB

MD5
3b04a4bb57594065213063a51bf8428d

SHA1
8ddecde84fa289e95bf00958ecd44fdbb4ab7f5b

SHA256
64f456b281fe6202086109480ebde8cb1c0774148af8675eb2791447387bc7ac

SHA512
ab76f72dda1aa207dcc655cdd95e0f81a2f9a279e6c0510123114648331d7f89056c3bfe68a53c99cddf447e8cb9e24ab31a62ae71e98d6ba1e911576cc088a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_4204_ECLQNQMCDQIUOTXG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_5220_BWEGHRGRBGWULVAS
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit