ca6a1b0df4d33923183dd8616bb47c01794dfd90937487b89c3c278988d50878

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2023 15:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d19c5c30997ea53078e51de8e0afceb1621b7755472521f8b6506ac4700db4f5.exe
Size

36.6MB
MD5

22afccf162882f9262ae2fb951a68289
SHA1

d312f1f99bf6957f07fda56f7cb68a90290ad209
SHA256

d19c5c30997ea53078e51de8e0afceb1621b7755472521f8b6506ac4700db4f5
SHA512

d10f29d5bfe761fdf4bf4bfc2a3a9aa11aa161248238c016ebdfbbbef13a834dbd3f170e8ce0ffb6b3ee0f9aa822620252735b842838329b4b8276772ee7ac5b
SSDEEP

786432:w3P57f7Vgkl+0avOSI0m+6j59VJ/MJKHb+97GsFfdp2F29:wB7zVF2vEn+6J/MNZzlpAq

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3808	msedge.exe
3808	msedge.exe
5108	msedge.exe
5108	msedge.exe
3080	identity_helper.exe
3080	identity_helper.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

5108 msedge.exe
5108 msedge.exe
5108 msedge.exe
5108 msedge.exe
5108 msedge.exe
5108 msedge.exe
5108 msedge.exe
5108 msedge.exe
5108 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d19c5c30997ea53078e51de8e0afceb1621b7755472521f8b6506ac4700db4f5.exemsedge.exe

description	pid	process	target process
PID 2216 wrote to memory of 5108	2216	d19c5c30997ea53078e51de8e0afceb1621b7755472521f8b6506ac4700db4f5.exe	msedge.exe
PID 2216 wrote to memory of 5108	2216	d19c5c30997ea53078e51de8e0afceb1621b7755472521f8b6506ac4700db4f5.exe	msedge.exe
PID 5108 wrote to memory of 896	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 896	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1584	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 3808	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 3808	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1552	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1552	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1552	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1552	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1552	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1552	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1552	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1552	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1552	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1552	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1552	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1552	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1552	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1552	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1552	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1552	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1552	5108	msedge.exe	msedge.exe
PID 5108 wrote to memory of 1552	5108	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\d19c5c30997ea53078e51de8e0afceb1621b7755472521f8b6506ac4700db4f5.exe
"C:\Users\Admin\AppData\Local\Temp\d19c5c30997ea53078e51de8e0afceb1621b7755472521f8b6506ac4700db4f5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d19c5c30997ea53078e51de8e0afceb1621b7755472521f8b6506ac4700db4f5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffdad2d46f8,0x7ffdad2d4708,0x7ffdad2d4718
    3⤵
    PID:896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,1834935947417027135,9686003637271388016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,1834935947417027135,9686003637271388016,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:1584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,1834935947417027135,9686003637271388016,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
    3⤵
    PID:1552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1834935947417027135,9686003637271388016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1834935947417027135,9686003637271388016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
    3⤵
    PID:568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1834935947417027135,9686003637271388016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,1834935947417027135,9686003637271388016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
    3⤵
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,1834935947417027135,9686003637271388016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1834935947417027135,9686003637271388016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1834935947417027135,9686003637271388016,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
    3⤵
    PID:2096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1834935947417027135,9686003637271388016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1834935947417027135,9686003637271388016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
    3⤵
    PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1834935947417027135,9686003637271388016,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1834935947417027135,9686003637271388016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,1834935947417027135,9686003637271388016,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4960 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d19c5c30997ea53078e51de8e0afceb1621b7755472521f8b6506ac4700db4f5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdad2d46f8,0x7ffdad2d4708,0x7ffdad2d4718
    3⤵
    PID:1440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ef2ab50a3d368243b8203ac219278a5d

SHA1
2d154d63c4371354ff607656a4d94bc3734658a9

SHA256
2e2faf2873e0b8d58788da8603acdd772642a396fff661c4e32f8a581362cbdf

SHA512
4533997bf4070f99306337b8ff553691d4cf1d1b53401628524ad4dc9d29bd0536a3f2df4ecdd0a8afa81b7f917f40524c9a1898b566ee499a358abc5c84b27a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ef2ab50a3d368243b8203ac219278a5d

SHA1
2d154d63c4371354ff607656a4d94bc3734658a9

SHA256
2e2faf2873e0b8d58788da8603acdd772642a396fff661c4e32f8a581362cbdf

SHA512
4533997bf4070f99306337b8ff553691d4cf1d1b53401628524ad4dc9d29bd0536a3f2df4ecdd0a8afa81b7f917f40524c9a1898b566ee499a358abc5c84b27a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
21bb0416092ccc880d323e9c778b365f

SHA1
a3b532df1aeb65ffea8956f62e5de39f95ecfeda

SHA256
f4564d78cd9f0d2e7024ea0210d17d3af795ed62157c664baf8d2228018a2501

SHA512
671cfa1089647fd987d5a79fae5e82602bc42c2966c0e6673e96db469dd6551886bde72aea278c8e867269abc1855c98462d9aaa85bff5cc1f3273c6b940f3a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f89759cb2cfe8a4aee5bef2c410da74f

SHA1
b18c38129221f51d4d9da7d1f41c746947f79965

SHA256
4259b6da52b86dac1688d30ca904ea165db727ff086a3354cfabf297089cac31

SHA512
05f45e7e20b30eb27bffb1b94a6addb53bde3fec5d62ba39a2557d941387d877bbcb680aa67680f89c669c667882772e688d994c1de482e96d76df391feb7b11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b9e08a7801df6430de8d5f4fb4070cb6

SHA1
8aa53afa1c2b8a3db51c1e4ed640dadea44d2d01

SHA256
43125e82ecc092c348245c424e1e01ebc4e247a0aad6f50c1b08cba43f916461

SHA512
3d5292cb9edba5e73cef725dbed1a1adf460c2c57ef14a466d5cd022993e0633096c9eaf911bc224ba20b35814e6f7080c6318b919b2eea1a4f758553b7d457b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c2dbc35fe4a0f1a2cd6f05b7af0a7b03

SHA1
c56552159d2b19e0fe8fe233bf7c7e14ec899d97

SHA256
650f5bfed9a5984b892e5d1a533fc5cfa99fcff3be1cfef6a71f547614acf32a

SHA512
06a813918482990843931939f289b677aeb09e459637b2a4555b5d635126d9b4b99d952d7a1fcb8d7fcf555ff05371c501de7f08a81a72704b6c90aae43ce390

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
bf38e67347aea6d520cda5fde321a1e5

SHA1
0e7a8def4c923201d76b41dfa9918bb1052827ea

SHA256
0f0744f36e30e64949c41835aa5666f25c1ab4f3636d9247b8350fd8ad4f8025

SHA512
f62478dd4e38c6bef2bfc24f46caa03840613711e2b6fda2aad707df5cbd33b25af4fc3954521e203b981c4a10e5c8fd2520cabc16cdad858eed819b45a6f366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
547527fb7748b85f0a069182b483cfe1

SHA1
1a4f00bbd3c943782b51ac95511888a354a3246b

SHA256
25ada4e8f192814f58febf69cf55287f9d3689b5fd56bdcbc62fced496696c80

SHA512
1b41c24bc8d1984e888a0d4df570fdfe9c58e7571a47aca7be3a6b22a8178ae814aebc6f14ac5e47523c640457d188f541e64cdcee5996a67c56eebe995dfb71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584acf.TMP

Filesize
371B

MD5
dd7f92b7f45fed9a85f35b728d4a3a0c

SHA1
09de9c7455b40fb7b3a13d146c7673835dcd918c

SHA256
28a577c7c609119b14c49774c34a3eef62905d61e1a62b1380fca15b282b39b3

SHA512
0035cbabd0ddcc80dcdc21144dec864693803198449bd1bf3f34ef8afb3a8c79d8846fff36a4fca45073c79f129d64687c1380cc36b269367689ff783110c008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
61ff8d6b6c4cfbe14892cad06d57cd02

SHA1
f0ca941cee082b55c886d9d17660727fce2bda6c

SHA256
ee436ffead7e61a0e361041a8d5ed6712fd9e591d0485a420ae6291268b95a9d

SHA512
4af1411b6df528444110d9b751bdd0d10d476e735166eae876b0693ff8893d324775a3f0373b9e3186ea4017c9d675238479f2c472d7339baebebe03b1e8771a

Download Submit
\??\pipe\LOCAL\crashpad_5108_IXYNUXWSMFKUREOQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit