hxxp://ipa-aus[.]org

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://ipa-aus.org

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
2688	msedge.exe
2688	msedge.exe
3268	identity_helper.exe
3268	identity_helper.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 4016	2688	msedge.exe	82
PID 2688 wrote to memory of 4016	2688	msedge.exe	82
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 452	2688	msedge.exe	85
PID 2688 wrote to memory of 3628	2688	msedge.exe	86
PID 2688 wrote to memory of 3628	2688	msedge.exe	86
PID 2688 wrote to memory of 4952	2688	msedge.exe	87
PID 2688 wrote to memory of 4952	2688	msedge.exe	87
PID 2688 wrote to memory of 4952	2688	msedge.exe	87
PID 2688 wrote to memory of 4952	2688	msedge.exe	87
PID 2688 wrote to memory of 4952	2688	msedge.exe	87
PID 2688 wrote to memory of 4952	2688	msedge.exe	87
PID 2688 wrote to memory of 4952	2688	msedge.exe	87
PID 2688 wrote to memory of 4952	2688	msedge.exe	87
PID 2688 wrote to memory of 4952	2688	msedge.exe	87
PID 2688 wrote to memory of 4952	2688	msedge.exe	87
PID 2688 wrote to memory of 4952	2688	msedge.exe	87
PID 2688 wrote to memory of 4952	2688	msedge.exe	87
PID 2688 wrote to memory of 4952	2688	msedge.exe	87
PID 2688 wrote to memory of 4952	2688	msedge.exe	87
PID 2688 wrote to memory of 4952	2688	msedge.exe	87
PID 2688 wrote to memory of 4952	2688	msedge.exe	87
PID 2688 wrote to memory of 4952	2688	msedge.exe	87
PID 2688 wrote to memory of 4952	2688	msedge.exe	87
PID 2688 wrote to memory of 4952	2688	msedge.exe	87
PID 2688 wrote to memory of 4952	2688	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ipa-aus.org
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc8f746f8,0x7fffc8f74708,0x7fffc8f74718
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2944 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13126861665133978539,104059831036421465,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3496 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
ce952b00a413bef8013f86322dcd3439

SHA1
aaa58bfc5e4161c8c6243ee24817bf3d86bad124

SHA256
bc1c9cef8ff1695154dfd09faef45d314683d1764eff6da292c157553db14ec0

SHA512
31c74fc1bbea3c9e6d2920b309fe85c00ef48345aa7e35c059a266f4fadb56a895ee96c51395ee42839bc09e15c7c244188c304e3b17a3e38d7ce96cd05e8018

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
d3860ff6b8c5dc1e7ac37271b0a63ac0

SHA1
3506dd495ad7eed285e4dd022290838fe7b27313

SHA256
bca724cf625d93bed5eafcaa6dcf5bc2a8661320b676ad97f1547c55d00d58e7

SHA512
b462dad9c100980ece045b73458de1fa3c874c878d790e9b0df516038da722b8b926e74a756551ad77430824e0c3e2bcdec06fca91f612605a789bf54a5f5cbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ef3683b85882c708b0f60171e2d3bf6d

SHA1
ae665c07c52e75ce964ba93bad9b27a5377b4699

SHA256
96dc0eb1f449a223017ceeddb4b25c3ae4e4bf4bc7d273a3e1ef2dc3d77a2fb6

SHA512
ccce4ad80411d2b3f33bd2e4c6857aa7ab98c9d536b3d2a0ac300ade13789ee5f678934b5d9d4ee675995bc93dd0a5c73147d356726bc31a3079bd2d80ca0a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f8bde81209877675c158d1d0b228dc69

SHA1
537fa0cd0fcf9c20ea17140e63a519d83f95d90c

SHA256
79be953a8a6d92234c1c24842e35b0e39cd3b212671398e27b4895c59185c00d

SHA512
325050bc6c82cacef4134e24cb6a4e493c888d37a13738b3280fb0dff2921d0f1801b09959668162a5955a1b14a17bc00bd7349c0cd9b01758ed694581729bdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b425b6a75dd007ac548c2d72429d473e

SHA1
88278615ba5244e3f87e1a746a9ea785e422b3c3

SHA256
7010e321e86456057db161c5ae32dcd028ecdc9540486be4447ee52854c0aa54

SHA512
4714183b2865ea2eb175a09890460d066d0e604920eab79b8ad9b81403f8e45cd11342dcdc187206abe0d3d9d2eb3cca9f01825b12786af43bfae24ef78fda19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1928bb1384b4bdf4ed3194254ae6ffa0

SHA1
b0d06459d28466eebe83667f6cf56d31c4b6ba46

SHA256
c3892d2974a1fbd1ddb96b27ddd20a5efecb90dc22dd5eb67b765dc5d31af794

SHA512
d761ab6f45544e00425427d0c54bb28670cc7f4511467d98a43fe63daa91e09768a74b4afed69c00b7c2346f5ea9f752d0e9b3aca01f435a2a9c496416c0ee62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c837c9fd39c4c0fe86e242db896799bb

SHA1
3517398fb3e083709f9c3e89be79ce2c5d7715cd

SHA256
99314f0c8026aa35c1e6ef705ee95d932bd7654332f841fac88145ddb09fb820

SHA512
a37a3ead90574a248858ffa60a5b18095097aa6ed74a2cc117e1d3057c380a979207786c9319f3917b59442104d1a97e37d5dc35958917c3163ec5dcfe4785f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
20b8b7734add25cede0089d103a3c01d

SHA1
fe71aa520f1f652728964ade9189699ad647cc26

SHA256
c406df22224d98b124061a47229bceb69cc0a2698a6735405d87f053c1663dfd

SHA512
419adcaab04e2b3bb104e21c70e7af9fa9d9ec733f8f38fc0bba38e2ff1560d718e31f72fa303f422b8f5d8d99fec615f7567a9d3e851582cec4c8c65a94ffe9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c6b741dee8ab64d1d751ab1471710c21

SHA1
63b9c71682a132008630a7c5ed43cb45ac844741

SHA256
2d30601466bae0201836542a9271cbad9c28533a776ce50b89137caa683fda98

SHA512
581428d06cdba3f243913798463a60c6f654de45d9b5205f73fd4b33a2d0220774d2a96e378ee5c7466748e026622c791d50a33dc5c8de0e80a4871b2ed68ac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e26304da8913fb94bd8bfc647166bb10

SHA1
a8dcec7c9946182101c3ddcc7671a9711f8e4613

SHA256
60b81bb6e62d395951f46b0d38888762e1816f71d2358d8f4b206f2d8f52e2ff

SHA512
c090bc2411abf9477f3a6df2c34c6ef94a13f709fab044ee02a04a575f946f79fbe66fc48ac8a827721def3519dc2255146857e6495c9d8f4e6ccc484a65bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
e611163f4826c15c8705d6c2fb2072d9

SHA1
2911be8c110ab98fdffa0dee0454b6dced31f48c

SHA256
f7dce5502c6435a0e1c12a6df00c97597bf091fa1ac13e5be55ceb06e0cb77ae

SHA512
cb43bc5fd56b5dbd94e26b878a5b43b408b511358a08c1588d51a0dffdfad6d101499f1541fa46d11b73400ffc164a6bb4e5cf0d72dfccc6e5c9a4c582007177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b0a3.TMP

Filesize
537B

MD5
78f660bb82a1ed91b92d0ffdc21fa360

SHA1
ab46daa96a5db7aaf42db0e95806d4211c18ba8c

SHA256
fb487947752b02470c9bb6d791ed1c83b082eeed8b153e06c728d1aee4de9b3f

SHA512
9400b0da80941c518915e77ac691b486106605389af90264af0590be3c3d8befeeb4694cca681c9b830a269cf9798b870b7300df84ba00bcf464aaa076497ffe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
10444d314b2278b1ef3ce6b59d656133

SHA1
7f364ff6eecfa8a07fc8ca280e9f7b41744e9340

SHA256
c543748e02be809ed07ce7315c0f7242c825d163e439288e375cece6feb5e502

SHA512
6c4bf5fb3c7cc9af62288655942a2a10398301e210d26b73f36857ec1c7854bcf6c95d392e9f93b38f2eb99a5aec86882d59525d4898631d1953422b0d7785a9

Download Submit