hxxps://url12[.]mailanyone[.]net/scanner?m=1s9PCz-0000cD-4j&d=4%7Cmail%2F90%2F1716296400%2F1s9PCz-0000cD-4j%7Cin12g%7C57e1b682%7C11949542%7C14589158%7C664C9C811D87B03FE2E6472997A0C22E&o=%2Fphtl%3A%2Fatsnhtaageeteoilogt[.]rgsigc%2Faz[.]&s=1YKQiaLIfHH0tTbjCAvEAnTGAIU

Analysis

max time kernel
264s
max time network
278s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://url12.mailanyone.net/scanner?m=1s9PCz-0000cD-4j&d=4%7Cmail%2F90%2F1716296400%2F1s9PCz-0000cD-4j%7Cin12g%7C57e1b682%7C11949542%7C14589158%7C664C9C811D87B03FE2E6472997A0C22E&o=%2Fphtl%3A%2Fatsnhtaageeteoilogt.rgsigc%2Faz.&s=1YKQiaLIfHH0tTbjCAvEAnTGAIU

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4664	msedge.exe
4664	msedge.exe
4984	msedge.exe
4984	msedge.exe
212	identity_helper.exe
212	identity_helper.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

msedge.exe

pid	process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4984 wrote to memory of 3008	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3008	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4756	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4664	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 4664	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3620	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3620	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3620	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3620	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3620	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3620	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3620	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3620	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3620	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3620	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3620	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3620	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3620	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3620	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3620	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3620	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3620	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3620	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3620	4984	msedge.exe	msedge.exe
PID 4984 wrote to memory of 3620	4984	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://url12.mailanyone.net/scanner?m=1s9PCz-0000cD-4j&d=4%7Cmail%2F90%2F1716296400%2F1s9PCz-0000cD-4j%7Cin12g%7C57e1b682%7C11949542%7C14589158%7C664C9C811D87B03FE2E6472997A0C22E&o=%2Fphtl%3A%2Fatsnhtaageeteoilogt.rgsigc%2Faz.&s=1YKQiaLIfHH0tTbjCAvEAnTGAIU
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83e1046f8,0x7ff83e104708,0x7ff83e104718
2⤵
PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7092829046511274985,10318118848751555410,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
2⤵
PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7092829046511274985,10318118848751555410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7092829046511274985,10318118848751555410,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
2⤵
PID:3620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7092829046511274985,10318118848751555410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:3220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7092829046511274985,10318118848751555410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
2⤵
PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7092829046511274985,10318118848751555410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 /prefetch:8
2⤵
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7092829046511274985,10318118848751555410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7092829046511274985,10318118848751555410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
2⤵
PID:1872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7092829046511274985,10318118848751555410,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
2⤵
PID:2640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7092829046511274985,10318118848751555410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7092829046511274985,10318118848751555410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
2⤵
PID:928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7092829046511274985,10318118848751555410,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
2⤵
PID:2676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7092829046511274985,10318118848751555410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
2⤵
PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7092829046511274985,10318118848751555410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
2⤵
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7092829046511274985,10318118848751555410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
2⤵
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7092829046511274985,10318118848751555410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
2⤵
PID:2512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7092829046511274985,10318118848751555410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
2⤵
PID:552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2100,7092829046511274985,10318118848751555410,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1604 /prefetch:8
2⤵
PID:3272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7092829046511274985,10318118848751555410,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3872 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
206KB

MD5
f998b8f6765b4c57936ada0bb2eb4a5a

SHA1
13fb29dc0968838653b8414a125c124023c001df

SHA256
374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef

SHA512
d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
9b71c456193f82833bd54bf69c99abe6

SHA1
27fe4f9ba4c2e39cd758fa55d45f020632d7be3a

SHA256
13cdb2bb8cdb495c6e5ee684874200242102f9623ef47c470b2a637613986128

SHA512
949df643e6452846d4d5ac9fe95f81d7ab3e9a1e3eb10eff5c4747b2687a8254253204d3fcbb0933277be1b6bd72c8cec2c6b6c600740941cf50a6a5f92a1711

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
de8f53e1ac0f345af1c044e71daa97c7

SHA1
d9a736b295f108f6f001e64085bddfc04d72b8b4

SHA256
47de743cf4c0d5f7661dcee30c68a3c9c7ef23c554a03481294cea18153b7760

SHA512
799a3a0e520421961d55178544a9c2df9c8cc1d288cbba718aa750817a8ee7de3fe7048f1825111dbaecfe8293722521e0c11d2fd4ab532ed75a53c70bf27e6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d935c8e6d441a194c641dfe697a0ff14

SHA1
bc49efd3bed194c54371b354068f2456b9f3d8f6

SHA256
bda553c225418df7b7ac76c3269350c9bb3e563bbfbb5305dfde9baa20ab2a30

SHA512
207591cf57e07d46b6a474842af1c6178debaf89265e9b7c278430319b13e18af66ed217cf8a3505e11284bf72a2328463620398378f67f68a49b3d95019cbe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
977B

MD5
4f238e63bfb64aa9294a1cc643783457

SHA1
5628ea655787e103442d26894a32ce0df0848fe5

SHA256
2b0aa9dd86106657b751a56b658d761af1c0abdfcfb319be4dc818c6c00a676a

SHA512
07afb6258fd0b10203533c6799143adca991ca16212b5a8687668aadc2836584c8b3b3ee0bc8a6543c1118dee3a3514696727c2c498c7317bad326a3ec0d69e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
da07b94a359b3fcd16dc5bb64d096eaa

SHA1
35ef8fb7b398a1968acd6c7fabc9bfb2d4230ff2

SHA256
9c5c01d2f5f210512e04452986578db8765523b32c3a569a5952173bdbefd416

SHA512
ce6041ae579ec21c19f84c2be704fbf7fe3470c07c97a4a13634ec6734f79fe398f3f7328572e0f8f63be45724fc8a1db359b0f6d7632b5118b0ee6da62226fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b914ffbc05878ac21fb68c92cb491042

SHA1
faad17a84ce457fe35d41a87587b5937509a1f9a

SHA256
6623cea7daa302fb757b2d0270c90b265c6ad8555f315fa2dbdc99fc865a2393

SHA512
72910484dd6af678aedce8d0a4354e5e3160cb7fbf94ed303cb204f0864d11efa05a8966c4cdde9e6e3548fa8e8bc2b8f4afd512c389bc2c073952e2494b3a02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bccdb679f03b91b5fc7ab87727138600

SHA1
7b0ac458d0f1283b70569b7fbe18e1c6ee353e0b

SHA256
38dee4ab235e31137f98e2245e95e774bc61b7e42ee1f8fedf9f96db6844f6ff

SHA512
c83b842645d0baf4f983b92f862dd52e8637eeb30d25ca666c744854df7b75988540bbf06725efa51ff3c68449c892f19d63cf9b74369f5771338b03c546d105

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
535B

MD5
fbe56d68f43b871b0a6bac7b61f3ed01

SHA1
756b59e82d5b0e573ad76d6b72c8c250830a6151

SHA256
f81a49686c030e58f223188706f922a407a323a89d96bfe5c6f86cd614b1f892

SHA512
17ff3c0a4f66f2b126445016dd0afb032a42335635821c309289e979e0a02ca0cb5ba4293b72e8715a2452f427a6a45285dfccea6f10277872aa2893fe633609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe598524.TMP

Filesize
533B

MD5
48cc355c6d7d6fb64f87e4853741d1f0

SHA1
9f3d4b54c94c4f9260c98aeeace49335c58c317c

SHA256
06326a45c81372d4b4ddd39b133935d4cd62f82febfac6d67523a4dbb8f628df

SHA512
e9f0d6aedda95c2395e55852a297a30147f6363caf9d618a30258e72059f8f99d5e6c17401489a479209b55e8908e2e4a4584846450c45cd9c0bde57a4cf9974

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
013bc32e55e0559ce7cee088305c2bf0

SHA1
e91ed0f5acab8914ea394c47fdb09f74b04c2888

SHA256
f7e2a7a9f8a0642ca15c57014612326100254812372112216a21a53df0ec7049

SHA512
9e07b4c0b88cfd04a355c8ec7fbfed8b9ad393685773619eba72caadce3b73b7b140c994baa8d4943636b05933ee2e8cac0d494a52f2a67508f54fff8015d4d9

Download Submit
\??\pipe\LOCAL\crashpad_4984_LWXBVVQDVZVKZNJV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit