2896e1ebe90347a650c2ea28f23bb6818795d53a49adb7f746c6dbeb8fed1916

Resubmissions

21-05-2024 19:48

240521-yjkz5sgf21 1

21-05-2024 19:48

240521-yjcnrsge33 1

Analysis

max time kernel
240s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

751B
MD5

6d6069a6adf3e607911a4da8841d450b
SHA1

4f1e90d8733a46942884a14f7663bec9f4cd2ea7
SHA256

2896e1ebe90347a650c2ea28f23bb6818795d53a49adb7f746c6dbeb8fed1916
SHA512

df1d0be59814c438afdffe4a167e296a03bef0661f51945538d9013a5b17815a1baef798df502332e520ac0dfe092c7b04840c3bdf44b39cc0d11d5c82669e77

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3528	msedge.exe
3528	msedge.exe
4632	msedge.exe
4632	msedge.exe
5184	identity_helper.exe
5184	identity_helper.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4632 wrote to memory of 1336	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 1336	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 936	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 3528	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 3528	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 6128	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 6128	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 6128	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 6128	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 6128	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 6128	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 6128	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 6128	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 6128	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 6128	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 6128	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 6128	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 6128	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 6128	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 6128	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 6128	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 6128	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 6128	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 6128	4632	msedge.exe	msedge.exe
PID 4632 wrote to memory of 6128	4632	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa127d46f8,0x7ffa127d4708,0x7ffa127d4718
2⤵
PID:1336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,2511739042926002402,4440125616156100129,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
2⤵
PID:936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,2511739042926002402,4440125616156100129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,2511739042926002402,4440125616156100129,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8
2⤵
PID:6128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2511739042926002402,4440125616156100129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
2⤵
PID:1224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2511739042926002402,4440125616156100129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:5428

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,2511739042926002402,4440125616156100129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
2⤵
PID:5760

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,2511739042926002402,4440125616156100129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2511739042926002402,4440125616156100129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
2⤵
PID:1456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2511739042926002402,4440125616156100129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
2⤵
PID:3052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2511739042926002402,4440125616156100129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
2⤵
PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2511739042926002402,4440125616156100129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
2⤵
PID:3804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2511739042926002402,4440125616156100129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
2⤵
PID:2516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2511739042926002402,4440125616156100129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
2⤵
PID:5764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,2511739042926002402,4440125616156100129,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3768 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2511739042926002402,4440125616156100129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
2⤵
PID:1632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2511739042926002402,4440125616156100129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
2⤵
PID:3348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2032,2511739042926002402,4440125616156100129,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3504 /prefetch:8
2⤵
PID:6068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
18KB

MD5
ab939e6ecb09c18ba142603448d1e53d

SHA1
1f32c216cd92cda457c5db94957cde72f9fdd22e

SHA256
fe7ed34be041647e2a8111af201f6d33a135476c4ef7c557a44c5b83f33b2e46

SHA512
ddba8c8716e2e5ae29443d0a0c21ebb89009b5b33bb550255141f3b5b64e58aac863c1729a032a32c57ccc55f824db3024f1b60374b6f00e34fb19c7f69edd33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

Filesize
1.1MB

MD5
f3de1394df7c1c8d5a80b1b3f00bd31b

SHA1
1efece022a285445abdfae022b2873da53ffb7ef

SHA256
2b353b406918d148de3ce8ddafffede9322b7c9d6fe8bef9a0ac8a4ebc464bb1

SHA512
8fbec5ef978e7b5244623e61e476a766e4cd2d0d17fb3a9af70a37f5b961ff7052f8a6c4b5cb7ca4d294856f8ec3a539f6cef39849b21a3f1763f9e90b73d08d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
6ad4351ec70c9c92f606a2992b9f90c6

SHA1
731e0d049bcce0d9906a810b08cc5305c22d76b3

SHA256
ac309e7932b293635615300d0039210fd84a847d628e1410a9307ad33c985802

SHA512
983c703735ea8a295072cf367b7737a6ed61761757aff69f1006670d1140bb12a25090611cffa884b95bf6676878af5bd81ad45b821c9396892c6292fa123310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
a627e7878279e3b24c77b5443e3eac68

SHA1
d52295588639dda4076cab41238d7353ac8f1295

SHA256
158af39ce43762ab3735c71582985912a660ad8eaac5edca2cf4833e5ab96dbc

SHA512
b9e8c5334f1ff79ff31bc0cf7cfc998995712a6e92de3dba276bae4a001f1e7a646ec92a04a576049732046e3d677fc5fc34fba25f10c059cd6c4581f0395049

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
b3c0679434e9096394817e283972d184

SHA1
2c0a0ba4cfce2b295bc8919c98dbc1033adbb340

SHA256
d5211803394032efb1c9905769a272f6574b85da27e6594c27ae33ea1e3e6379

SHA512
1f6716cf11157b4ec9458b844eedebf1eb16df27bffd2e469bed732f41e59acabbd6baaf48b6e2fa81cf7f516aac71b160284efe6dfa299e5edeeceb57004ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
8453cdc921b6d4a8a05a47df4db553f8

SHA1
331fc34ea5e86448701353fb16033fe923473d34

SHA256
2a3830843d88d37dcae9e242cf0abb93e6f9ecb2d5e9bcbd85c76c7900cd1819

SHA512
3e415548e0742c4d7ce616cf97cba2c871bd955a1f0e0dad34330d27ea80e13544b7ef671198a09027ece9d7fd9ec320698d0553c2b511fda338c130d83f2a3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
393B

MD5
3ea6c1705a6ac1324aadd0d9051809fc

SHA1
ca27fc69d96a0c110c26ebd1ea194ff67647497a

SHA256
592dacf61b8b01493078a3ca8f0029964c91636249405509505aa87cd0326a11

SHA512
2130d312189d50ebeb19fd0e6282df94710f97f1d18383d31d0dd73b383b1eefc387f2d03e9540803d25938f0197ff506257a562c63c72c15279b90dc48d41fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
615B

MD5
f53be1839cd908942cf594740a638243

SHA1
836264931cd7c5f9996cd397670bd8ec53bfd689

SHA256
bc2b4ea69e4ed93591f397b8eb4fdd365d3cc91dc572bbd094bc998177aa56d2

SHA512
39663fbb4dbb8e05b576bee97eba0db31a76023d88f4303517e54342c9b4d727443c0c7c7005fc9369042e920ac9f15d85114ff169ddf84c8f4af53edd2d4565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
739ed1b88b9a36ed6ed6077d8803f39d

SHA1
f9eda27b7fc0a31d0bdb7fdb1f3fa5351030c99f

SHA256
df7a30a778416232896c5162de6e343b24083f6e3449c4918c1caae39be4261c

SHA512
3033de85e4dbd6b383dcc1eec45237f7d479d819ab30c3ec5a93b7797ffcbc74173b1d1b49fdd2b97f838236f1c3d5da7ffd57b5be346e4d44e3d06c98670548

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eb7cb0bc95162d7f5a72092a54c6ba5b

SHA1
3683bca70aec0db946bf2c34d11219144af4e568

SHA256
9a38348a414c5f85a1569ab9ed8d8887c8ac78863b8d21dee84b919fcc0aed0f

SHA512
9a67cdfc9ae9640be08982156e304ea82dfb46b6e943cf5b7350861a3c9cd5f678daad25cd8a5ec0ea70099ae23c1d43372c5a30283b9d5c9492bf1f748ce825

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ad6047e0d33f4dd6d8bad4c82b438bb2

SHA1
d8ab1854cba340d9f20bdd466ec4d277bafdb043

SHA256
be91cc495702461ac15229cbea3dcee7d0446a175f8652a115f42c0b023a0d49

SHA512
bdefe5d1f46781d0eb3fc8a96fb49f1e925d071511e70ca910bf1a86cf99a0c867b85dd19834e1ae246c73f473176bb6563490fcf5b5cb4f6378c5fd41a6c9bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d69da2dd9a7a0aa599eb1b76c8b6bd9b

SHA1
e0931d591a2d2e01d6b271d6795dd0486ffd0177

SHA256
a96c499488b21166bdbf855918d321640b02d723ddfa69156d258e24aa39942b

SHA512
8d3313cd3e83db2ed07598b0faef0241b024f77923c429da4dadcd3f223d5e56eb84be73bcb61ada55c440f9762fe3264f76771bf351c389a6a6dfdc8a3c4016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fe14143dde46323eb7fe99e2044a0bcb

SHA1
8296b1a205e5d100b315764739645bceac4e7b53

SHA256
54f894a312cf3742d9b721b925da71a05bb206dfd166514b37ddfbddca5a0d30

SHA512
6043ff1c1753a18980ff13f38f04e43261acf57e407e413e9ef57fbb0cd42300e2536462c289525f6a24b3a6b98178b7521eb0b7dbccce9832eef2c53ca57f65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
174e367bc91a9464054b1710f720ed5f

SHA1
dd7423259f1ae0838dbce4846607f53ee7e326c5

SHA256
7e4758aed9061e0d122c55e9b9b8af56138e07466ea3a5f7b9b21f39bebf2a06

SHA512
81e346b4e1f353982edef044de35f6d2a96ce02361cc06ff31fb47e3fb4ba54e356893a36d110860edfff4b73322f3fe94f36c380f88a14b79754c6a3950c5f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4140b21f5c8f0f9caaf2c6bae644320f

SHA1
ebc127d46b659cd92ef3a5fdca50cb07389de706

SHA256
601704ad1bf9877b05662029cda8f74401d3b3ac8c2a6e6bdd92b5268841e7af

SHA512
d2c9cdd7e87e565cbac76c259e336258084a4c03c658608383d7c7a606d9267a897d09502a14317e93a58a37a01a6016e3e4867fd6d82171a2a41928e6937a17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d0d49d0a376ef4028de5b08039e65be3

SHA1
04768041e8b5219d157668a10f51c2bf08ca6ab7

SHA256
89051e339657aba0588314acdab0cabbbf1156384b2fba929f062d057499cacd

SHA512
227ce8361d14462eb89875cac0f9143a16a8d6765ac557f800eaafdb941dd0b728095fbc183a2a9f1c51be68bd7ba8563ba5ad7c79082e87f4c36bb7c072502d

Download Submit
\??\pipe\LOCAL\crashpad_4632_EYAZQWQDMPLNCYGN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit