hxxps://splendidedwin121463[.]lt[.]emlnk[.]com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkZwdWItYzU4ZDBhYjkyOGFmNDk5ZWIwNDUxNzBiNGY0MmI5ZWIucjIuZGV2JTJGcHVyby5odG0lM0ZxJTNEMTI1NDc4Y3ZpZCUzRGU3M2M0MTg2NzljNjQzOTU4YjllMTg5NDIyMWY0Y2YyJTI2Z3NfbGNycCUzREVnWmphSEp2YldVcUJnZ0FFRVVZT3pJR0NBQVFSUmc3TWdZSUFSQkZHRGt5QmdnQ0VDNFlRRElHQ0FNUVJSZzdNZ1lJQkJBQUdFQXlCZ2dGRUFBWVFESUdDQVlRUlJnOE1nWUlCeEJGR0R3eUJnZ0lFRVVZUE5JQkNERTFNalpxTUdvMHFBSUFzQUlBJTI2Rk9STSUzREFOQUIwMSUyNlBDJTNEVTUzMQ==&sig=3XDH3rmZoQu7BTn98gpb9SvqEXZH6nqA9NiwR64p7KJf&iat=1716522499&a=%7C%7C652463995%7C%7C&account=splendidedwin121463%2Eactivehosted%2Ecom&email=5%2BsB9tk%2FfappASz%2BVpjLkphy3qR7uDICPKIKmAMF9b9NsQkxvtYQ9g%3D%3D%3AneLBeYSJ3c3MvNC5nojt6%2B8TNuFM74rB&s=3834941fbb829496edc41ec58674ea4f&i=1A3A0A11

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 08:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://splendidedwin121463.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkZwdWItYzU4ZDBhYjkyOGFmNDk5ZWIwNDUxNzBiNGY0MmI5ZWIucjIuZGV2JTJGcHVyby5odG0lM0ZxJTNEMTI1NDc4Y3ZpZCUzRGU3M2M0MTg2NzljNjQzOTU4YjllMTg5NDIyMWY0Y2YyJTI2Z3NfbGNycCUzREVnWmphSEp2YldVcUJnZ0FFRVVZT3pJR0NBQVFSUmc3TWdZSUFSQkZHRGt5QmdnQ0VDNFlRRElHQ0FNUVJSZzdNZ1lJQkJBQUdFQXlCZ2dGRUFBWVFESUdDQVlRUlJnOE1nWUlCeEJGR0R3eUJnZ0lFRVVZUE5JQkNERTFNalpxTUdvMHFBSUFzQUlBJTI2Rk9STSUzREFOQUIwMSUyNlBDJTNEVTUzMQ==&sig=3XDH3rmZoQu7BTn98gpb9SvqEXZH6nqA9NiwR64p7KJf&iat=1716522499&a=%7C%7C652463995%7C%7C&account=splendidedwin121463%2Eactivehosted%2Ecom&email=5%2BsB9tk%2FfappASz%2BVpjLkphy3qR7uDICPKIKmAMF9b9NsQkxvtYQ9g%3D%3D%3AneLBeYSJ3c3MvNC5nojt6%2B8TNuFM74rB&s=3834941fbb829496edc41ec58674ea4f&i=1A3A0A11

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2244	msedge.exe
2244	msedge.exe
3264	msedge.exe
3264	msedge.exe
2544	identity_helper.exe
2544	identity_helper.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3264 msedge.exe
3264 msedge.exe
3264 msedge.exe
3264 msedge.exe
3264 msedge.exe
3264 msedge.exe
3264 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3264 wrote to memory of 1860	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1860	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 1348	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 2244	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 2244	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3944	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3944	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3944	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3944	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3944	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3944	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3944	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3944	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3944	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3944	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3944	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3944	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3944	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3944	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3944	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3944	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3944	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3944	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3944	3264	msedge.exe	msedge.exe
PID 3264 wrote to memory of 3944	3264	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://splendidedwin121463.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkZwdWItYzU4ZDBhYjkyOGFmNDk5ZWIwNDUxNzBiNGY0MmI5ZWIucjIuZGV2JTJGcHVyby5odG0lM0ZxJTNEMTI1NDc4Y3ZpZCUzRGU3M2M0MTg2NzljNjQzOTU4YjllMTg5NDIyMWY0Y2YyJTI2Z3NfbGNycCUzREVnWmphSEp2YldVcUJnZ0FFRVVZT3pJR0NBQVFSUmc3TWdZSUFSQkZHRGt5QmdnQ0VDNFlRRElHQ0FNUVJSZzdNZ1lJQkJBQUdFQXlCZ2dGRUFBWVFESUdDQVlRUlJnOE1nWUlCeEJGR0R3eUJnZ0lFRVVZUE5JQkNERTFNalpxTUdvMHFBSUFzQUlBJTI2Rk9STSUzREFOQUIwMSUyNlBDJTNEVTUzMQ==&sig=3XDH3rmZoQu7BTn98gpb9SvqEXZH6nqA9NiwR64p7KJf&iat=1716522499&a=%7C%7C652463995%7C%7C&account=splendidedwin121463%2Eactivehosted%2Ecom&email=5%2BsB9tk%2FfappASz%2BVpjLkphy3qR7uDICPKIKmAMF9b9NsQkxvtYQ9g%3D%3D%3AneLBeYSJ3c3MvNC5nojt6%2B8TNuFM74rB&s=3834941fbb829496edc41ec58674ea4f&i=1A3A0A11
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff86ae746f8,0x7ff86ae74708,0x7ff86ae74718
2⤵
PID:1860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,4860956030594018938,15646840937838373920,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
2⤵
PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,4860956030594018938,15646840937838373920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,4860956030594018938,15646840937838373920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
2⤵
PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4860956030594018938,15646840937838373920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
2⤵
PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4860956030594018938,15646840937838373920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
2⤵
PID:4208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4860956030594018938,15646840937838373920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
2⤵
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,4860956030594018938,15646840937838373920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3968 /prefetch:8
2⤵
PID:2592

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,4860956030594018938,15646840937838373920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3968 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4860956030594018938,15646840937838373920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
2⤵
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4860956030594018938,15646840937838373920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
2⤵
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4860956030594018938,15646840937838373920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
2⤵
PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4860956030594018938,15646840937838373920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
2⤵
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,4860956030594018938,15646840937838373920,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3628 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
7d425630e70a6c1ffb53026a7b7594db

SHA1
0c9390982332a55c15d5bcbe887e1a710ee9a44a

SHA256
c9c4b3abbd6ebfe346cdf9ae7710175d82d7cecc1c56699827191bc076f243ee

SHA512
1dcc80e04474ab3b28cbebd43d03859c2ab64b0659d9dcd9f1e0eb004efb21be951d57bcdfb8ea9a0b3894c091a79cfe17ced2a3531af35bea1c2db96e09156d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
923B

MD5
14c855eb926d0c59d8aa4afc24a3ac06

SHA1
4a43d48cfc91a2602eefc6c90cfa20c726464ffa

SHA256
6d105ee055ab84c2f26eb04b5a6549e46db36bef214731bdf8654ef1f85a8589

SHA512
69d55ab84a4d7152c4ae83d98c2eb897d67a06615380e84408004324f82c1bf751e65c6c66e41731d947d447424ae0de207cdd17f4feb6ab5650bf94e01701e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
d4eb684d78f5a05e2eafcb92c0af043d

SHA1
1e277af59a821ad8e80a54b91d9f65a968e367f6

SHA256
c3afeeabe8ea26afd093e793406d04786aea0efaa7ec61bc373f0c8c347af3a3

SHA512
f8bda23180389365513962e138beeb7a17a523ab1462fc829c237727fe828924b6b2c24d45770702a90e5b14e5d605ecedf700c203fa5d07d0df33a13bec7460

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
efb130947bfe079c17fb0815743ed092

SHA1
1fd5917da244bfa361dfde0daa5d756228ea39e5

SHA256
7dc829542166f33cd27e2c076344f79161a990a8cfede68c9537c318bc0e6eb1

SHA512
a75a8fc9bf5e57b9d87ac586ffc9e9bd6062e238b9f28042050be1c8698309a4080e2094aebc896b9a017e64c1194f35fa8ea4faf2a69e7b28423e60426a5c42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
ae4980d85995ecfee0d9e61dcf6ae2f3

SHA1
a71624ee6c0513bc353fb52403a0b9824f0db110

SHA256
18df0b16ec531a8c18efb66df0ebad6617bac1d8a7c7533e8ba9ed7c7dc3bc93

SHA512
ad272f7d7f52c2fd3b742ef34fabbe15d9dde372c3d0c1a5deaa729e356ce3e7b533b28069cde51c89bbaab82879f0566bc3b8dc2c2c8f737b5780ec9fcb9537

Download Submit
\??\pipe\LOCAL\crashpad_3264_EXRZGFMNNLOZMWSZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit