0d06324d56334dbf8a1d3076f76c7acd7cbad1dfbb446f743357597c8df49550

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 18:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d06324d56334dbf8a1d3076f76c7acd7cbad1dfbb446f743357597c8df49550.exe
Size

23KB
MD5

56676236306c32b0383ea4662d1d4b9f
SHA1

a78ec3ca7af409c4be0a167a0d2b54fbbd742d26
SHA256

0d06324d56334dbf8a1d3076f76c7acd7cbad1dfbb446f743357597c8df49550
SHA512

7742ed92faa7a6fccdab9510b25c0dfbeac468f2bfb9ecc7430d3193730c2e7928f7e77d162b80e272135e6228f08f59526d8e54296ee841b5486d86b9f55b43
SSDEEP

384:GweXCQIreJig/8Z7SS1fEBpng6tgL2IBPZVmRvR6JZlbw8hqIusZzZrnhAn:RLq411eRpcnu06n

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4064	msedge.exe
4064	msedge.exe
440	msedge.exe
440	msedge.exe
2504	identity_helper.exe
2504	identity_helper.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

440 msedge.exe
440 msedge.exe
440 msedge.exe
440 msedge.exe
440 msedge.exe
440 msedge.exe
440 msedge.exe
440 msedge.exe
440 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0d06324d56334dbf8a1d3076f76c7acd7cbad1dfbb446f743357597c8df49550.exemsedge.exe

description	pid	process	target process
PID 4300 wrote to memory of 440	4300	0d06324d56334dbf8a1d3076f76c7acd7cbad1dfbb446f743357597c8df49550.exe	msedge.exe
PID 4300 wrote to memory of 440	4300	0d06324d56334dbf8a1d3076f76c7acd7cbad1dfbb446f743357597c8df49550.exe	msedge.exe
PID 440 wrote to memory of 3592	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 3592	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 1752	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4064	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 4064	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 2744	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 2744	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 2744	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 2744	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 2744	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 2744	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 2744	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 2744	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 2744	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 2744	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 2744	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 2744	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 2744	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 2744	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 2744	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 2744	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 2744	440	msedge.exe	msedge.exe
PID 440 wrote to memory of 2744	440	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\0d06324d56334dbf8a1d3076f76c7acd7cbad1dfbb446f743357597c8df49550.exe
"C:\Users\Admin\AppData\Local\Temp\0d06324d56334dbf8a1d3076f76c7acd7cbad1dfbb446f743357597c8df49550.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0d06324d56334dbf8a1d3076f76c7acd7cbad1dfbb446f743357597c8df49550.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb0a1f46f8,0x7ffb0a1f4708,0x7ffb0a1f4718
    3⤵
    PID:3592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,8090455644769750870,1975802750603453612,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
    3⤵
    PID:1752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,8090455644769750870,1975802750603453612,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,8090455644769750870,1975802750603453612,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8090455644769750870,1975802750603453612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8090455644769750870,1975802750603453612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:2792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8090455644769750870,1975802750603453612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,8090455644769750870,1975802750603453612,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,8090455644769750870,1975802750603453612,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8090455644769750870,1975802750603453612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8090455644769750870,1975802750603453612,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8090455644769750870,1975802750603453612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
    3⤵
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8090455644769750870,1975802750603453612,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8090455644769750870,1975802750603453612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
    3⤵
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,8090455644769750870,1975802750603453612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:5416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,8090455644769750870,1975802750603453612,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0d06324d56334dbf8a1d3076f76c7acd7cbad1dfbb446f743357597c8df49550.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb0a1f46f8,0x7ffb0a1f4708,0x7ffb0a1f4718
    3⤵
    PID:5272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
6f52bb77800c2f122114dab734ceb801

SHA1
c74b9cec9a1eb7f6e3dbafeefd6fb55697a69ff9

SHA256
0221462156a03eb36522d34339b9da375ecacbde4b848f42c260bd213cafdb87

SHA512
4460da9abd1a618f0a2486b8d88a59d9c21d2e8a8d11e1b20b126dd70068485f209fc3e64f47e862d0244420c71b6edc053e6a2bcf740e8b16dfe35be9fed3ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
60cd9a86bda76fd7bdf3cc26b5314422

SHA1
afe650dc178da533d71f5f531cd58791a395dcf5

SHA256
fc4e5b7ca56b60ddbfe741fb2ee519d54c6a57d4441606d47d895222c8a7bb75

SHA512
5b9b7e6d5fcc300d4e8342b3a12587c2a095ba7170f41ba26426411bf339b4a5fb40ae6941bce54b799c8e18e1a4c70bb3c9374b9c33eb6bd70cbc0efa94922e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0533bad1ccb3b6531c7a28e14b56d896

SHA1
92ec74e2f039899c53669818eeb30c92e549ae8d

SHA256
d2a4df73e626cbbf3a55a943fca0afd3db205ebc83302932b49b5913a91e857c

SHA512
9994904d000407b3f1f12b1b4d280d6defd5f4bae552a90575b4f5a6847cbe0cc50eb383638cba14ddd1abe0187f643852137264b4f7fccf63a424c555ed564f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8604e86334c32fbf386778510416b0ea

SHA1
34d5c963167c3c8d28a8687b90b33b071316901a

SHA256
51d10054147bf71382d5e82270d2a2c3a98c4144ed06d3534cbed74c80b94b41

SHA512
c8343d3b345a8e5d5ab5335e76ceb0d7c3a0b174d8a918b3e636d299c2cafc41f0c8663667e0268a415333ccd883a842cb297eb080eb2b058e7c02786c4ffe3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
8e98dfc4234be79c70ed368c3efa2a7a

SHA1
46121287b1f733728678e55240a750fa0ca0a537

SHA256
710a1d3dd1d02766eeb35dfa0ded621dac362bd6d7f3425f8ba4d2ecc4ef98ec

SHA512
1b3382b9ebc2a07cd70cf48da0182171e874e1aa7746460d57951d56413a7f12028499fe90cce5cb83ad4f73be1f6bc6a9e273147fc5207536b400cba7138d73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bd35.TMP

Filesize
371B

MD5
a9463d88948803b1a685d46d3cc3c2db

SHA1
afafb2d01a297693a2633e67eb7b7cb159cb9bef

SHA256
978707ea947550f63c19c3a8c52c2f420296b5d567831e1a85c386b94e2005d7

SHA512
1f89943f581132ebc8190d6f24c7634a14a9e3c33ce4503ce7e7f0402a171746081a8e1bd6dfa1a90158ef350a5752a07c008857bd8eea85c449d1dbc3e8fb17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1f9cd2f9c51cbfc89cedecc2ac7c9cbf

SHA1
c197312d6db4a99a4fabb7751c5059a3975edbcf

SHA256
7717cd3a9a119270511eb93bfe106dcc66beb2307ee60eff69bc51a3524c2e58

SHA512
159bf57471bab2f2bcf46c79042f5795abbb84fca6520c371965462b61a9402e8cc666f9140969ceef09c057a76f1f99d55ed88fadfdf00eadf6df27b0ac9478

Download Submit
\??\pipe\LOCAL\crashpad_440_LZOLUGGVETLBXTMQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit