235be39bd1a684f2a9ea791f4c6bf842ceeff23173ffb762901868e460f96c9d

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

235be39bd1a684f2a9ea791f4c6bf842ceeff23173ffb762901868e460f96c9d.exe
Size

172KB
MD5

4c3ed4c5425bbf0b5c37c0b5ae724e62
SHA1

9e2909e4b0398102c6323feddcc2f4691e6abc9b
SHA256

235be39bd1a684f2a9ea791f4c6bf842ceeff23173ffb762901868e460f96c9d
SHA512

e10347aea7a32f25e98e1d815cd3aea90ee9824aa4918f386eba5bc24da02b69fa90bc206836e8a073293d7a34bee3ac16b5c6d89ac826dccfbe462408a553b7
SSDEEP

3072:eqacm74qpXtmOnJjBawT253uaxfKfVvXgDOL3D7pPL0F0JCb3O3Cb3h/q/UEcC8m:/sfVtjqP1jh

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
440	msedge.exe
440	msedge.exe
688	msedge.exe
688	msedge.exe
3116	identity_helper.exe
3116	identity_helper.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

688 msedge.exe
688 msedge.exe
688 msedge.exe
688 msedge.exe
688 msedge.exe
688 msedge.exe
688 msedge.exe
688 msedge.exe
688 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

235be39bd1a684f2a9ea791f4c6bf842ceeff23173ffb762901868e460f96c9d.exemsedge.exe

description	pid	process	target process
PID 4676 wrote to memory of 688	4676	235be39bd1a684f2a9ea791f4c6bf842ceeff23173ffb762901868e460f96c9d.exe	msedge.exe
PID 4676 wrote to memory of 688	4676	235be39bd1a684f2a9ea791f4c6bf842ceeff23173ffb762901868e460f96c9d.exe	msedge.exe
PID 688 wrote to memory of 2404	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2404	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2096	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 440	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 440	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4404	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4404	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4404	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4404	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4404	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4404	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4404	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4404	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4404	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4404	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4404	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4404	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4404	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4404	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4404	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4404	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4404	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4404	688	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\235be39bd1a684f2a9ea791f4c6bf842ceeff23173ffb762901868e460f96c9d.exe
"C:\Users\Admin\AppData\Local\Temp\235be39bd1a684f2a9ea791f4c6bf842ceeff23173ffb762901868e460f96c9d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=235be39bd1a684f2a9ea791f4c6bf842ceeff23173ffb762901868e460f96c9d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac7f246f8,0x7ffac7f24708,0x7ffac7f24718
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,10663999927636182351,12363582999276000942,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
    3⤵
    PID:2096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,10663999927636182351,12363582999276000942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,10663999927636182351,12363582999276000942,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
    3⤵
    PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10663999927636182351,12363582999276000942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:3036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10663999927636182351,12363582999276000942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10663999927636182351,12363582999276000942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,10663999927636182351,12363582999276000942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,10663999927636182351,12363582999276000942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10663999927636182351,12363582999276000942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
    3⤵
    PID:1644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10663999927636182351,12363582999276000942,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10663999927636182351,12363582999276000942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:2672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10663999927636182351,12363582999276000942,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10663999927636182351,12363582999276000942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
    3⤵
    PID:1976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,10663999927636182351,12363582999276000942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,10663999927636182351,12363582999276000942,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=235be39bd1a684f2a9ea791f4c6bf842ceeff23173ffb762901868e460f96c9d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac7f246f8,0x7ffac7f24708,0x7ffac7f24718
    3⤵
    PID:4872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\028624de-495f-43ae-9994-11a25ca8e691.tmp

Filesize
11KB

MD5
97386bf5aede11d93d18214adfac2d38

SHA1
3f2e7c52b0ee19fb42946a77e9128aad8a11703a

SHA256
aebb23211f9f433e72f0a45e5e136fa38d8c0dfed2869fc141d8326b1e7d5693

SHA512
d9116ffa55917b8e64c76df791976ae11d0ad62ec50e06ef62903e44affc94d7e26ca485d54c85f438ef09616c7eaa2622e4365a4484d1496175a3fa9e43e301

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
3f2640a84c279de6e8b6e1c2807efd12

SHA1
ded080cbffd6bb78dc88f85615d887e9b3f7c97c

SHA256
5ebf81e0331bacb448dea3cf79ee2f3a503beb2bc1a55851ecfeae13e3cdbd02

SHA512
0c701387ccf3c45e108676f288f79be8a7c0107c567a061f989592244830e8361b39036da3543a517aa286b52cc32be8186dd7cd0b6df3ef45fb2bc46a3edc0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3a917a21b9d4c7d0b50ca8cd6cae45f2

SHA1
086599ad3edddb4d246070551aed96df55dd1779

SHA256
7e6414abac7dab36723bce35fdd6cb0854e28f1329e4116fb0cd3d526ecb50a9

SHA512
fd04673352062c4d5c103b72ace0a3f3fc7a7ab99d1e200083379dc2694ea80f25b8448aebdbcad05d31d60f4e377e89562d538e12c3f96dbf6b282d4eb9a19c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b461fbe6384f5b697df7014a3e07b6d9

SHA1
3b9773fd199bb6d8ae0cf2ff1484f5fae5d1dc1d

SHA256
b6d380c29f46a6647be4973b78dc841d5a8137bd9e5e17a940c843b88de4d047

SHA512
867cda4685ae83eace622dfd5e6515ccb8c61a7bb40738a3ffbab348e5b900706a526b605950aee14f001b55ff78e79493c1abc8ca7d9a5908431fc5f0ded72d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
76e1ba1e6c8d9b52e19d50caaf5f88a3

SHA1
82cc3b7197aa98c488e0839d77d5bbd3fda58c68

SHA256
a67d4bf7dcd2f48da25bfe45604d100efa14e761dea40ad5e9a428b3cef9fff8

SHA512
0bd9ed56992f50f4adffdcd1fb2b7acd90b74c4ae837a2dbd80ccb5b1dc5427e9499ce6f8c88ce56cca4ac62e43f3e5aa2318d4156cc31aeebef3fbb77c4e5ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
184d0dcf5297ed08a6e184eb8e2f75fd

SHA1
481455e1f2f81c957d6937e83cf1429176dde3a9

SHA256
3152334f51c056cfdcf81b308328feed7e59f1b3b0489aa06fc41cda674e2fc3

SHA512
39de8a2896ee64b29b7e809e6d25d8a2bd6858efea7c97b790bcba56e3bad5c244cb4997a4477cc9938ccfe3188e19f6c829ff0ba9900391a3a2d56217debd94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ccb6.TMP

Filesize
371B

MD5
3e54cf97530868197240ed21da7db362

SHA1
570af0e29ba1d9a0b1ebc5c25308973b71f5714a

SHA256
c5ddc4948e6b940071208ce37442a6a30792036ba4ce979ac564eb67ee18bd87

SHA512
10da44624f51cf0481a559aeb99dd8f5008fea48ce118121993f3554c1a00806fbdfde63103ed20b0c3cc1650e49a49648060e0b5748f519e7d2f9938f7d65ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
\??\pipe\LOCAL\crashpad_688_ZCDGJBFLEDAPYXCZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit