0d6e09e3a2340a6e80a53ca8181276bac5424405ff5b07e4707a32af997cc7f4

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d6e09e3a2340a6e80a53ca8181276bac5424405ff5b07e4707a32af997cc7f4.exe
Size

39.2MB
MD5

d98f63acac1e752907e9ed968471b5ca
SHA1

5a4a083912651dcbcd2cc42f65aa81d28b3db6a4
SHA256

0d6e09e3a2340a6e80a53ca8181276bac5424405ff5b07e4707a32af997cc7f4
SHA512

1c8ea4bba6b002d4daef19d829d631717af9cd5cb4cf468a94a2fe1603ea50fbbfe3d036cef8a9b82ed2166a09302ccd21b2b0874ab1d8162de1aee2f8af251e
SSDEEP

786432:Ml6iTfRwFOU8ofAl2jpynU1PKcDxvV/yaPZM:if2V89l2YncKcD1fM

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 772809.crdownload:SmartScreen msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 772809.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3024	msedge.exe
3024	msedge.exe
5068	msedge.exe
5068	msedge.exe
5056	identity_helper.exe
5056	identity_helper.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

5068 msedge.exe
5068 msedge.exe
5068 msedge.exe
5068 msedge.exe
5068 msedge.exe
5068 msedge.exe
5068 msedge.exe
5068 msedge.exe
5068 msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0d6e09e3a2340a6e80a53ca8181276bac5424405ff5b07e4707a32af997cc7f4.exemsedge.exe

description	pid	process	target process
PID 2108 wrote to memory of 5068	2108	0d6e09e3a2340a6e80a53ca8181276bac5424405ff5b07e4707a32af997cc7f4.exe	msedge.exe
PID 2108 wrote to memory of 5068	2108	0d6e09e3a2340a6e80a53ca8181276bac5424405ff5b07e4707a32af997cc7f4.exe	msedge.exe
PID 5068 wrote to memory of 4020	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 4020	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2304	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 3024	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 3024	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 4908	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 4908	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 4908	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 4908	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 4908	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 4908	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 4908	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 4908	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 4908	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 4908	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 4908	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 4908	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 4908	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 4908	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 4908	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 4908	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 4908	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 4908	5068	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\0d6e09e3a2340a6e80a53ca8181276bac5424405ff5b07e4707a32af997cc7f4.exe
"C:\Users\Admin\AppData\Local\Temp\0d6e09e3a2340a6e80a53ca8181276bac5424405ff5b07e4707a32af997cc7f4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=7.0.10&gui=true
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb290f46f8,0x7ffb290f4708,0x7ffb290f4718
    3⤵
    PID:4020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,9603139923861195576,7101434850072365395,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,9603139923861195576,7101434850072365395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,9603139923861195576,7101434850072365395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
    3⤵
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9603139923861195576,7101434850072365395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9603139923861195576,7101434850072365395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9603139923861195576,7101434850072365395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
    3⤵
    PID:536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,9603139923861195576,7101434850072365395,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5240 /prefetch:8
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9603139923861195576,7101434850072365395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,9603139923861195576,7101434850072365395,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3944 /prefetch:8
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9603139923861195576,7101434850072365395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
    3⤵
    PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,9603139923861195576,7101434850072365395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6184 /prefetch:8
    3⤵
    PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,9603139923861195576,7101434850072365395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6184 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9603139923861195576,7101434850072365395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9603139923861195576,7101434850072365395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9603139923861195576,7101434850072365395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
    3⤵
    PID:5256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9603139923861195576,7101434850072365395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
    3⤵
    PID:5264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,9603139923861195576,7101434850072365395,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4884 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\35e695f0-f25a-4722-a06d-d14a7bbd7c18.tmp

Filesize
705B

MD5
c7f0eb805594b01d61fa206a00edc2b7

SHA1
307f6389858f9b3f1983e2ce1fcb6f06648d6348

SHA256
63eed89ef5ab8fd93fd9f864a897db8dc7ab7d4d1365fc299209cf7cb03dcc09

SHA512
2621d731e26635dfff0bdecbebbb8238f42a5945244ac5a6a054d71217556c6f3ce2d960e8c497f74ea14c0b92796b8ab12914a449d261d8bfee4d5519c24f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
5f88454d88f078c6a9e52089a0cf6bf2

SHA1
df5d14a22a4a30c8aed68d800449594064ff5b85

SHA256
b514c7e66556eabd39d70887fa3b9977b81cac6153eb5f263cc56093fa6c1ffa

SHA512
3e6a63bd5c535da12cbb42dc6ca5fee6c6a8c3f333e3450d625cf5cf7bd096ca0430c94ad4ec8013ae19e7e7bdc9d72fdd753e814703c2cf17e6df73cdd03f9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
902B

MD5
956dc6d60dd8b352b99b3aa5d79a4b4f

SHA1
10a9220f97eee12679fde36c77fa4b22f7be8f05

SHA256
640c4046b23d3a6edaffa732339922a7048b944d554cfc678069d6ccc6d0a6b7

SHA512
7f602f65c63200c8aca026131832a9718b53f8e0d44336e06a8cf74e2ec9df4db213d8cb1b3e9d542ed9c33d9b17801b084c0ac1c531df27d74282220c02eb9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1002B

MD5
02d77d5f507012ecad73da0599ebe9e7

SHA1
1702430199744f5249cf7d8298eadf1c5e270e86

SHA256
559cbb5555b8b458ef1ae9c46188560bb2271f523f3751083f16e3869104c6ea

SHA512
b43bd0a63c9c4bfd373b16ff33c24ac4e3171f91ff618e0b018fa125ca50fbde371f22785220896ce0c4c176b423708bb1082227e91da1cb2f88117625722e51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9f5b9d39b83284c58809eebf884e0606

SHA1
a9c84897b7f67a87a80901f85fc94ef462d23978

SHA256
2491c64c5fe41bc9800b836ce37880525aa716b62ceacc3eae833812c7ea5108

SHA512
74bfe780372bc37758bbf556c3797e3a3203f1ce70149f4c9988722683d85cd11382648adceefb6361f4c7ca242a25291f61582716a9aeb33b83bb0f2ebf4408

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c6950e7f3c28da7e4f50557b4d67e97a

SHA1
770449da4c5dafba9257f01285e58ce5dea1becd

SHA256
e466f3b384ef4e0396361185008a4418b3a0934488952b4b34feb2aebb5aa88c

SHA512
dc083778c755a215ad84fe18843a19ca852c80f9173f9f782e3b2addc0240ead5b3715e8765f3062f30c5c1d24ef791a8eeefc06df52251ce9384d1371842b9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
72aaffa19a051aaece242b681e8e1a71

SHA1
e0ff800a5b02c192e2380a77b43c6cfc78c13fdd

SHA256
48c9aa011352785cd170448db85ed0a5c5d780838a8e1b1fadf590c70a3da4a2

SHA512
a9a1b6defc08f46f4973724509cf18ffc5282b868edd5f4f349f307d01f568dc3e906da797f5489cf622c84191a452ec101e87b7a903e2a3338e3a842de105e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe591c39.TMP

Filesize
539B

MD5
dcfc9325288474727a7d8922c65a8e44

SHA1
15a57aaa0316cb94c96086fd34342493c619a685

SHA256
f91b1294b15346bcdb1270f3aef977406f0d5da20290a0a8b6812d93de8646d2

SHA512
2f63cb70a2171bc8ab2556ebfa97bcb9b8b174b1fd2717e9514183ac6ff9b65887468ffc179ca652e981635b0aba35e82af9decc3f40404d62cba6f7b8aaf034

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0b7a97f4c626470147916b70490b0320

SHA1
f2238ddfb862597b00130a97cc02fa098f783b88

SHA256
a79a3342282735f92baefdce1c6ce1856667c5d0a7196a43b04c0941811bef02

SHA512
a67eb2f079fb352ceee28bd928f788b936a0eb607d4fa1a24ef3b5016a1fafbfa63acfe52659e168bca92b9e8109e09a36ca488a773202b310addab57b744048

Download Submit
\??\pipe\LOCAL\crashpad_5068_DSOKKFBMSBOEDEWN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit