asyncrat | hxxps://gofile[.]io/d/OqJDaG

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2024 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/OqJDaG

Score

10^/10

asyncrat whats app discovery rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Whats App

192.168.0.38:4449

Mutex

fvkarpgviexcled

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\Unconfirmed 520125.crdownload	family_asyncrat

Downloads MZ/PE file

Executes dropped EXE 12 IoCs

Processes:

Whats App.exeWhats App.exeWhats App.exeWhats App.exeWhats App.exeWhats App.exeWhats App.exeWhats App.exeWhats App.exeWhats App.exeWhats App.exeWhats App.exe

pid	process
5132	Whats App.exe
840	Whats App.exe
1980	Whats App.exe
3092	Whats App.exe
1820	Whats App.exe
5000	Whats App.exe
1936	Whats App.exe
5692	Whats App.exe
3224	Whats App.exe
5716	Whats App.exe
4224	Whats App.exe
5616	Whats App.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

NTFS ADS 2 IoCs

Processes:

msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 281726.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 211344.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeidentity_helper.exemsedge.exeWhats App.exe

pid	process
4352	msedge.exe
4352	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
3920	identity_helper.exe
3920	identity_helper.exe
5456	msedge.exe
5456	msedge.exe
4492	msedge.exe
4492	msedge.exe
2552	identity_helper.exe
2552	identity_helper.exe
4808	msedge.exe
4808	msedge.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe
5132	Whats App.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

Processes:

msedge.exemsedge.exe

pid	process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

Whats App.exeWhats App.exeWhats App.exeWhats App.exeWhats App.exeWhats App.exeWhats App.exeWhats App.exeWhats App.exeWhats App.exeWhats App.exeWhats App.exe

description	pid	process
Token: SeDebugPrivilege	5132	Whats App.exe
Token: SeDebugPrivilege	840	Whats App.exe
Token: SeDebugPrivilege	1980	Whats App.exe
Token: SeDebugPrivilege	3092	Whats App.exe
Token: SeDebugPrivilege	1820	Whats App.exe
Token: SeDebugPrivilege	5000	Whats App.exe
Token: SeDebugPrivilege	1936	Whats App.exe
Token: SeDebugPrivilege	5692	Whats App.exe
Token: SeDebugPrivilege	3224	Whats App.exe
Token: SeDebugPrivilege	5716	Whats App.exe
Token: SeDebugPrivilege	4224	Whats App.exe
Token: SeDebugPrivilege	5616	Whats App.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exemsedge.exe

pid	process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

msedge.exemsedge.exe

pid	process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Whats App.exe

pid process

5132 Whats App.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2428 wrote to memory of 816	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 816	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3556	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 4352	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 4352	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2216	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2216	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2216	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2216	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2216	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2216	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2216	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2216	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2216	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2216	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2216	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2216	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2216	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2216	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2216	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2216	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2216	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2216	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2216	2428	msedge.exe	msedge.exe
PID 2428 wrote to memory of 2216	2428	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/OqJDaG
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedd6d46f8,0x7ffedd6d4708,0x7ffedd6d4718
2⤵
PID:816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2380,2890428297566189524,9771845227794989576,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2396 /prefetch:2
2⤵
PID:3556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2380,2890428297566189524,9771845227794989576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2380,2890428297566189524,9771845227794989576,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2496 /prefetch:8
2⤵
PID:2216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2380,2890428297566189524,9771845227794989576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:2784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2380,2890428297566189524,9771845227794989576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:1688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2380,2890428297566189524,9771845227794989576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
2⤵
PID:688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2380,2890428297566189524,9771845227794989576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
2⤵
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2380,2890428297566189524,9771845227794989576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
2⤵
PID:768

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2380,2890428297566189524,9771845227794989576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2380,2890428297566189524,9771845227794989576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
2⤵
PID:1892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2380,2890428297566189524,9771845227794989576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
2⤵
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2380,2890428297566189524,9771845227794989576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
2⤵
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2380,2890428297566189524,9771845227794989576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
2⤵
PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2380,2890428297566189524,9771845227794989576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
2⤵
PID:4332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2380,2890428297566189524,9771845227794989576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
2⤵
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2380,2890428297566189524,9771845227794989576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
2⤵
PID:5252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2380,2890428297566189524,9771845227794989576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
2⤵
PID:5448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2380,2890428297566189524,9771845227794989576,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5980 /prefetch:8
2⤵
PID:5548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2380,2890428297566189524,9771845227794989576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
2⤵
PID:5556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2380,2890428297566189524,9771845227794989576,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6188 /prefetch:8
2⤵
PID:5696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4156

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffedd6d46f8,0x7ffedd6d4708,0x7ffedd6d4718
2⤵
PID:5784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
2⤵
PID:6040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
2⤵
PID:5496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
2⤵
PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
2⤵
PID:1192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
2⤵
PID:1052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
2⤵
PID:2588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3412 /prefetch:8
2⤵
PID:1280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
2⤵
PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
2⤵
PID:3328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
2⤵
PID:3564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:1
2⤵
PID:5704

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
2⤵
PID:348

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
2⤵
PID:772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3416 /prefetch:8
2⤵
PID:6064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
2⤵
PID:5460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
2⤵
PID:5212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6060 /prefetch:8
2⤵
PID:2892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4808

C:\Users\Admin\Downloads\Whats App.exe
"C:\Users\Admin\Downloads\Whats App.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5132

C:\Users\Admin\Downloads\Whats App.exe
"C:\Users\Admin\Downloads\Whats App.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:840

C:\Users\Admin\Downloads\Whats App.exe
"C:\Users\Admin\Downloads\Whats App.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Users\Admin\Downloads\Whats App.exe
"C:\Users\Admin\Downloads\Whats App.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3092

C:\Users\Admin\Downloads\Whats App.exe
"C:\Users\Admin\Downloads\Whats App.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1820

C:\Users\Admin\Downloads\Whats App.exe
"C:\Users\Admin\Downloads\Whats App.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Users\Admin\Downloads\Whats App.exe
"C:\Users\Admin\Downloads\Whats App.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1936

C:\Users\Admin\Downloads\Whats App.exe
"C:\Users\Admin\Downloads\Whats App.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5692

C:\Users\Admin\Downloads\Whats App.exe
"C:\Users\Admin\Downloads\Whats App.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3224

C:\Users\Admin\Downloads\Whats App.exe
"C:\Users\Admin\Downloads\Whats App.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5716

C:\Users\Admin\Downloads\Whats App.exe
"C:\Users\Admin\Downloads\Whats App.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
2⤵
PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:1
2⤵
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
2⤵
PID:316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1359458004487447756,15789271748238184332,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
2⤵
PID:5512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5896

C:\Users\Admin\Downloads\Whats App.exe
"C:\Users\Admin\Downloads\Whats App.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1122b67558137d5328476e3a5692c171

SHA1
720f1a2e9129806b564642bff031ca3b356758e7

SHA256
e81dd8c478ec52fa32184aa36d9a33bd52530cfb901a98b022c6b51f92bd0e9b

SHA512
30b8859cff7b9074179f94b248d724b1c64b33c1646cfe26f703bffa63d49c04db9eda4e7423fd329322dd84ff639a32c00b4adcd2f0783bbe56507a722d826b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b67c851e8bdb6dca82bfda906b1fdb67

SHA1
202d119bb928d002924d19aaba6ab84074a0f8b9

SHA256
3fe4bd4584b79dec76e9788acd6ceb905ee2b7ea9f3ab20539fd667c212434a6

SHA512
56318492eb1342276229b6b30b5b02118056ff04c27b931a4cdfdcd01ac002844e27a2685198c98f3f459a96f5b4469dd667d46e927ffd6c56ac2adf87d478d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
62dd4aee22668fc2289fe411a46bc0fb

SHA1
2796e86a70608565bfb7a892e48789a782189959

SHA256
d00090ebf4e9438f7f7f443140ec2d1ab042c1e211a4696aafb557cab3b09822

SHA512
304616096bd4f640e063d820d272f1819920cc6ed7095a804b155aa00f5de1f3d2fa5838795bfa824faaf0e1c775da6eee3fc74d8d0deb301eae33cc3d7ff839

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
912db8950d2db20042b88aff3d010846

SHA1
114564123363726bdb844001b7a766fec73bd901

SHA256
6d9172d8c7fd84e03632c882c5910de8bec06816eb7911f6739c2799b1d47e27

SHA512
32511940f33ee48461972fadf84364e221267f722ab1951ec3f294c842bcb6a8af2e81365dca9f8b8e26cb45542c57ed702fbb8f65007f3dc57f9356ac9d0b8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
e44934357aa19af63949d6d1c0ba1902

SHA1
27babc55d50a6d18e54d0afd1682f25e83c41fc8

SHA256
32bf8ea621f554675700eb5f061a75380a169b8d85f1a9d5beb1f6952f6e230e

SHA512
cd33a5c86511c20f2cc47e7c17f8e8e1ef1620981e640c7d1a4c58b889c8965e0426eae8583101e66c82a3fe484e1ddf35a0d5bee43c8b61931f3d0c5d9938ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
e832b9d1b80b639eea94fc82339e8b4a

SHA1
f9a428e99aeac9565d67263c76f413e1925352f7

SHA256
db62f5385a416af03bfe759ed98b043b55d98647086af89a653d9aeb93bd9c09

SHA512
1c3b480cb75420d2488fa81d264535315f911c2c9b3033f13e1aebb31ceb9b176163d70eec503368e3ff0c7dae904be107d21f892923fc1582a0fa9dfbed4f0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
16KB

MD5
5bb848123396170c4b5ccb9f1148a2a6

SHA1
0178442b22482efc1d7018284b4b18ddfff9f948

SHA256
08ccf9d267093d4e59a5a5633e2019dfe70e001088143fedbf1f02c74849db60

SHA512
e2d78eb5f2950dd2214b27abc2600ae97dfb3a3133d5cf6ffb49a26493fc77047a37a988248113c19af70a77a1727dcd053e3a1572029cc418df1db560831852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
27KB

MD5
ba77edb25c67040b1961099f0dfaaaf3

SHA1
84d9ab804b43e8dba35e7329bd53f04216bf4017

SHA256
75afaf1bb05f94df47802c73de396234f07d508d33fc33afbb0ddae235a29706

SHA512
02b4b9ba243b8f89947e7f13b0619142d78ec337f9ffe5958ae7a1cca4a3ddbe837d5519a7c8f85aa2d0235b5832ffa9bdf33fd17dcd47feabb0ab272de6fb2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
36KB

MD5
6e0dfe11e95944da94e70a99c169c81e

SHA1
f8cd534a059869e65a5e800ed4ff693539c7bd65

SHA256
72863be7491063b6198044605fae19e03c2bf5ca0f3282dcba49e0adff86b900

SHA512
f51ddb326f3fd0b898f29b0759b0f40d1490af0e374b50a323523ddbbb8336c08e832992274a45610bc09361f2883f8f95c67c29d5a9bc7b4a77d18e100913d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
39KB

MD5
2b0137600fdc5875830b51a9ad6e8256

SHA1
20c6bd524096c9e8672a6c570cb1273ac6a7e18e

SHA256
81e8d0bbbe902acbc02b695d1e68d327431a5f34f1beb99585d6a277acb78546

SHA512
643b5d6ef6083e4fd71928b8f4132657b55a39d3f386058dd3538634ff2afc69932636ef3fd825446c30af6fc4a3006c9ef1a15c2f1a3451df146325a1e69c9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
80KB

MD5
c07e058ba0a0c6a179a791870baff7d8

SHA1
ed7f77508ae64ae30979a22be039881391eb5e5a

SHA256
8552f049ba68d96f341f68e95e2d28ddd50a68fab0dda76d361ad3a52460d6ee

SHA512
ea3e40878fec6f595e17c5d37e9094bb0cbaca60e00caf0d843ef3429cd59cc69f5f5e852020f5b599151fd2f7cd6468c18bfed94737ed7634a2cdd2f641f492

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
53KB

MD5
cc3938d998c6ca5fb843c3a9cd523ba8

SHA1
c2cacedd442b928683893dfb9a7e1a4aed5c8923

SHA256
01b96ed354e216ae07d66eb1d53c4b501538d66ebd8d87d628be3996991700c9

SHA512
969717d4e6786e43ccb3b4ca85a03847fbd7b3e79fc59d0701c59b6ce5a7d1187a556b8c20f83733870db46f5e472a26065f1d39d6c1c53d30e7a08abf55fcc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
118KB

MD5
7f477633ddd12f84284654f2a2e89b8a

SHA1
17dad0776899ad1beadabd061c34e2a22b2cde74

SHA256
966620f9e3bec428663687f9e8d67a6b8e35d79adebf6fb204e9b139eada7599

SHA512
b46baa2a3ea38512f8b539774c751004cc866d085a9739f4c25f2ade9d97c10d6f4b20cf87dcbb6a003e0df0ca2df200f9036a4c76a013f24c57d365981f6e00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
3dc2567fc65376eceaa144d045cacb5c

SHA1
1ad5eb0e4860698a09e1e3c6380a2fa25f2e87b9

SHA256
8b63780a272c02d4758b1980bedd5eab9395e590ec0fd1b2397041c51411cda5

SHA512
adba8e57e92add8b6ac22a2f9c38606c564f82da71a950cc0ae822cb29d2ab564739e18757e7d7022e3503d30d7731c60057de7a127418a749bda924937907c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
ed8c5c9c717259f22d5370f0b235daf5

SHA1
b223dda318c35ce03822fbe93a32d52c8279dd72

SHA256
b8d4067364a50982d286f6352781ac8a6aeb7a92f7360288ca7203daba1e139a

SHA512
3ef1342b5e249b7f0832b21ffe5cae8d4b2ce254da0d56f8fce3001e29c76e92086253cac6189c57d73c439671de8ea973a22ece077e6e9b0b1e472300e33e54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Collections\collectionsSQLite

Filesize
64KB

MD5
2b65c5d1ab0aa3f3f57c635932c12a5d

SHA1
b532c837537438e591d5d6adbf96a5dfe5c40eba

SHA256
c111777e9b9a42cf62b06900b847283238af63d15033c40577cb10aaa58c084a

SHA512
7d75089fb928c23c0166a74bb2baa3c1245bb23012d30ec2cf1fe71f8412700d354d4b9b8070309b23a5b003e37727ecd00f9ffaa018ffa5bb67ad1bed58e175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
322B

MD5
0ccc17e912659875e4ce7edaf2d97eca

SHA1
53ea189e0fa9e2fbf60ee7ab35bca50237c4835f

SHA256
6f7e025e389be55bf9d4bce6abd0b89d67f6c3a948f2d2e514a13d7d9a245902

SHA512
05403afa7abd303662eeb062cf292051d390720da6e427dd697c851efac0df0cc977837e1a539e059b6709ac1e3afab5c9d4f12030359c45baf559c42fbcbfad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
e39d3646b53a90983e35abe7373b78d8

SHA1
e7176a6e38d19bc6ffc937570227a66c1225c97f

SHA256
a0190bf557bc983cfdb1364d0bdab6e2908272769b10186c2dfbccb87ed72157

SHA512
a23aa57dcc465968506660af7fcb9a6a976f70837564ed4989d42654f6fa1e43b5079522333ef40d1357f7006b803c52a92665ca297e36c4a07390d3262d1762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
ef78bcad14e142cf06c82cb269dfb562

SHA1
0b8ac2d2ce01881e7cd395eaa854c72c1d18da38

SHA256
86ee3b6495c198d18a245cd8a99a0b61191b2a89e79c7f7edc55e2b443a7afec

SHA512
b9c42e36571e7553f2875498b10730fec1318254ac82764d8fec5ca186a75f6b77265d662a3a72177d9c2fa6722df657746e453aed311e387d9963144c2061b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
c8510e3cff525a52ff575c2530b9546c

SHA1
2d501a1a4fa09d55b2a2d04d8904a86a37743788

SHA256
fc331e28d7d532ab347dbd1e119d2da9cccd584962c207256fe0badcbb781f2a

SHA512
bebcd5b48170b2057074d3fd863f6d8628434a6e1f0ff775d19e625cb949badee036c4b1caf474c32e6f84d7e57e708021a7ab873c72ab93c1b938635e455fb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
712B

MD5
90a5a12eab912bf834cffed00037f3c0

SHA1
d3661481bb06006f0ee2418c3bf680f756184f6b

SHA256
cf12ba686f6cfed4da17a1586cbc1c3dce9a4ba01199b0ee6bede6b9fe5cd742

SHA512
3f48bb3338d77beee497917113f6a794d9cc741d4e55313a0315f38a05172d451d49d6eb35a1623dec3cbcd5469491fc265a92ff24a85edee72a6854d763598d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
462B

MD5
545bbb8b15aa2a0b03d8f73a2a1fe9c0

SHA1
99e65e8ea75dc0395df64554cd1b7b01b6b3937a

SHA256
d08ffe5b9434ffd437feb82ecd8ef848e62d45bbb0567c8df8f12d24498bd56d

SHA512
a1e31a42dae111c8783bac55128ce88d99862c6c7fdfca409df6c462ef401f0ca9dcc086709525a9e4af78e10456caa89b7b22a19a6bd7c1b592f4b990ce4535

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
10807c40a3cdf19f25511d3b9ff68899

SHA1
01c03095f9e6a6f7162e008bd5f31dc510cfd29d

SHA256
e371786f5820a281ee2b26990dcef5814367a04d957fb5f1c07e333862c4568f

SHA512
daae1631fb7a35b27964ef3237b90a6d56c124b3acd1324f89c33323587679831f300b596f94b4bf2b99c0e5d2748fafd01a226e77e5de782aefdd8ff387dbd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
391B

MD5
849513df600e047b054814bd507b6255

SHA1
154c4c9bebcc81afe49b233f8e54196c5b1879f5

SHA256
e534078d912404d05bd2e44c1f2106692b73a66b8acb6382209d105f8d3deb51

SHA512
9c38b6657ee44e49447e1b63a8e6abf307baa6f9c70f8c993fd99619a46240da6df8408a86394e106f2fae155ad327b08e6e2457faf57dca991000909d98b078

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
25b10790245d5e0db284b6b1c1b88b76

SHA1
d8aedef9b9390844d3eefb5f80a26e75d1ed0970

SHA256
2d9d3b6da4e28ee636acb22f5d7cd8e19115506770ec8b555d6993c5aca9c8e4

SHA512
57d360e403bbb59e3db1455b5ff84bf38d666a324d11ee2a9aec05973d344f42ddd938a0b455905646dc94b3f12e61f868266aebf8229c7ab936f42bdb778628

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4da13bbcfa26f4a6e344a5e34d4cf906

SHA1
4bc5a3aab8c5d28efdf2d0980628d559645cca7d

SHA256
7e28de5cd4704a6259d2d3f3ad1a467b0f5348d9b0e8070192236ca98c1a6fe2

SHA512
53c51c686f14f07f3f197aacdb6b2c598703d678c6c4c6f9604d8e801b325cf16b0896fa1a3f9e35b88c3be3249141c37b30ce0af3a3566a31f6e11e8ef64dd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0fd277d84ca0809728ccbd2fa164c98d

SHA1
1641a1036080d14fc6d8b9635e7c5d0b13049086

SHA256
f8e4c0454003f3717b955bfe2501de1577a09d858d7fa810638f072100357705

SHA512
7a273bd58883a920b33b2dd97bdd0f97e51b75bff37994ebe79a490c921b354ac16f5796200fb37e1d261e5e0c60c291c70f48faac4d9881803580bba389aa9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6405df0bf6a6ccbd4cb367d370e9aefe

SHA1
51f3586c9ec272b0f7a592ea10a39c2e74d92516

SHA256
2a1d9db1fc16f0cf6a3bb39818e2c26e59d101cae4efadfd2226f3100a56ec4e

SHA512
bcca7ad7c4904f258bb1c314ec1be04b9ee8c865f38a290e193ff3bd5768488121edd5c052f6262ffbd465b00405479e983a506893a1fb8eee244df36aa111ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1aaf73869f24ef4ab5925a0d238a2bb3

SHA1
59743cf0b12cc3b88aab9a1d6cd2f429a486f528

SHA256
edff395c35251e14ef5a1889f7a9822eaf4602541a4e5a704c0ad89a10e1b988

SHA512
f844f4f5bb91e713b79cabe366a72c2ba5eb60940f60cfb47a02bf7962639c9a6344b969c72ac70f40e6a61e32461306e0a652d767f669ceda00846144a70ac2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
345B

MD5
e3d1821ba9e5a947a175d00ea7259559

SHA1
5395b669e06dd099f8dc562cbe60468360b6d2f5

SHA256
4329327805c524fba1545ea7b75c5415c64a8c96f98f2ae087c772bc9a1968ed

SHA512
26b9c81a6ef12311bd100e99e5684fe5254ccfc886c559c1e18cf493e14c0547e3023d94e60d9ee835e0a0bf8bb9ec6be84fb469d9654dddd524fe416aa9c0b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
9e5576874fefc212a2048eebb05c145a

SHA1
13ddc48a8d3d55535673f5362dad4f20d8fbbc46

SHA256
986ec3ba5717011c2d4d3390d04f1e7a2710fd1547e54781e44d38a6bac55847

SHA512
13f3e4ce054aa1dd873fda975dddd8e2c658f0591d905eda056c15597c94188242ee0b0e8b18dbb24e30566d4909c6350ca93b1bb5dc7e3299fbaad66cd75422

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13373826454060510

Filesize
14KB

MD5
c720b56f534a866864497d7be75e6e43

SHA1
04b6b3d153719a2396471016a243323f93c6cdf8

SHA256
5573ae94e28abf3730d74d5a5125f438cf3d1d6e237cb926f6b6f70c03765a55

SHA512
09220b089425ad004622ebf69edb0832b5b4ce06f20000c46dc993e18dfda3519ab2c36db0b2f64bb08eda0f5d2ccbc91495c6f189ff06f4867f37396644522f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13373826454271510

Filesize
3KB

MD5
491d7fdc605687dea2d049c16369ef10

SHA1
86c932ca97348cbd329ba2c1d2e7824afeaecde5

SHA256
458eeffab5a2108fd732c28bfac514809eb81e699953e89027b81537ef8c8345

SHA512
626fb6ff941f0897fbedc1ae8cdde624332570dbd72375ae8da9b4e5d060ac9ff9384e8546e9d290d33688ed59c623b58ec8eff70b55a95340f68752c6e79b13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
304B

MD5
42d412d0e56630c725c8a98912fbc0ab

SHA1
22e659620095f2cdfe92f3db0ffbd045c393cd3a

SHA256
9f65f2a8e8bf41191c2ae5959a4671b7544be9bb6d4fc0336455f7ab96b85dc1

SHA512
c9005733f759a3e7c04cff8240a46f60a34fe6f7f7acf3b5a815b9e1ad2c7409dd8e32b61bf132904f70acbee07b98b0ef2483cc1a4420dc8d6758d84878e64e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
bc026008d4266ec6f95763b5f8c52fee

SHA1
2eae1f5f4fb238a89028de666e52206822064f6c

SHA256
d933287dbdf05215ce71819392dc4a6f616b2a8c4f2858356083171ce9f0855d

SHA512
bf4ea07d949fbaa54b93c2bc56fbf1442dcd927f0a10b0e381965c2a746e93601a393760f0d44210349742f3dcadc63020253dbdd1741070d9ef1ce43039f18d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
dc2a8663f0ffe63ec3c4aceb3b626c60

SHA1
df52ce68a7af589bf3b3c753b532a81ee4a301cf

SHA256
350370d500d962fafbd994cde4fd7762531fa375b3faca1a05c8a0173d293b32

SHA512
f9ad5bda5b7f1fadf5284f2125dfddb1e19f91ce882c0de3730c3ce0ef665c663697e67ffa42d1f8785108d5d9ad8878f4af41941c94ddc4a2cf0bdbc2aa5c8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
387e4a26f5d3fa47d31a141b28e74fd9

SHA1
b6900b52377958378f3169a2981afdcd4846d142

SHA256
9ec8be3158347b46619fdbe0e6121819f321559bc300fb1816289aad6f444034

SHA512
58202f621a23a47c27cc27ababe3c7a8c129f29886175f0c2955559358822ccfbafc563f09912307af9d6636ac738538ca8231a48c7580286db33c4ad7558d07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
cfbddb16e477d5baeca32bb78b5a30de

SHA1
ab2ce44e7e23d3fd0be18191b6803d40fb953d3f

SHA256
9d7027e99807692c92eca6ba941ed9aa97fa99a6b9d909a82effa8878a64585d

SHA512
04d4ec5c6ccaa241af1b254dec86cb3827e7b0826f588dbb94fcf8c10df82f48c0c6b3cd2a5f70cb8a9dcc683e9e7367f1f6b361a3c2367f399018378e737d0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5813d1.TMP

Filesize
370B

MD5
fc0603f0b7c212d8f5779e4263fba105

SHA1
fa4c520840c72a27e060ffa5bcd55ba59c4cb341

SHA256
415073e4d24dcc9472167da30ad0b2b9758f0052c1df74fe56a9171647cc3290

SHA512
5ed8910c90b0ad7587fe0239e65f1c569a3607a4c33c6680556bcca5f4ab9bec0cd07e269f6482ab19266ee435691cb05ebd92cdbab276cb12e3eea8c1de8093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
4fd312a81d78d4ce74a2382030d52229

SHA1
a0691ce1891b1ea100e9633a5230e6f75e155acb

SHA256
a68570379897921ceb69f0ceec325ede710f063ba8fc50eceaab9cfc8c08df4b

SHA512
c6032095cbfff25fd6f5a1fc656a7ea21a73f357df836fa6ccf1b96226d0b1773f2d40933e13272d5bba281f7e3f2bece0c065a149138743fc3f02fc08191fa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
fa7dbdebdd24a5ae05c47ca2a059ad63

SHA1
cc9bd79ce8e8755b58032bb85838bfa8328b913e

SHA256
35e2280e96552fc50807dd38ccdeef0f3698eb342093cdd5ef87c71dfd35e57d

SHA512
f0555b9b5e750a3e4ed5259886b4e3dbfd4b5e7e10b17b162729add7d2ee5d42936e319316273b8c64bfd32de1e354389520f742bbc8027d2f8bb6085e7c0686

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
1KB

MD5
abbee19fdd146f5c881eef49ac46cf72

SHA1
d1643403daf68c286847d56349e589d6bc10f53a

SHA256
f58b773150112f396a7dfc92ef00fbee65b6a804930692f3c41dbfcc3737a18c

SHA512
94d3be4aaf08b651bc6cf3e2808e6fdc2bd6809c8a36bb02e62edc2d5469b61b5acdda9f4ec1ae5d4990c5df9e781d8ee3dc9d30f2bc69d960eeb4d153a30b07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
322B

MD5
25801619c8aae8401aa02c70c2f195d2

SHA1
bdc77317ff43207b653ea577c59eb23fc9f88a44

SHA256
2291c6e473578ff1402257f2f5e7e905bc40542e5116203498ef5be9e8a14915

SHA512
486f8ba30ae6ece8b0444906209c5c3f9f93426c80f742ae0b4cf65bb90e6869575f7f7c4eacbeb3498e18cfe55b650021cf70a7e43480145cd2dc30aab37d44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
594B

MD5
1c0f7e0be08468e98e2f5f11f8435038

SHA1
a127eecfe583629cf42ee7e560dba47402bb2ff8

SHA256
1a95b79f28d6c6ff9053a8a8ea612208c6b3303e680ddb0704567a42f4f19fa9

SHA512
45c02ee90ac2d8fcfa3bdabd1d2bb0f91c266c5ea679cdec43cc113db4f7859654332ebc3737e61d1e8289b9481ee4ebb15d95ab8f147fb25db502eb61c23a75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
c5231d961a8a64539dc4be3fa37cf717

SHA1
2ac4607a549de73c58c9feafd261aca92ea72b01

SHA256
1086955032fffc1296578e6dd4f2700508b994deb01ae7f46f1206e3d5eeb7db

SHA512
300cb37aa1bcf2f4666f56bd5012d37d2fd0ca05af498ba76971f6a12ed2dd59b0da76000df315cd32b55a0d6fa98796afdb4c99d7fa8d4d0bb65f09b3e5237d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
f15459aeb2a77718c9b93e87735b198e

SHA1
9030ef96b178d0f9dc603068ed78598facf324b0

SHA256
b14301324e295612d47bde2c6a09ae0bea959c4b86d7485dc6d4beaf4f54f922

SHA512
eb850a309e34844f744e64622e05f08e9b55c6f9523af6e70c9082c7bd9a59e29c48adbbd109edbd847993480e45b871fcf3e926e2f21412c495517ae1d959e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
40c66fe545fbc6fd25d462aeb5845be6

SHA1
8133ffcb42efaf2aff571bd3f9b3333152604ba8

SHA256
02e329d755dd3731aff9e6468fd061c5cdeaafa5ae7087c1f99fbd50a5fc77af

SHA512
b88cedf563ff707c50e0cd6d285969c23ec0e6c3588df98049bd09ec0af464cae0782a7c334d6e632ff7e7a01eef7d48bb00cd280773e72f7e64ee20e006e0af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
398678023adcc1b03b4b3f7c91196ea3

SHA1
5af2d0028ed85d95b88dd55d4df96e0a98d3e32d

SHA256
789e5e7310626fe4bf74884294f406eb286e4e1254cd052aa050271a89d1d6e0

SHA512
ad4806ff6704c4711aa67f9377e265b9a91e7bb4c695cb8f676304302cf2ca012d733264fe8c541007a1f4506502b3970629e6002124d70a328fe37b8fb34a49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7c26e8784ef296db892e94767e42119d

SHA1
cf3e6a7d00016cdf5a88963eb9388bbc8e0148a5

SHA256
a88ed842d482a974ec40458cbb14d72f615c43bcedd82dd0ce4a9c55839e6e42

SHA512
4d52fc0f20f3ce7f0eaeb3f567ac3cf3e9cafed945bffa0c55aabe407869171e829f37102bc65dbf22fb2790d0e91dbc234998f8052a3a7bfd39e0545fc81137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5395c92fc73d4543b702bd48a4d8dece

SHA1
bbd8514600a89e2ca7ac005919d179c14e678dd9

SHA256
ff66468d64a0ab53b5f9e2838bea8a61a7db4151a8259e1aaf67ae822126e65e

SHA512
91ec4d23ac6e070b1ffe116519176fb84c2a50ba0996d5b495d00fde1e37aa86649621c01bbb6061411d42addcb082278f68029db6f1994b3fddce1e4c3629b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6092a417f947ef91906ca44096a0f25e

SHA1
e18fa273d070d153cb585bc77a3fcde9db4cf534

SHA256
daec51ed833b677a3f72b785b33763fe1211382ec83a288b8d9232d3550fbb00

SHA512
4066d719921c2b94f036840ab865482700421a37d01f124086f806871ad008a72fc1e258d957f738235e6c4a7323dfca00e8bd459c64e8b30c70cbaa61a2d86b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a59f7564dc01b853201318bee09e8bb6

SHA1
53e173dd73e02f63c244f0d07e0fd154f220eb1b

SHA256
161e9538a08ecaa47b904c03dad744ecfe7bc3020f30eed43e7ce1f200c40614

SHA512
bfcf0a25971b40dc1d104b5a6d7565b34f542bf98c248025fd97ba9e3cf2dc9f45e0a9e3a53548f3638cf1366ca5201382660b73bd506083549c2d66613777d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
431b9947cd7280ed13b8af0d31ad16f7

SHA1
3a36aea80bee7db0178a4a77101b8d1ff720e1c1

SHA256
e5a0b9209dd19cbfcbe29d894764ca85de022f28a17a40d924f11db7463cb6cc

SHA512
65796c80327e44a977392cb295aca4c6b2130bbfc2b0ee4d34f54a67bc9d7d18f1d02df86c4147f0b53c42a2e487ceb89b48a7f18f82a68349c0a54d2f671cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
b9e9a66e7b1befd7d3bc9b6e8fe630c1

SHA1
9cfb8f86dff59d23f23f2421c8ba9625e872bb89

SHA256
216966c999f21bbb9c04905a3479c908b7754d010bbc3ce837ec046f7d5a0f4d

SHA512
e5431eb6006fb6232eddc5e9861fabf6d8b1574a4667c1558d0edb6a1d3672fb13de3278668c66dc55870b9945e784d3f286a1ed6c6e05d92a308cf6de728d54

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 520125.crdownload

Filesize
89KB

MD5
a25ad4e40893d481ba7c30e9ad91bf77

SHA1
a80ad4b4569b50975092c9fe6836685740e5460d

SHA256
56757a5b9443a015b4ab47e1c10c8fb2715ea2d7d32be7c2825cda7118fbf6d1

SHA512
23ec61184e2639677aab3e5b3391341729ce208c083c0ad5d2e9b67412ef371ddd74a484b154e5e581f7b64657fa9a0e11c9e7897fe0b18bc5b1898b545f9d8f

Download Submit
\??\pipe\LOCAL\crashpad_2428_GRMNDPUALBBGDRFY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/5132-432-0x0000000000160000-0x000000000017C000-memory.dmp

Filesize
112KB

Download