hxxps://kiraverse[.]game/api/v1/auth/verifyCode?email=tlaudien%40selectmedical[.]com&code=857100

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://kiraverse.game/api/v1/auth/verifyCode?email=tlaudien%40selectmedical.com&code=857100

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid process

2636 msedge.exe
2636 msedge.exe
3440 msedge.exe
3440 msedge.exe
3492 identity_helper.exe
3492 identity_helper.exe
5144 msedge.exe
5144 msedge.exe
5144 msedge.exe
5144 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3440 msedge.exe
3440 msedge.exe
3440 msedge.exe
3440 msedge.exe
3440 msedge.exe
3440 msedge.exe
3440 msedge.exe

pid	process
2636	msedge.exe
2636	msedge.exe
3440	msedge.exe
3440	msedge.exe
3492	identity_helper.exe
3492	identity_helper.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3440 wrote to memory of 2372	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2372	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 1352	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2636	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2636	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2800	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2800	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2800	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2800	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2800	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2800	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2800	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2800	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2800	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2800	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2800	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2800	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2800	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2800	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2800	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2800	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2800	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2800	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2800	3440	msedge.exe	msedge.exe
PID 3440 wrote to memory of 2800	3440	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://kiraverse.game/api/v1/auth/verifyCode?email=tlaudien%40selectmedical.com&code=857100
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbdf746f8,0x7fffbdf74708,0x7fffbdf74718
2⤵
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,9649766394011169285,9396579816045524500,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
2⤵
PID:1352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,9649766394011169285,9396579816045524500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,9649766394011169285,9396579816045524500,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
2⤵
PID:2800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9649766394011169285,9396579816045524500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
2⤵
PID:1520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9649766394011169285,9396579816045524500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
2⤵
PID:2688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2068,9649766394011169285,9396579816045524500,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5568 /prefetch:8
2⤵
PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9649766394011169285,9396579816045524500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
2⤵
PID:3192

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,9649766394011169285,9396579816045524500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:8
2⤵
PID:4536

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,9649766394011169285,9396579816045524500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9649766394011169285,9396579816045524500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
2⤵
PID:400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9649766394011169285,9396579816045524500,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
2⤵
PID:3020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9649766394011169285,9396579816045524500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
2⤵
PID:5252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9649766394011169285,9396579816045524500,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
2⤵
PID:5260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,9649766394011169285,9396579816045524500,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5700 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1656

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x484
1⤵
PID:4668

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016
Filesize
1024KB

MD5
dfa9e384d125dedb68f549d0cd55f4ae

SHA1
45356a679fe614764c8d1b44e6c6b6e31e8ae26b

SHA256
81015cbe9cc59f2fc6762a210e54e9ba5be8763c4f2d6499233fdb71ad45544c

SHA512
2f58c3a82d10a3c64e726492ef449d2d47c236e7cc48e0eb404bccb5f38d1657fe0575bb976635cd9c29b0b81df31e520aeafe035c9af62c2618c9dd78745191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022
Filesize
1024KB

MD5
057cbfbcbad49fcb3f3b04fdb6cae925

SHA1
760b4ef5c48b5a65cd25bf97c8b5fd1005df120b

SHA256
102221405f6e45e7664cd55d8c668b26c64def1b9cb9f7185e66929b4415f724

SHA512
05edbafb8d748061836247e49eeb230d1a17e6f19fa45eb56fcf0b345f81aeb23da787c52489c3c24be252094610df850c628959fbcf9f76867e35581b9bc1f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023
Filesize
1024KB

MD5
5c97439fada30de115a57b64a62c470a

SHA1
949403a612f87e89a4cbf9b2585477eabf9d2eda

SHA256
b2cd5f5df849b4340e8b5965d40d9fb7fe18bf571054dc7c334b9d1becefca8b

SHA512
a0e019015d9c1b45ada26dc6490a11eb895b437984850ed434e277e916394ead18450cc48571f5aff9ac51a7059630b4afc5e5dd5b7f4b770acdde0a322fa449

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024
Filesize
1024KB

MD5
8a7a16c704fa3b16b42c9419f7549831

SHA1
380c5e45a46f7666d9bdc8720e116a917c226d9f

SHA256
0d754984b8a996d515d739ddd80b715ac0687067f46b201614c3a394632e20c5

SHA512
343915ad3c82a04d2dff32472aabe454386a5e7fb8dfc8cdb4f8b84cd2f2dfffe07dfb7b986f564f09472047f7d86a3e836feef05ed229d0f06a00d84b640add

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026
Filesize
1024KB

MD5
b73078b1e9ef8cd844fb9ac9bc47f4a0

SHA1
0535960a5a0027303390e45c0557e572cfcfee6d

SHA256
06fa71be67a837c7d2e36e5fde3c3618edc293fab15d74fb2dc5ef707d420081

SHA512
0b502d568294515b44de89534a5ba22ab04d084750bca36f3178be1b6bd88b08331ea6954780f4c79e0f05a6e5281a6478df0b40e5a48eb5bf2efb053bb2d126

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027
Filesize
1024KB

MD5
f5cd6c047a9205ca7b1c3de477758134

SHA1
6d993e8c36819521b47fc333bb237f6a12325428

SHA256
24ea71a27df4d43466d94463a5215a3d851d8680bf51524b235ab82b1153a3dd

SHA512
639ac5da64193b4b75ca2301720120b50ba088cc2db20a63cc09272bd22a4077d3f863b9cdbb1555ba41fb0f62f37e32f0c8a59b67cb5a787af1b8cf6079b72a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029
Filesize
1024KB

MD5
9dfd077e3c0f2013ce8be9e321d7ae69

SHA1
0b1f7c185d4bb08bdbc840b51dfc2b4cd597c4ed

SHA256
dc48e0c7070d5f73e31825395693bb71a484a7a1147f358fbb6e233cc781162c

SHA512
bc29254782360c7c5d8c8486f122fff9d6741d7862165000f12d52996b2889f4b6ec5db9dcdbdc39f81e4bdd30307c4170753c7cece8e1d72b20f2f1778e4710

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b
Filesize
1024KB

MD5
2c9601aeb9dca2256ad8b7de1d12e407

SHA1
3d8b0afd8583e4f277dd5ff062bddff57fbece1f

SHA256
30ab2577a8ebdfe9a72dee477e9ddad130139557b0d95c38723745cae7db48e0

SHA512
036e27445932a1144497929afb1534c204e2a457978caaa693766c5b59a2265d02e3f5580118bcc9f0c274974d213ea66e54cd1a508337e148ba90d2325d5513

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c
Filesize
1024KB

MD5
761fae816189453ef3abc5db3d1e8342

SHA1
508302bbd2ef87f09e5d0fd06c0fe6ce3efc38b9

SHA256
93d8544e26a1ec97bb0551ead27db5c568e6268ce696fd540cee2e1ddcf6a568

SHA512
832a628ce19ed24076e5a23594354eec7cf50907608621169a72b177e92dd0b46760093265b8385fb79cb56b1d2cb5a5190802ec5b71e719c367993f27608ca4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d
Filesize
1024KB

MD5
4a56073ec28e389151d7ed11e86ef1f3

SHA1
f5ef4fc51b19ac96d4d50b782d99d70ae2e3540d

SHA256
c946c990dc05e7667e4201b90891fc9c0b39d7263403616ca2d7b3e87f26a0ad

SHA512
36bdbcde9088fb07641384823861ec9d60689863afee2221973950f8d66347b7bd354c44fe87d528a7653b2fe2590048d3cb83f8bcafe804e460929bb44588c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e
Filesize
1024KB

MD5
c8701b1cc7e738f4c2d2e658353d7de7

SHA1
3f5ebac1913e97d4279dd8fcf54069f79e51f5fd

SHA256
a0c59813e46291e2a8bc598fecf497fda7da2714f4ed8e16ea3f49e5db02d406

SHA512
3e2c70b36b333e80d7540de6b41fa3e080732e6af75a0694dd7327ee517bcd86ae77353dcb903a0ab73d26fce06f2fa3cf8c924fb34572bc36662c7909161dec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
504B

MD5
b0c50457046d5e093777d22d9c8d507b

SHA1
aa25bdaf5a501029d60e382e1aa9681ccdf05d02

SHA256
4d9f06fd9231b754bcc0e91eae3415f4d6e0a934736c8cbdee314658dee3471b

SHA512
91b99ca950bc3abf449e8e808d724d007d97aeb9639803acd0cdb736433f9e16d803e4f47bc1a6f67a19a684928669bada043ebfda5c85b8d74311491f1647c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
892B

MD5
cfa9931471be557d931881f8bf88422c

SHA1
f6c7054ab2cfd59e4fe7823dd9a98ba358493bb7

SHA256
6a1f8713d24415155d5a3097018ce65f151deccb3436d5832ef335a5d1e5a965

SHA512
96c55f877fd92a9c9fd810092943b40d2b73f0d6fee62227bbfed7931a9a0525e038b5bb1e07e43ae10ee96f7dee0e9b1df4c13de5cc52f20bd43d723a218355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
2ac0f7e2170fd6e2a622b9903d37789a

SHA1
1b2cd33976843a99a3f9ed610a1a85f2999a41f2

SHA256
3bc5dd7ed971e1dcb8378c03052ef2c5bc489157dd08a5137ef8632ac0261e0f

SHA512
088b5c81b0bf692db5098902ba128ae65265ef0a282c179d65f10af27a613561a31933470611a61264f99439ffa8a2fb15643cc13d3888d0498de30fcd93da89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
86dae10dd207a64ff41ba4a6825eddb6

SHA1
e6c6fcf7bd69b466bc525ee99c7fb1b3104969c1

SHA256
ec788023e75bd90b7f210e35b869c5b1613edc08f315488860301ec5d10ff039

SHA512
914ce71c7578adbe32d57a4b48477f2d5929cd2e94f70c4989dd2b7e93f3d1704c88f8b9e9759789c332a0049e654b985bfe26e2fd717c86503f89ca6582a053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
1e7715a184333da31729b024600f48a4

SHA1
e2543b8d65ebdf1ecb603f68cca0b7ba0c5324ca

SHA256
86cff1ceb8f8ee1ccddc66f0f276adcbef966f86f6e627af32e4953e058adae5

SHA512
c2c650376cedcfbe33363ca199a978c1a4e14610e1e993962d2e759070795d6c883a4271f14711364b71497495d1d0a7cdc9308e555a4d4f260f347e54e64506

Download Submit
\??\pipe\LOCAL\crashpad_3440_VRKUCEMANCEVJAYX
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit