e4a2ef2b9baf7f702b753ed3e2e69fc834b1614e826787f5742b2965f99f00ea

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4a2ef2b9baf7f702b753ed3e2e69fc834b1614e826787f5742b2965f99f00ea.exe
Size

234KB
MD5

475e172dbf465ce13ac075e142807a3b
SHA1

6a266784518c16ee7e3170326497de9a93f6fe94
SHA256

e4a2ef2b9baf7f702b753ed3e2e69fc834b1614e826787f5742b2965f99f00ea
SHA512

941a8dfe6491e10caacf1ece399aaea6573838851401a8cf6c4f226160dbd39b9b171eb7297e71da444bb60935d983cfe35922bdc885ea8fa0b8e9bb331c5860
SSDEEP

3072:D3gRVplR1ynXixbHQbNgAIHoc5lHOMTkt:D3gRVplR1ynSxbHQbyoLMw

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid process

1640 msedge.exe
1640 msedge.exe
1528 msedge.exe
1528 msedge.exe
4192 identity_helper.exe
4192 identity_helper.exe
5072 msedge.exe
5072 msedge.exe
5072 msedge.exe
5072 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

1528 msedge.exe
1528 msedge.exe
1528 msedge.exe
1528 msedge.exe
1528 msedge.exe
1528 msedge.exe
1528 msedge.exe
1528 msedge.exe
1528 msedge.exe

pid	process
1640	msedge.exe
1640	msedge.exe
1528	msedge.exe
1528	msedge.exe
4192	identity_helper.exe
4192	identity_helper.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e4a2ef2b9baf7f702b753ed3e2e69fc834b1614e826787f5742b2965f99f00ea.exemsedge.exe

description	pid	process	target process
PID 3368 wrote to memory of 1528	3368	e4a2ef2b9baf7f702b753ed3e2e69fc834b1614e826787f5742b2965f99f00ea.exe	msedge.exe
PID 3368 wrote to memory of 1528	3368	e4a2ef2b9baf7f702b753ed3e2e69fc834b1614e826787f5742b2965f99f00ea.exe	msedge.exe
PID 1528 wrote to memory of 1284	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 1284	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 4600	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 1640	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 1640	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 2964	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 2964	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 2964	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 2964	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 2964	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 2964	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 2964	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 2964	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 2964	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 2964	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 2964	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 2964	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 2964	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 2964	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 2964	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 2964	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 2964	1528	msedge.exe	msedge.exe
PID 1528 wrote to memory of 2964	1528	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\e4a2ef2b9baf7f702b753ed3e2e69fc834b1614e826787f5742b2965f99f00ea.exe
"C:\Users\Admin\AppData\Local\Temp\e4a2ef2b9baf7f702b753ed3e2e69fc834b1614e826787f5742b2965f99f00ea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e4a2ef2b9baf7f702b753ed3e2e69fc834b1614e826787f5742b2965f99f00ea.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffbf83e46f8,0x7ffbf83e4708,0x7ffbf83e4718
3⤵
PID:1284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,1611848754771422191,12271363369739210652,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
3⤵
PID:4600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,1611848754771422191,12271363369739210652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,1611848754771422191,12271363369739210652,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
3⤵
PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1611848754771422191,12271363369739210652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
3⤵
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1611848754771422191,12271363369739210652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
3⤵
PID:508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1611848754771422191,12271363369739210652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
3⤵
PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1611848754771422191,12271363369739210652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
3⤵
PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1611848754771422191,12271363369739210652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
3⤵
PID:4332

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,1611848754771422191,12271363369739210652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
3⤵
PID:1668

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,1611848754771422191,12271363369739210652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1611848754771422191,12271363369739210652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
3⤵
PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1611848754771422191,12271363369739210652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
3⤵
PID:2780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1611848754771422191,12271363369739210652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
3⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1611848754771422191,12271363369739210652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
3⤵
PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,1611848754771422191,12271363369739210652,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1316 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e4a2ef2b9baf7f702b753ed3e2e69fc834b1614e826787f5742b2965f99f00ea.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf83e46f8,0x7ffbf83e4708,0x7ffbf83e4718
3⤵
PID:332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4884

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
264B

MD5
86c4b7b7b39cb03b661fa358c716d7be

SHA1
44a824f2ca5a0edbc69ce49db8d4ca210983a98a

SHA256
321cc2348a0931d50f019660c59347cb76c30cea782aab88ebfbd23c88df5ac8

SHA512
2611cb98537a369f82d7b4158fee137997472e4231a399e7c219750fce3d18766941b883ccbf1cb473ce9f4ce3343eee3f22a12822b62516e60ded94ed92acd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
9eabfc204493426825ac3501bf920da1

SHA1
29c814f03d5e64e15ef97224ae785a329b2fb124

SHA256
dada60dabbb45d3b7579969ab5f4a359c1686b782a8e7d58808de4314be25014

SHA512
3cc123cc439a124ce5e7bd5b1cb1dd33ccf788073e58db3af8b5b1afa739b391a2e510fe2c765e95a40df62e2228f32643106bf7b54e000a9a5fd7c28264f05d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
fa4302fd08433dc44b3baf842b00178d

SHA1
9450ece604ddc9d2382cdf8a0b28ddce404c43dc

SHA256
99a4fc840473a6d9bd3ca39e12169993f02928c909957dd0edd17ae205c5cfa1

SHA512
6de09db2255ab203e42c48913f9339ebd4b4dcfa37b45557f66fb01318b5513117830cb5044e1c57cf9d44c52c63bad275cfaafd1ff8f82703ac8482b43b5df5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
844e81db65adc90512d3f865f899a6c1

SHA1
e2d5b95352680c2e468e46d5e9cabacd7e06ba4a

SHA256
1a4e52b105612312032901b67e90d54bf0d7a4a5cd1919cb6b2a2c3f19b11b1b

SHA512
a06e71822301fd841b06a2471de94a736c0b9bf1c91c5e7cb49dc87f61e29bcbe2a876593197fa79d2d023c100c9cd360166f5d19e82e94e55f606e5d0bb47fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
371B

MD5
cc2fc1c1c5bd706c5b0bbc0db8dd780a

SHA1
e06ac3d3a51a850b55d7a9b81901580c9c8283ee

SHA256
36607f39166e2a278606befd8f904397fc04d613688d25cd5c775b9c9e688f36

SHA512
0875982a6fefab42691696966f9bd44cb6949c764c2ce8f7cc6d32253d1b73365d116066c65b0b72eb97af1477291ba04a526c8242fbb03c1e3b3a884d3c3964

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57af4b.TMP
Filesize
371B

MD5
c0e5d3affd0b660a68e42c711c417c7e

SHA1
c3f5de90b9c15eff4210fe1b20ac0574398cce16

SHA256
63d94819c3adf68ccc4a02cd81fd5f84e53d05fefa214fdc801ef3bc081bbc63

SHA512
2fa5968323aaa5840f0230382960798deebd98d13e3a3a5242c86a9f3d047aa28fb5ecb51efdaf9bb4dba1bf81b0612c12f7951757b85bdd1177cb007258e4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
e3f5afc5ecac9558487df4b6ede06079

SHA1
5e8d34004fad9b432d1fa2c5c36c83da5a6f9c1d

SHA256
80928ec65841ff71309abca2d89c6b74d65e592d246be7d5beac504238826ba4

SHA512
2a1356daa10901458d3b0ca1fbb5309260cfeade342ffc7d14af5b4e36a996d62e78a00092ca97f4455a63e88a7b7c274a0beb279f94ece94c9f838d7b6ce45c

Download Submit
\??\pipe\LOCAL\crashpad_1528_YEIRPXEZHTXBCRGK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit