hxxp://bxbchat[.]com

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2023, 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://bxbchat.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
2660	msedge.exe
2660	msedge.exe
3676	identity_helper.exe
3676	identity_helper.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2128	2660	msedge.exe	55
PID 2660 wrote to memory of 2128	2660	msedge.exe	55
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 3176	2660	msedge.exe	88
PID 2660 wrote to memory of 4148	2660	msedge.exe	87
PID 2660 wrote to memory of 4148	2660	msedge.exe	87
PID 2660 wrote to memory of 4268	2660	msedge.exe	89
PID 2660 wrote to memory of 4268	2660	msedge.exe	89
PID 2660 wrote to memory of 4268	2660	msedge.exe	89
PID 2660 wrote to memory of 4268	2660	msedge.exe	89
PID 2660 wrote to memory of 4268	2660	msedge.exe	89
PID 2660 wrote to memory of 4268	2660	msedge.exe	89
PID 2660 wrote to memory of 4268	2660	msedge.exe	89
PID 2660 wrote to memory of 4268	2660	msedge.exe	89
PID 2660 wrote to memory of 4268	2660	msedge.exe	89
PID 2660 wrote to memory of 4268	2660	msedge.exe	89
PID 2660 wrote to memory of 4268	2660	msedge.exe	89
PID 2660 wrote to memory of 4268	2660	msedge.exe	89
PID 2660 wrote to memory of 4268	2660	msedge.exe	89
PID 2660 wrote to memory of 4268	2660	msedge.exe	89
PID 2660 wrote to memory of 4268	2660	msedge.exe	89
PID 2660 wrote to memory of 4268	2660	msedge.exe	89
PID 2660 wrote to memory of 4268	2660	msedge.exe	89
PID 2660 wrote to memory of 4268	2660	msedge.exe	89
PID 2660 wrote to memory of 4268	2660	msedge.exe	89
PID 2660 wrote to memory of 4268	2660	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bxbchat.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92dd346f8,0x7ff92dd34708,0x7ff92dd34718
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,3795203942838599201,13071207605526860271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,3795203942838599201,13071207605526860271,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,3795203942838599201,13071207605526860271,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3795203942838599201,13071207605526860271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3795203942838599201,13071207605526860271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3795203942838599201,13071207605526860271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3795203942838599201,13071207605526860271,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3795203942838599201,13071207605526860271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,3795203942838599201,13071207605526860271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,3795203942838599201,13071207605526860271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3795203942838599201,13071207605526860271,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3795203942838599201,13071207605526860271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3795203942838599201,13071207605526860271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3795203942838599201,13071207605526860271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3795203942838599201,13071207605526860271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3795203942838599201,13071207605526860271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3795203942838599201,13071207605526860271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3795203942838599201,13071207605526860271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3795203942838599201,13071207605526860271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3795203942838599201,13071207605526860271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,3795203942838599201,13071207605526860271,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3976 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5b47f935-62c9-40c4-a233-55890c2e21fa.tmp

Filesize
1KB

MD5
f8da8e310c73ad66ec5df1279daf20f7

SHA1
b4d84a137a01d25544a178b16a52c0239c51456b

SHA256
5dd6cb59b2694472b4c64ff823ab5d2fdd1c7705160be1681c61b523561bf56e

SHA512
5501d8aaf0668911168d94672f90b765ada9a0e1d0d7740af1b4b7198b60123a91538718198da6bb988528ca23e6b75ea4d6eeee56350705d26d663f7ba0ff56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
21KB

MD5
2b3724a99be5d42c6b5aea60cd527386

SHA1
6384e3f30b55ac0727bfc6bc832b0f00e2c5b046

SHA256
d43cc6180e66f43f3a5e4e5993df02fedf8cc4ca54b24b0b1a6ae14b18ecb523

SHA512
43135f14ab549c889069b518fb7c4c92752e0b68f0ddacdb45023cecd368494b91fd8b2b7579448c7fdaed5eb9b3fa768d801532caf5da9b5bf1a8684a20c39e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
186KB

MD5
740a924b01c31c08ad37fe04d22af7c5

SHA1
34feb0face110afc3a7673e36d27eee2d4edbbff

SHA256
f0e1953b71cc4abbffdd5096d99dfb274688e517c381b15c3446c28a4ac416e0

SHA512
da7061f944c69245c2f66b0e6a8b5a9bca91bda8a73f99734dcb23db56c5047de796fa7e348ff8840d9ac123436e38a4206408573215b7e5e98942ea6d66bb7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
39KB

MD5
496bf154d09ea640a63e1fe295bf6715

SHA1
ea4a01239d7c7ec0cb67b259dcf715d7f6772a96

SHA256
9bca2b3e996185d1294b4d0294838f08b25665fb4defaa98f13bec877b9c3474

SHA512
a100c47d5b7601e5a4a0a4a733d7edc902767f48300d10d92c319f2dcf54453fb5115c2a9eeae1c1cf1214de0480273c129823d3eab86d217617117ea6698f25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a9e0bb52efead778a05e54d2f80775ee

SHA1
138e33beffe5c276a0babc30a604458abe822941

SHA256
23ab8f18979a9b8ebf50dacbc7b15ed7b11272af0ac6f66ce47cea49964d9471

SHA512
b02c533c4852565543cc2fcc973be0cb0bf51954883e180da0dcb60607c93bf7539fa7e7cfd81d56cc5490acb2ab8e6e12881d2140269aab2d33221d25e3046c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4dd25a6003c00794578357b794e36e77

SHA1
63c7d228619b641f56b9560741f395663db7f534

SHA256
6c775db63c941b0906dc5f4f062f6db6adfc1a1809b2b93c800bff3a7eda294a

SHA512
b48b1d2790298cc3dc35d755b40ff77550e7794cc255005e57980e4f02370b7dbee2c3a58e5cef94068f650b0b1c3349aead3416a416b47cfae23a16a6385e4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7cf23f49440f7204889657c404a1f60e

SHA1
22c26648514bedde4812fd2629b0f265c4c513d7

SHA256
000229f00a664ceca5cee93aa8a0572bdd61be3e173500ca56b27673d25c771f

SHA512
ab04e1ef86bbe7db306bf20e6d2a35bdfa711bdaa3761234f91b8b6883ce203447afd72c74e4d3cbdbefdd5c82c1610bd5c37f096ca2867478ad4ae8a1bde623

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d058e54c6b8574d4004bc3102694537e

SHA1
db5a44206d1ba38970fc68fc519f400f0bacc0b6

SHA256
be33ef85bcdfa37eaa70ece5316fa04ccd5f37b6da1f40b3e35f2443e95d04de

SHA512
51d6d5b981df989b094123cfee689c6e498372f1a4385eeb1cecd0ac76695698e361995f7d45faa2157128a0c965824ea10a7d302035108d285ff8220c931723

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e37b9c029b05b5e8ea5546b4501cf325

SHA1
327b46bff701238cc7c76c501eaf0d6c587fb5f3

SHA256
be2f0b3dc6a7f658963f01777072a78c1f89949368502ed038cc5f88b72dfcfa

SHA512
026c4044c4a5b1153ceb633f4457a8cc3ed3003d289ccb645e014befb262aa58bb662ab945c10b8e78cd1720d8ab5af97c6e3d249ccd7e7930df1d5f7e47e8a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c57da23bdfa719e713ea3be6f3a5423a

SHA1
d724a2fdae8ca1b315cbc981d3be4c1c3aca7488

SHA256
abd62c6288de95867d7e3c57e2dba5a2f65bb06e18c63589dad81c82585d2680

SHA512
1f5bd3c8bbb2789e791d9669d63c9b6045636f883513f7626e62da20971bf60ffe162e408f272de0f975b7725c86539557bc3dc30078aa9dbc93892c161267af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b36d61bb004c480eaad1523e8e488487

SHA1
ebc39c8c4a749cb73bec7adb10d5f197c20399e0

SHA256
0f7adc5b7eb659b50697d4ca57ee67746433085bbf03ff8135135edabe3e6793

SHA512
a5f515df38c3a844ff8e03d72504b360c7bff5dd2e501d397431d8e18b9c1498bd0b4336082750b1037802b1cc675964ac1f99d8ed95e0b405dd37637ca19c29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
739624ff4fa830e412c53eb84f2bf387

SHA1
773217325eec435772881c99343fc6556c2145b6

SHA256
7c976bef68ae1567e4836cae0503d9ae81a782da0638e738527ce7f8c660bfca

SHA512
e7d583d3cd4d47a1a9d08f150363329dce57e19757308dd010cd63b66f0a77fa493cefc6302d7eeac66215a790b51b51c759b88c1ed30d7f32979aa56aa7d988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
409608025dd68c0475431eb9b82e9ecd

SHA1
8e834654c9fec28b3ba76ef5a15d4ba77e5b9bd8

SHA256
9f120a89d3855467183cd08c1847f1b1e89ec7560a188b42e65d12995c5d5151

SHA512
1519786f23ea4a7b30806f9d93d8e4470a74009eba01093710d551756fc82c42f1230fb975ddf42a7939f5d6e75b6f0b0f1af3f206575d08a09c83e1c3b29d9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
918ecd7940dcab6b9f4b8bdd4d3772b2

SHA1
7c0c6962a6cd37d91c2ebf3ad542b3876dc466e4

SHA256
3123072fba0ea8e8f960dd213659a0c96ce2b58683593b8ea84efac772b25175

SHA512
c96044501a0a6a65140bc7710a81d29dac35fc6a6fd18fbb4fa5d584e9dc79a059e51cbe063ca496d72558e459ffa6c2913f3893f0a3c0f8002bbca1d1b98ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dc0ebe0e1791239e84d7d9e487c2f992

SHA1
6a6c57a71f613f99cc69bca4b2bc4837e4440dc2

SHA256
cc00f902e0eeefdc573ff95627c24811fbc4a71d170ea2073ae9da3a9292d946

SHA512
0a36642a9bf46619e529fa60d5deae7a16d238f31f0008f366fff0257de9287b6c98a7bb4698c97ce7ad574b2416a10dd59122c299edb28873cbcdbcbd615d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584764.TMP

Filesize
371B

MD5
fe362d5ce050e9c2d9150766b665d614

SHA1
a092e9b14c1e1ba54d51fdf88ec16c1133bc4a08

SHA256
926e3fff9ea64934fdddac7986e9092b0461263bcde4621e07ea66be2c7f4924

SHA512
7b66679336fd492ee7752011f07eea9a0f2ea08c314304554b4792faabd2a96ffc3e5ec19932d980b11d5c4b099359749b13895ad3bed62f7ea112bae0ca60b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
103039946b1796c6b5d76a10e99a396c

SHA1
99841a7835795a009618fefb81c5345d54c261db

SHA256
5fe4b70f46d7fb3a769fb30c22c5f198ee547e5b7dfd27624f86f5eb70d0d30f

SHA512
1c711aec9cf567bef65e8c07e807b6a577d0525ca62b223af868b1b57ea9c4f22645095ea98537c48e5bc499483f22016646b230496fca2b648471851dcec7f3

Download Submit