2a32f76f5d74ecf9f05ba0cd06c7d6f20e258e8873cac9dbb3747713f021797b

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2024 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9bef1ee8ffa69eff22f69bc2011dbf1.html
Size

432B
MD5

b9bef1ee8ffa69eff22f69bc2011dbf1
SHA1

d4810f5d07e64bd536d50f1225f70dc30b009a16
SHA256

2a32f76f5d74ecf9f05ba0cd06c7d6f20e258e8873cac9dbb3747713f021797b
SHA512

fd40756df14f6c9dbbc0683e4c6730b6db48c42718b5f365c4be83b7648b9e78609f7b127cf5c81f9ad83773bd01523b2427a532e94c92ba2f772008e8a7fecf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
4868	msedge.exe
4868	msedge.exe
1940	identity_helper.exe
1940	identity_helper.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 1336	4868	msedge.exe	87
PID 4868 wrote to memory of 1336	4868	msedge.exe	87
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 1552	4868	msedge.exe	88
PID 4868 wrote to memory of 384	4868	msedge.exe	89
PID 4868 wrote to memory of 384	4868	msedge.exe	89
PID 4868 wrote to memory of 1112	4868	msedge.exe	90
PID 4868 wrote to memory of 1112	4868	msedge.exe	90
PID 4868 wrote to memory of 1112	4868	msedge.exe	90
PID 4868 wrote to memory of 1112	4868	msedge.exe	90
PID 4868 wrote to memory of 1112	4868	msedge.exe	90
PID 4868 wrote to memory of 1112	4868	msedge.exe	90
PID 4868 wrote to memory of 1112	4868	msedge.exe	90
PID 4868 wrote to memory of 1112	4868	msedge.exe	90
PID 4868 wrote to memory of 1112	4868	msedge.exe	90
PID 4868 wrote to memory of 1112	4868	msedge.exe	90
PID 4868 wrote to memory of 1112	4868	msedge.exe	90
PID 4868 wrote to memory of 1112	4868	msedge.exe	90
PID 4868 wrote to memory of 1112	4868	msedge.exe	90
PID 4868 wrote to memory of 1112	4868	msedge.exe	90
PID 4868 wrote to memory of 1112	4868	msedge.exe	90
PID 4868 wrote to memory of 1112	4868	msedge.exe	90
PID 4868 wrote to memory of 1112	4868	msedge.exe	90
PID 4868 wrote to memory of 1112	4868	msedge.exe	90
PID 4868 wrote to memory of 1112	4868	msedge.exe	90
PID 4868 wrote to memory of 1112	4868	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b9bef1ee8ffa69eff22f69bc2011dbf1.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff09ce46f8,0x7fff09ce4708,0x7fff09ce4718
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1464,3634629410663421948,6818184442824558901,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7740a919423ddc469647f8fdd981324d

SHA1
c1bc3f834507e4940a0b7594e34c4b83bbea7cda

SHA256
bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

SHA512
7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
194KB

MD5
f5b4137b040ec6bd884feee514f7c176

SHA1
7897677377a9ced759be35a66fdee34b391ab0ff

SHA256
845aa24ba38524f33f097b0d9bae7d9112b01fa35c443be5ec1f7b0da23513e6

SHA512
813b764a5650e4e3d1574172dd5d6a26f72c0ba5c8af7b0d676c62bc1b245e4563952bf33663bffc02089127b76a67f9977b0a8f18eaef22d9b4aa3abaaa7c40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
b656a596ef8f5263d163b5197e9b1daf

SHA1
3a3e01ca51717537407fa4bcef4fed64cc669bfc

SHA256
d32fe4c8eab2ce7ba95147e8be61e4481fdd58dc7ed21a9d1be95e0d570b00d0

SHA512
fd5b60fd16a76e27719ebcec5fe05401a5e2159ad740c82eaf21301ce527f24a808ef462369f7ef4512f9eaf02757753dbf78ca9cb60d0fff5d22424a5953ddd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
455ee2f9136fd6680e62391cbc3a77af

SHA1
0027e0de265c94a3cbfd0922208d526639d39ff5

SHA256
31a0141654bdb573b3e87eb01c4c2f49ca5135d9b25625ff1d2f9e03acfa83ec

SHA512
e570ca5ea461d71a5c3a45ae089a4fbdaf8fa3a971f0056dd9beb101416eb8039e38f30834f2bbc5d3a67bf1965dafa1f1e644c8fcd346b318337715fa58cc7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f7aa966431f02da754065c885172e44c

SHA1
d461b78171085e4c762e9a7bc451b224993b7132

SHA256
e10921298b91290f37f0485fa762c48e320fc46aa9dce05d2d659a6a66d13938

SHA512
4f5252392dfc4114af956eac1c54067373323c95d97290c5ed3a0102994e1507e7a33e3ae5e0f11277bfbcc45fb47a62b98ebca4e7fb999f7565a2b798dc82b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
efce5e95ad19e28f2733dd1519d88b84

SHA1
0b628709b5dfffe454d21271f808afbffad25a32

SHA256
29b6a83e09ff1416a4af52b416bc48899f17e99b37dc0ee9d2b98017f2b359cf

SHA512
b58be055b7e19e415b6c2a4e8c6ddb53fde55520b05e7b525735b947b84cb12ad6ececd1b7b0e8e5b1bf48ffdc7ba080db6ac36b161ae10e8959274b63f81b66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2432d366592d2239e51be1c23629ad24

SHA1
fa529a83496eca9efeb8a455dde6751e6540f886

SHA256
6978131ba0db5e318fdedfaea71579832a042ef33cf87a7eaca7b2347d8185d2

SHA512
cb38369171e26babbb5ab59f055fe9b8d047d13c27a5e4104a494f8c3d5264c1044c75f176ed31979cfa71b5b7a19951d1c4bbfa30dbd9f8ae5a687af6a15b67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6bb7e746ce4b293d651050e5d70cdacf

SHA1
d7eafbc47ba70649187a8e8ac356d4a56dd4e7d3

SHA256
8aafad90d823f7ee80b56d502898b613654f719f3e658a6c850dbefce3507c0b

SHA512
f0eea2b620a73bb51f707b84a8b2ba9669c902b6e54568b2730892cbac7310843608b6e01f961b3dd9d17b3968c9cfba39322ff085c4a11708fb9ba40bc0cbca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
382543d46e5dfa488f68ed9d3144aaaa

SHA1
bf09c3eda80a1b6bd37a72d6bc8de83f9260ee2f

SHA256
811afc573c2c96b4613481fdec825f27990760a611a0f1e7792b22af26bf5acd

SHA512
dcb21a6e745b4a9656ecfbfd10e16b2ae165aa3ea3d75f1dbf81d3c6bc6d69ce176575d7c308daa27d6a98513dda35374a3a251ee901fdb8c537ceddffa2d3c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57bd83.TMP

Filesize
48B

MD5
73674b704938997a3d75e3f88ced234f

SHA1
97ebca9d65ddd14bea3f08576d9347d772c834f3

SHA256
7e8c38dc4efbf76dc86a7de015fbf84d5c4a2292f451ebab58eb0a3c7d20df53

SHA512
46b56af95b62241bb3dcdc154a0879fe8101def7f16aaca5d86c01d0411a6681d798d8e4d621d86b15d21e275f33ec65e1f1ac776f7a1dc9c4e13fead26f2c22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
e2023a5d8b61bb40b5f70e3dbaed8174

SHA1
6707ce94edeb4521a1c5651470bbf70f4ce36c6a

SHA256
b42e8ec42acf3f71db92197c5a9175988fdb42552c24c7b03bce1f30505fe88f

SHA512
8e0180f30bd127c7bcc7a09fb99463150f3ec51d5d6edd65ba4bf2b5f67f133d337df5150907a6efae1a0b197f088a40262f4c580bd920a9091840268858140f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bdc2.TMP

Filesize
203B

MD5
82d99d4c111950cdc37ed9de855b5b04

SHA1
3c304c79bc2f0e60bf53e29f56c9eb46ea3560c0

SHA256
bde98fe9e85b0d65785f2b6521b24f56031f30a2087e859e8c4174399821380f

SHA512
6874803a6a8aad2c33292d23a7ba0880835fda496fcb81e61a696dcf7e0aa6b120f144439f8119f218565d8c83adba26c97f279f92852f654b35c11e3d3b899e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5748cf5817ede47dd0ec28d1b8703f50

SHA1
46e02cf2884e290a06118963400b20ff3cb51345

SHA256
2b69072fc3d4f00a0221c8dad8f19442eafc5a09908abf9eec7fc790cba381ee

SHA512
595dabd795f5a64a9c3e964450e5788e7c1b4e53d51088b894ff8c2f10d6c3b60b6bdeb8b4754e17f518dad403692be5b522accdb758fd8884b1f8f3d1eb186e

Download Submit