hxxps://api[.]spently[.]com/api/spently/click?id=105133&store=hotelcollection&type=OI&cid=6272440696998&url=r20[.]rs6[.]net/tn[.]jsp?f=001HLgqcUkReO9FSIVITG6uz7GAoi1UxlGPbQsty7P1VKgkW3rrLc_ptlx62J4SFe04DjNXGRkaq3l5iYct3l4Ibm2Jk5ZGEifVQNE8pQ3yznzzgAXktLXaPRw9VN4yUzMXA2TeE3LEcbF03becoHdT7y5_YU8Sh61a&c=&ch=/=&__=[//]new/auth/jhsuhqplywjcfaoscdjdtctjmohqtndgoogcnrcjwolvwoszus/Y3RvcnJlc0BhbnRhbWluYS5jb20=

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://api.spently.com/api/spently/click?id=105133&store=hotelcollection&type=OI&cid=6272440696998&url=r20.rs6.net/tn.jsp?f=001HLgqcUkReO9FSIVITG6uz7GAoi1UxlGPbQsty7P1VKgkW3rrLc_ptlx62J4SFe04DjNXGRkaq3l5iYct3l4Ibm2Jk5ZGEifVQNE8pQ3yznzzgAXktLXaPRw9VN4yUzMXA2TeE3LEcbF03becoHdT7y5_YU8Sh61a&c=&ch=/=&__=//new/auth/jhsuhqplywjcfaoscdjdtctjmohqtndgoogcnrcjwolvwoszus/Y3RvcnJlc0BhbnRhbWluYS5jb20=

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1916	msedge.exe
1916	msedge.exe
5108	msedge.exe
5108	msedge.exe
1312	identity_helper.exe
1312	identity_helper.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 4952	5108	msedge.exe	89
PID 5108 wrote to memory of 4952	5108	msedge.exe	89
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1432	5108	msedge.exe	90
PID 5108 wrote to memory of 1916	5108	msedge.exe	91
PID 5108 wrote to memory of 1916	5108	msedge.exe	91
PID 5108 wrote to memory of 4940	5108	msedge.exe	92
PID 5108 wrote to memory of 4940	5108	msedge.exe	92
PID 5108 wrote to memory of 4940	5108	msedge.exe	92
PID 5108 wrote to memory of 4940	5108	msedge.exe	92
PID 5108 wrote to memory of 4940	5108	msedge.exe	92
PID 5108 wrote to memory of 4940	5108	msedge.exe	92
PID 5108 wrote to memory of 4940	5108	msedge.exe	92
PID 5108 wrote to memory of 4940	5108	msedge.exe	92
PID 5108 wrote to memory of 4940	5108	msedge.exe	92
PID 5108 wrote to memory of 4940	5108	msedge.exe	92
PID 5108 wrote to memory of 4940	5108	msedge.exe	92
PID 5108 wrote to memory of 4940	5108	msedge.exe	92
PID 5108 wrote to memory of 4940	5108	msedge.exe	92
PID 5108 wrote to memory of 4940	5108	msedge.exe	92
PID 5108 wrote to memory of 4940	5108	msedge.exe	92
PID 5108 wrote to memory of 4940	5108	msedge.exe	92
PID 5108 wrote to memory of 4940	5108	msedge.exe	92
PID 5108 wrote to memory of 4940	5108	msedge.exe	92
PID 5108 wrote to memory of 4940	5108	msedge.exe	92
PID 5108 wrote to memory of 4940	5108	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://api.spently.com/api/spently/click?id=105133&store=hotelcollection&type=OI&cid=6272440696998&url=r20.rs6.net/tn.jsp?f=001HLgqcUkReO9FSIVITG6uz7GAoi1UxlGPbQsty7P1VKgkW3rrLc_ptlx62J4SFe04DjNXGRkaq3l5iYct3l4Ibm2Jk5ZGEifVQNE8pQ3yznzzgAXktLXaPRw9VN4yUzMXA2TeE3LEcbF03becoHdT7y5_YU8Sh61a&c=&ch=/=&__=//new/auth/jhsuhqplywjcfaoscdjdtctjmohqtndgoogcnrcjwolvwoszus/Y3RvcnJlc0BhbnRhbWluYS5jb20=
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc82af46f8,0x7ffc82af4708,0x7ffc82af4718
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,8619981865243797672,14329841398836130938,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,8619981865243797672,14329841398836130938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,8619981865243797672,14329841398836130938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8619981865243797672,14329841398836130938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8619981865243797672,14329841398836130938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8619981865243797672,14329841398836130938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8619981865243797672,14329841398836130938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8619981865243797672,14329841398836130938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8619981865243797672,14329841398836130938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,8619981865243797672,14329841398836130938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,8619981865243797672,14329841398836130938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8619981865243797672,14329841398836130938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8619981865243797672,14329841398836130938,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8619981865243797672,14329841398836130938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8619981865243797672,14329841398836130938,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8619981865243797672,14329841398836130938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2052,8619981865243797672,14329841398836130938,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8619981865243797672,14329841398836130938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,8619981865243797672,14329841398836130938,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8619981865243797672,14329841398836130938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8619981865243797672,14329841398836130938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\16aad4ab-739a-4399-a820-dffc41d5f691.tmp

Filesize
6KB

MD5
3c7a1604ff5b08dff676ee8f998edd49

SHA1
8ed444dc08e9f9c9e26e9a9921303b3cc6c4f8c6

SHA256
323fc552626fef0efb07e0270114e8216c896cd8abe48de97f45c3e8ece83d48

SHA512
384292ec26d99dd848044435e3d6cb387349708db58edb7387a06df8bb81b256562dbe2c33cf72c030d9c419cf277e3e43dd722e93b4a13e5b4b22c0fed085d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
88368e2ada04fccb5b47e8a79cf8d0fe

SHA1
614b68a2e779aea014a869b01fe1c5e4517fa6ea

SHA256
6a8a5af08ff1ad943aeec3ca43b07791d5bbadeb93239718c76f984a4879ebc7

SHA512
961b997283b0ec329a2bd05d76344fb831bb31052bc2a22bbe85fc227a7dd92d3beac1c7ef410b9bd4046f5e80f4bb772615a2f775e140d37aacd2d1b17d5e3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
4876aa51c4c3dceeb963b71edc6771c6

SHA1
24291934b015a932e4e12fee564dbb4d444b7e6f

SHA256
7c7cba7d14e9fb4ab34dd6afcc5b60f393f1e7f166094e703613b11ba108eea1

SHA512
58b10304c0a04a24c2808c88290fe1ae79078133c06e82ed538d018be3e7552a108c77783c65b628fd3067ef6c8eea82082434a91608fe3c40cde067b553db7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
35ebe2190c36e18df9a233a3c3d30c16

SHA1
be5e500705de1d2f087b8ad26fe455cd70f6ed6d

SHA256
00e03160536da7023e254d414da201c205b4c209a636acbd0a2b319c923cec51

SHA512
8ebfa3c9cb68062bc2bf35449f6e045e6a94ad5be0023b66a870668c51c425b842f8aa7c727d947e8d8d14e1237f3b70b27caa74e4e43045bb08f0916b2c4049

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ed488bb2f234c315d65f3d67d6563573

SHA1
f5e2fedbeb61bf7e95571891b2b555c394cbe73d

SHA256
ab0f71f65990c9ee0442e9c6724299953fe5dc23f8633485632b42cafd4bb282

SHA512
4e0088aeaf9c86328deee29635f9b7d68e9bd47defafaa9d2abfd155db627a1278624a1218476dfd8f30388822880ee3e7418e37d3b1711bc53b5404a7a45b11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aafd132bb2e9c658afcf94956ca38610

SHA1
e9bae8350eb520b8ba8536d33569b1328e5a5004

SHA256
e5b34cc174a9b23d5a4385c6c4531ac43770afb47b33ca4b0c8c0cc4a73ccb01

SHA512
5a354b6afe6f79be1f96eb79288df6e27ebc049bd360e03d56a1eee3078e0f7f37f7ead3189418cc4b2315187f4ba2bfa477893a1b11306a27ef7d9e3773e42c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7bcb0831f79698e37896e49ea6ac3146

SHA1
cdd0fc5fbae467eb46b3b647b6a568d62f5653c1

SHA256
a050984562b6b1b46c520af5f4330e91d1db239b4d5b8c0569b189be4983a3b7

SHA512
cb42c476b1927a8b02c4abeb2c8e0d2b4d64ba1ee1ff71b634017199a2172f2040a9cf9d0759149d4f498fe1dbafce3420f27565dc111844c4592e8075efc3b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
2abee26ea7ea8e82009ac62be9671c6a

SHA1
c20dc70b72e18cc9202ca0b3b15cb5533319ba8a

SHA256
603b7da22c93002a850300d465f1b2302895aee97813ba379bbdc18bad293ec2

SHA512
564b6f27e768ad47a2a361a0ca95398841094df21e60683f6ca31b33a2217dc7aa49f7912e7a3123bb8b8dec195bc09f5a55654d4e1ed4ab82e3026d1b2b20ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1cb721d2853af53ad5d8326abb33e0a4

SHA1
7cfae2fbe418ebf518c367c45833a24f9852b7bd

SHA256
101b2f7f4d1503790ead2e3d9c38c48a77b295ba8bfa3243d8eb634981cf3827

SHA512
f7c18893685a63ec9952f6bb1e57dae11b2c962ea40ca0f6c2070e8cc09977c08aaf7ada991ce8dd8a7c0aab4ee429591a4045f1db0d4f10dfef4eab63f86663

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b244.TMP

Filesize
705B

MD5
521eb71983ee763c2c7741bddb13b5c8

SHA1
665cc450bd3e47e466773fee3b465d51ee38e284

SHA256
48ab1e28891025befc9f9305b4b287b200008b199cc7b820abd1449484a66e81

SHA512
a3d5acd1d4607d8c655c5019686e50970c3944d8c9b511b7044af855a1a29cad0e6181cfe440ccc07c00cc0f74af41ffe394e313b5e5b79267d01a16b9d326a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
042f3a3f5a9d8f273068a5c76b36216e

SHA1
4e068be10116f15ffc420876fb201c96c8170d82

SHA256
d5c0b41a57552cfdf4309467050e6f1f13b91a5d057fa7f5edbf54c2bbdc61a6

SHA512
4482a5025ee3f533949bd0ec3cb1e373a4c48585a0ff2b3af21b6dde801137dcafec763f6d8e9cb5d2a4714d2e30fbf2c082e1f45146a9617023848f874e202e

Download Submit