53245d9da932a893a892c7a397a7798967769e92a44f45bf8cdf4e12a3531ea1

Analysis

max time kernel
147s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 13:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb88a6e46c1e96fc64bef8e512344cee.html
Size

68KB
MD5

cb88a6e46c1e96fc64bef8e512344cee
SHA1

af7ced1b79c547d4179d1c674d0bf430b245b21c
SHA256

53245d9da932a893a892c7a397a7798967769e92a44f45bf8cdf4e12a3531ea1
SHA512

53f44ef52d669cc07ac4bed849e343e9232ebb88c03f261a3e7219faa9163f41223a1c9c697646e41cc322e71ba1a3b5bc4d3341b0b39443e7a8dbbeae0cd4bd
SSDEEP

1536://T645QOdZHI8vA082ESlxT2NhmtwFCK2Z9kmeQUDDklFYKSSLNOaHE1:zv28vA082ESlxT2+twFCK2Z9bFYKSSL4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-983155329-280873152-1838004294-1000\{7CF2B8AB-AFB4-4707-8DB0-016410358BF6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4392	msedge.exe
4392	msedge.exe
116	msedge.exe
2552	msedge.exe
2552	msedge.exe
4108	identity_helper.exe
4108	identity_helper.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 4188	4392	msedge.exe	88
PID 4392 wrote to memory of 4188	4392	msedge.exe	88
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4976	4392	msedge.exe	89
PID 4392 wrote to memory of 4608	4392	msedge.exe	90
PID 4392 wrote to memory of 4608	4392	msedge.exe	90
PID 4392 wrote to memory of 3172	4392	msedge.exe	91
PID 4392 wrote to memory of 3172	4392	msedge.exe	91
PID 4392 wrote to memory of 3172	4392	msedge.exe	91
PID 4392 wrote to memory of 3172	4392	msedge.exe	91
PID 4392 wrote to memory of 3172	4392	msedge.exe	91
PID 4392 wrote to memory of 3172	4392	msedge.exe	91
PID 4392 wrote to memory of 3172	4392	msedge.exe	91
PID 4392 wrote to memory of 3172	4392	msedge.exe	91
PID 4392 wrote to memory of 3172	4392	msedge.exe	91
PID 4392 wrote to memory of 3172	4392	msedge.exe	91
PID 4392 wrote to memory of 3172	4392	msedge.exe	91
PID 4392 wrote to memory of 3172	4392	msedge.exe	91
PID 4392 wrote to memory of 3172	4392	msedge.exe	91
PID 4392 wrote to memory of 3172	4392	msedge.exe	91
PID 4392 wrote to memory of 3172	4392	msedge.exe	91
PID 4392 wrote to memory of 3172	4392	msedge.exe	91
PID 4392 wrote to memory of 3172	4392	msedge.exe	91
PID 4392 wrote to memory of 3172	4392	msedge.exe	91
PID 4392 wrote to memory of 3172	4392	msedge.exe	91
PID 4392 wrote to memory of 3172	4392	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cb88a6e46c1e96fc64bef8e512344cee.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff980ab46f8,0x7ff980ab4708,0x7ff980ab4718
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,6404483367361226680,17158463796558286497,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,6404483367361226680,17158463796558286497,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,6404483367361226680,17158463796558286497,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6404483367361226680,17158463796558286497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6404483367361226680,17158463796558286497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6404483367361226680,17158463796558286497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6404483367361226680,17158463796558286497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6404483367361226680,17158463796558286497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6404483367361226680,17158463796558286497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2016,6404483367361226680,17158463796558286497,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2016,6404483367361226680,17158463796558286497,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2016,6404483367361226680,17158463796558286497,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,6404483367361226680,17158463796558286497,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7096 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,6404483367361226680,17158463796558286497,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6404483367361226680,17158463796558286497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6404483367361226680,17158463796558286497,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6404483367361226680,17158463796558286497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6404483367361226680,17158463796558286497,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,6404483367361226680,17158463796558286497,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4916 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7740a919423ddc469647f8fdd981324d

SHA1
c1bc3f834507e4940a0b7594e34c4b83bbea7cda

SHA256
bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

SHA512
7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
599bde7f5c952f293995bb72e88fd95d

SHA1
c5494fc35535cc541c4e2cb636753527311255ab

SHA256
86bdf1d0c3c0f27a3cbd87c04b888057d98627dd2863691292b8570b15edc547

SHA512
282f2126177a746660bb50757bd4df713b2d26697a6a56f0aa406ebf85e5c9f14fbbb92794c573b372d45d222010d16677d941e4d764ea3c7463dbafcf3d6ae0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
efa43867ae200458a10bfef727fe76c2

SHA1
753c145405a3d2ded8ab031d4555bfb32ef54bec

SHA256
716e2db38768d7a62380df0292a999f6bce3ccfd1c8bde8e1ab605d86e5e9bc3

SHA512
1511d47497da9ec865e7fa4e3a02c2b304b1c163c976b7952c881f3a63a3842ba22c12e3adc35fcfcca6528b4ec2be6efb50f4e6ef7de939e2c84c28edf1e9fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
34ace658096e35f6f2f46cd281fa2c1a

SHA1
81e17c286e230f9a2c2940f11873b67ba4a1a123

SHA256
d125abcd5dbfc17ce051c9a14802db9d5d8460187c114e3210c7890bc186fa93

SHA512
7b1cb09bf2b2d0d424aafd2ae0c55a5026a52f984582bb7129c12bf3455913073dd43d1e5cc37653286d2dc54b64041712b1361e140f90b4ce0f1aabcd8cd8e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fd9f91a0aa23872f7809dbe069dc093e

SHA1
e1084445fa3a65a217962ed384eba11a697dfe9d

SHA256
7e9e9c9d7db7484437d7c114d2fb68f0e712c736e5605db18700031a2fa82fc4

SHA512
cbc6a1295715cb4845788fa1cf917ff9bbd092ec5c389a8c01be8d868efef03bdbf45c5c1f5919dd87bd83448456f82f1b778812b5518cae55fddb510f8e60ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9698f93ae62257ea09d9ccc416421fcf

SHA1
22e3323d651b86836fcd72596c2422cf7bc346c0

SHA256
88cc03694c311312dcae7d7688c7bec7834feb770f4b32e389bfa0cc2f5c38df

SHA512
9b668d816bdf594fc361abeac34efcbbaf1afea817b6583bb9c2ca979044449e1e1a5cd2b00317b373e54266c56c29934cde7f95b7febf9b3ca804ee61b5fd80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f0235d5075ef3920c39c5cc340335c63

SHA1
4a55dc2cd678168305314f0bcc8b8197c7c402d6

SHA256
b25f15a30616bd3d1be0c182553692666b38b84113b47121c7316dfa8ff89e27

SHA512
e219e970de30076b98090c936be55b8586375174b235ef45fa0d0c4bd4b0fe5fc4db65036307bef988718bf6f688af9849ef9f62ffbff0846a34418c53d2531f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
27eef854e9f98ba1d45afb0d5d15cfb4

SHA1
ec248f33801debbad337662b69d5a93d99fb6341

SHA256
758487e7d9b8dc3095504ea0d54a8e97714aca0ab5e644e369b13f0260d4f8b8

SHA512
e63d5395dc8c8ed90d01c9de708e6b2e4f8e009ec2e81929f82a45d63c5e3c9fe6937feec659d1ea1e049c794479be386a1184453e78379cf676d19726e10d2a

Download Submit