hxxps://l[.]facebook[.]com/l[.]php?u=https%3A%2F%2Fvivalavida[.]online%2Fvideo-que-se-le-filtro-a-la-amiguita-de-valeria%2F%3Ffbclid%3DIwZXh0bgNhZW0CMTAAAR0zqkYshDw_aSYrHUAdUDOgQQowqprAt9gMT1C7IPCrwOj_qODkhNTkzNQ_aem_AQJoSEwdOKYS4nsSXLF-nETCpod3WQx11KH3sVlAPns1q5UUQuOLI_JGgJpNUwCzL89f1ZUjCfstzIOab6qWx-Xl&h=AT1spQiqq_QsJh_MvF3wtWe3g1X8MY2gPAiMZRVgG0npxprUGCzEBClr6Gi24PgBQ6PimxwaHPu1eSEKx3ITyl0W181DhZLURMt1S8C2WerS7fnvsb2iivzg9JXK5QXFnW8sfegTQae7MkJE&__tn__=R*F&c0=AT0qK37jPvb42Gvzq9O1x_gp9JliZi3bBbPNUyinJiqmxwjESme0tvORy7yjvrUs4i1plQA5-2YkAOqZUxim7eXOr0ihx8F7FBaywNv0-travut7kFHT4--RkRuut0IUF9YaKJs9EQdGhMWWpNPda-39dt3SDwvpZb6mENWqbDvc4_Vt-WtUgFZAO3ECRVeMsWwHSI-1n5V8e5maq_kK5urwHaFX_uuuolGIrTvtWEP6oABd_bXmgncRHr4p2xo

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://l.facebook.com/l.php?u=https%3A%2F%2Fvivalavida.online%2Fvideo-que-se-le-filtro-a-la-amiguita-de-valeria%2F%3Ffbclid%3DIwZXh0bgNhZW0CMTAAAR0zqkYshDw_aSYrHUAdUDOgQQowqprAt9gMT1C7IPCrwOj_qODkhNTkzNQ_aem_AQJoSEwdOKYS4nsSXLF-nETCpod3WQx11KH3sVlAPns1q5UUQuOLI_JGgJpNUwCzL89f1ZUjCfstzIOab6qWx-Xl&h=AT1spQiqq_QsJh_MvF3wtWe3g1X8MY2gPAiMZRVgG0npxprUGCzEBClr6Gi24PgBQ6PimxwaHPu1eSEKx3ITyl0W181DhZLURMt1S8C2WerS7fnvsb2iivzg9JXK5QXFnW8sfegTQae7MkJE&__tn__=R*F&c0=AT0qK37jPvb42Gvzq9O1x_gp9JliZi3bBbPNUyinJiqmxwjESme0tvORy7yjvrUs4i1plQA5-2YkAOqZUxim7eXOr0ihx8F7FBaywNv0-travut7kFHT4--RkRuut0IUF9YaKJs9EQdGhMWWpNPda-39dt3SDwvpZb6mENWqbDvc4_Vt-WtUgFZAO3ECRVeMsWwHSI-1n5V8e5maq_kK5urwHaFX_uuuolGIrTvtWEP6oABd_bXmgncRHr4p2xo

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
4304	msedge.exe
4304	msedge.exe
948	identity_helper.exe
948	identity_helper.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 2052	4304	msedge.exe	85
PID 4304 wrote to memory of 2052	4304	msedge.exe	85
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 1140	4304	msedge.exe	86
PID 4304 wrote to memory of 3056	4304	msedge.exe	87
PID 4304 wrote to memory of 3056	4304	msedge.exe	87
PID 4304 wrote to memory of 4824	4304	msedge.exe	88
PID 4304 wrote to memory of 4824	4304	msedge.exe	88
PID 4304 wrote to memory of 4824	4304	msedge.exe	88
PID 4304 wrote to memory of 4824	4304	msedge.exe	88
PID 4304 wrote to memory of 4824	4304	msedge.exe	88
PID 4304 wrote to memory of 4824	4304	msedge.exe	88
PID 4304 wrote to memory of 4824	4304	msedge.exe	88
PID 4304 wrote to memory of 4824	4304	msedge.exe	88
PID 4304 wrote to memory of 4824	4304	msedge.exe	88
PID 4304 wrote to memory of 4824	4304	msedge.exe	88
PID 4304 wrote to memory of 4824	4304	msedge.exe	88
PID 4304 wrote to memory of 4824	4304	msedge.exe	88
PID 4304 wrote to memory of 4824	4304	msedge.exe	88
PID 4304 wrote to memory of 4824	4304	msedge.exe	88
PID 4304 wrote to memory of 4824	4304	msedge.exe	88
PID 4304 wrote to memory of 4824	4304	msedge.exe	88
PID 4304 wrote to memory of 4824	4304	msedge.exe	88
PID 4304 wrote to memory of 4824	4304	msedge.exe	88
PID 4304 wrote to memory of 4824	4304	msedge.exe	88
PID 4304 wrote to memory of 4824	4304	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://l.facebook.com/l.php?u=https%3A%2F%2Fvivalavida.online%2Fvideo-que-se-le-filtro-a-la-amiguita-de-valeria%2F%3Ffbclid%3DIwZXh0bgNhZW0CMTAAAR0zqkYshDw_aSYrHUAdUDOgQQowqprAt9gMT1C7IPCrwOj_qODkhNTkzNQ_aem_AQJoSEwdOKYS4nsSXLF-nETCpod3WQx11KH3sVlAPns1q5UUQuOLI_JGgJpNUwCzL89f1ZUjCfstzIOab6qWx-Xl&h=AT1spQiqq_QsJh_MvF3wtWe3g1X8MY2gPAiMZRVgG0npxprUGCzEBClr6Gi24PgBQ6PimxwaHPu1eSEKx3ITyl0W181DhZLURMt1S8C2WerS7fnvsb2iivzg9JXK5QXFnW8sfegTQae7MkJE&__tn__=R*F&c0=AT0qK37jPvb42Gvzq9O1x_gp9JliZi3bBbPNUyinJiqmxwjESme0tvORy7yjvrUs4i1plQA5-2YkAOqZUxim7eXOr0ihx8F7FBaywNv0-travut7kFHT4--RkRuut0IUF9YaKJs9EQdGhMWWpNPda-39dt3SDwvpZb6mENWqbDvc4_Vt-WtUgFZAO3ECRVeMsWwHSI-1n5V8e5maq_kK5urwHaFX_uuuolGIrTvtWEP6oABd_bXmgncRHr4p2xo
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce4e046f8,0x7ffce4e04708,0x7ffce4e04718
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,1828692068776914679,3228805594726604050,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,1828692068776914679,3228805594726604050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,1828692068776914679,3228805594726604050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1828692068776914679,3228805594726604050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1828692068776914679,3228805594726604050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1828692068776914679,3228805594726604050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1828692068776914679,3228805594726604050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1828692068776914679,3228805594726604050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2244,1828692068776914679,3228805594726604050,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1828692068776914679,3228805594726604050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1828692068776914679,3228805594726604050,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1828692068776914679,3228805594726604050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1828692068776914679,3228805594726604050,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,1828692068776914679,3228805594726604050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,1828692068776914679,3228805594726604050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,1828692068776914679,3228805594726604050,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1424 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3916

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c4 0x340
1⤵
PID:520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b1931878d6b8b22142fd7fd614add5c

SHA1
0e20ec0bec5a9fe3b6666c3009626f0420415bc7

SHA256
d78e49cf9c940d8a407fca2338e30b754e4579c64e88932c46c3871f62c15904

SHA512
1e7a63ff7340719736560277601ff43f30937dbd4a1fbacbcb0d72fa708216692a4bb4ba658edf227b767975b430fc94e7c4f0b5dab29bef9483bfcfb38e1cf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
70ae4bf8f75c69610c1d00131c1ec28c

SHA1
eab92c184a3b655377f375b1b25ef85fb06c7130

SHA256
9f46453862eb083e85697631455185c0ead19ec86c1ae3d15274c06c9a38731b

SHA512
29299dbc0114f01525bff67ec421a28056905e8f5d21f00502554f446883b6086f8b9a2c27a591f364077da17c21438910b8dbf163a59f6f80272eb7d5f05c68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
4d80dead2767b340d899f76b6b14792e

SHA1
5a076eaadc2b28ec56298efc516c9a9aff950d33

SHA256
a03255176da60ca23d96c714ee976a1eaefebc5cdaf7341e60c382c19347ef04

SHA512
b0b64c523d52a91d16b76cea818d9553e2eddc3f73d2f9f992bab78aee3c4a0b0f466d1499d191386704f376fb7c185558bc8256f676e6b2bd3522b9649f2b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
889fb202a29249c11076f1452357b96d

SHA1
4bb8c9d34f861f2c5f37339836f7de11109b52e6

SHA256
910579c8475f1e78699bf00c324309e17d5aa02377036a819f498c937878d750

SHA512
7af1e491c3444f8576abe8909dca7ae2353abd70978ccfe609246335639dd26478d755287816abd21926a203d87d08cff19ecc7b2ff536884ee7da0c3b88f440

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
098107bfc178da25b700c8c440a423b5

SHA1
e81d79032ed9c5b43ac043d03606fb92714cff9b

SHA256
e7595556cc7c978236a442131da92e51227bbc641cbcef5db2eda660b9f8adfd

SHA512
b748ab643b0e41fd47d58f6cf4399e3332c2bba842df63b093c6bc21346f6416c3d862b15bbc7a4422ef1f70d05453e7be3dc96855a9e0451e2161bf05adb7c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2b223ad860ec9cbc32d56f945cea7db1

SHA1
eb64de978a1f331b22bb68e1d1b4dc84271fb4ba

SHA256
425c9d6be91ac4d36b7c81ad38af289f3fa18823be79cdeaa4e7d70aeaaa43de

SHA512
f4bd3744017f939a443fbb6facca331d0df50ab25c67059b809fb6c68e3d0a3d6f57812e0a71f72e5c91451094a7841b8a826c909806e69105a4949e56d87b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
70301cdf9a9d3ee1e4ede5ac869e91cf

SHA1
78f2920889b810858aeceba049360d92d4efa4d7

SHA256
552ac88f3707b95f3adc6b9f3d340da7fba72cacbfb67d6f9aa4ec7541a58cca

SHA512
8cd6b453d4cd93e376d09ceba9d77ec0fde2cac9ba30908d85714525a31f75d6194ce7618d8698b2d1726d131efa90561029322e177acec9afcb2e8bbd0afd22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bdb3ce9f700bff1ae6496fb258d17609

SHA1
8a34747baf7b50871cf206041453f35a6a5e9664

SHA256
5e7aa11498d9f0a2bd267b2652bf5dd63f4dca2f9420f16294e4dfcebc391bd2

SHA512
3bd3de9a3ea1ce9b85e0e2f63d9f145ff9f329e3d0312964979fc61e591b769469c9ed3438313834ba97b38d5ae86988dfa50bb1e9ae1ece557e0db88687a695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2976f7c584930606bf88ccb37dbd975d

SHA1
a54d03f867e9bd5a4f0e11b66d17cdf50bb31677

SHA256
3be1a6aca400a860b3cb3d5e9a09a625fb8d04dd68c6605419f8d1087fa88fa5

SHA512
4d46838d4cbef445f41ea21460ced0baa11c99e7080b7b3d26dc1ba292ac5ff67ea1889dfdabff504d7581ba8095994735bc2f1bd10ff89a0dd10276059bc181

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6e45ac63ad1456946376c6f14ef09258

SHA1
15c324020bc672d27c7401ac6e9b3481125b2dee

SHA256
86590c1c005c37edcf10059741d44acf8d1ac404b2539acfed5bfb1a5729a622

SHA512
027f56c60c3ba91e732cfbf76ff53dcf81086a6d25099fd79c0a024784ee9004bfea5b7f38adb3e98052512204e799b55afd529ac8914d1de6b00b1adfe382bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f29d.TMP

Filesize
1KB

MD5
dcfce50ab9a2709aa788838c7178eaff

SHA1
a4d31a5e25fa4540346ca0447968806beaa0f4c8

SHA256
3678bd69ee83b50885e65c75e5e391011b398aa2222685844ca86fcf38353660

SHA512
6c063d50c49ca399b0b785f20b9f0b94a33dc74ff9f162b3a3d6d17f355cd8378571b53844e4c12945e9f426dd57b523a67ba6d8156d34c05038c63cb1c25b0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fc1c5a6e485dac6c45c8911cd4ad1a4d

SHA1
d9836d3c0ca8e18d437daa75381dafc3c524e630

SHA256
791126f2c06e9276ba312d996ef4fc4ed73100a4a49c84ece729fc0b64f778a8

SHA512
9bb8e99529a5435a9c329d17d058aae38f604eec9452ae4f7e7c2b31aca89d959e252774c7d9abc443f492d377a577cf53d2c9893d2375240f2600ce5dc7f7ac

Download Submit