hxxps://www[.]googleadservices[.]com/pagead/aclk?sa=L&ai=DChcSEwiUut-x4d2FAxV6D6IDHXkTCGQYABAAGgJsZQ&ae=2&gclid=Cj0KCQjw_qexBhCoARIsAFgBlesBUr0ZuVGBuM4CjxjK1wCccOqBLaGsHZzcBnc3QWzzGgSr_V-0d0QaAp9OEALw_wcB&ohost=www[.]google[.]com&cid=CAESVeD2ErrZQz7eE_OPZSOIw1ZFgLxZsG61LBT-XbnLstU_GWuEy8abP1P-ebl-DPQnOqg6aRs8Bi6gF4VA3TBOlhsK9iXxBu0lVy60x6UCLmsUvJc9qDY&sig=AOD64_1R0BSAu0DhB5EfzyddoJi3y1TYfg&q&adurl&ved=2ahUKEwi_9dKx4d2FAxWDQvEDHQUFDKgQ0Qx6BAgEEAE

Resubmissions

25/04/2024, 16:22

240425-tvp11sce78 1

25/04/2024, 16:21

240425-ttpc4ace59 1

Analysis

max time kernel
76s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2024, 16:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChcSEwiUut-x4d2FAxV6D6IDHXkTCGQYABAAGgJsZQ&ae=2&gclid=Cj0KCQjw_qexBhCoARIsAFgBlesBUr0ZuVGBuM4CjxjK1wCccOqBLaGsHZzcBnc3QWzzGgSr_V-0d0QaAp9OEALw_wcB&ohost=www.google.com&cid=CAESVeD2ErrZQz7eE_OPZSOIw1ZFgLxZsG61LBT-XbnLstU_GWuEy8abP1P-ebl-DPQnOqg6aRs8Bi6gF4VA3TBOlhsK9iXxBu0lVy60x6UCLmsUvJc9qDY&sig=AOD64_1R0BSAu0DhB5EfzyddoJi3y1TYfg&q&adurl&ved=2ahUKEwi_9dKx4d2FAxWDQvEDHQUFDKgQ0Qx6BAgEEAE

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3360	msedge.exe
3360	msedge.exe
5496	identity_helper.exe
5496	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4884	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4884	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 3608	3360	msedge.exe	86
PID 3360 wrote to memory of 3608	3360	msedge.exe	86
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 2760	3360	msedge.exe	87
PID 3360 wrote to memory of 3924	3360	msedge.exe	88
PID 3360 wrote to memory of 3924	3360	msedge.exe	88
PID 3360 wrote to memory of 1276	3360	msedge.exe	89
PID 3360 wrote to memory of 1276	3360	msedge.exe	89
PID 3360 wrote to memory of 1276	3360	msedge.exe	89
PID 3360 wrote to memory of 1276	3360	msedge.exe	89
PID 3360 wrote to memory of 1276	3360	msedge.exe	89
PID 3360 wrote to memory of 1276	3360	msedge.exe	89
PID 3360 wrote to memory of 1276	3360	msedge.exe	89
PID 3360 wrote to memory of 1276	3360	msedge.exe	89
PID 3360 wrote to memory of 1276	3360	msedge.exe	89
PID 3360 wrote to memory of 1276	3360	msedge.exe	89
PID 3360 wrote to memory of 1276	3360	msedge.exe	89
PID 3360 wrote to memory of 1276	3360	msedge.exe	89
PID 3360 wrote to memory of 1276	3360	msedge.exe	89
PID 3360 wrote to memory of 1276	3360	msedge.exe	89
PID 3360 wrote to memory of 1276	3360	msedge.exe	89
PID 3360 wrote to memory of 1276	3360	msedge.exe	89
PID 3360 wrote to memory of 1276	3360	msedge.exe	89
PID 3360 wrote to memory of 1276	3360	msedge.exe	89
PID 3360 wrote to memory of 1276	3360	msedge.exe	89
PID 3360 wrote to memory of 1276	3360	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChcSEwiUut-x4d2FAxV6D6IDHXkTCGQYABAAGgJsZQ&ae=2&gclid=Cj0KCQjw_qexBhCoARIsAFgBlesBUr0ZuVGBuM4CjxjK1wCccOqBLaGsHZzcBnc3QWzzGgSr_V-0d0QaAp9OEALw_wcB&ohost=www.google.com&cid=CAESVeD2ErrZQz7eE_OPZSOIw1ZFgLxZsG61LBT-XbnLstU_GWuEy8abP1P-ebl-DPQnOqg6aRs8Bi6gF4VA3TBOlhsK9iXxBu0lVy60x6UCLmsUvJc9qDY&sig=AOD64_1R0BSAu0DhB5EfzyddoJi3y1TYfg&q&adurl&ved=2ahUKEwi_9dKx4d2FAxWDQvEDHQUFDKgQ0Qx6BAgEEAE
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3e3a46f8,0x7ffd3e3a4708,0x7ffd3e3a4718
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,16285687074938073000,18357743667958902632,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,16285687074938073000,18357743667958902632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,16285687074938073000,18357743667958902632,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16285687074938073000,18357743667958902632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16285687074938073000,18357743667958902632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16285687074938073000,18357743667958902632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16285687074938073000,18357743667958902632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16285687074938073000,18357743667958902632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16285687074938073000,18357743667958902632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16285687074938073000,18357743667958902632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,16285687074938073000,18357743667958902632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,16285687074938073000,18357743667958902632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16285687074938073000,18357743667958902632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16285687074938073000,18357743667958902632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16285687074938073000,18357743667958902632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16285687074938073000,18357743667958902632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16285687074938073000,18357743667958902632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2172,16285687074938073000,18357743667958902632,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16285687074938073000,18357743667958902632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3676

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4b0 0x4b4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
19KB

MD5
2857adf1a9605ffe485d8fc987dd9fed

SHA1
94e412468c687d6c43dbb9427cca3eabc23944c3

SHA256
bc7f037334953f85a56ab92753e4bc429815445ff54e727e9cb69ed097d5161f

SHA512
012e1b52dfdf8dc00633569ff161662133d37cca4df26cbbc273b0eb6cfe52c1054fc8d5036dca26d754fe21e014f5e978f334f4abb5b36e831182489272fe14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
19KB

MD5
d17d64e55067f5f164aa5dcab0e4eb6d

SHA1
e887b24c99ebf05cef7de818db18f17a82ccc612

SHA256
e010e5a62f6cfc598cbcbe4e0ba9b9f3aded1ae590bcc209cbb15027249cdea0

SHA512
72a77a0f04b05a29d40f9ce9ecc4aee1e74391d2ae632dfe4f192eeae7cb937a16a8dc38c2c0b060daaaf6916f7a32d2de6060aa485d2435583c40527d9496bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
be974156f679d8490cde9c84df36d715

SHA1
e5a22ca2d7d75d15f2f242a36de7223c5d7bbdf3

SHA256
d0524a5acfa61ad15cd34f8af906e2a266dd8d4d2330a40382199983a4f55517

SHA512
46f6bd5457e5ea4cc8ef83c0d2cdf4cd04fa97f3c0c6affabc0c102eaba37c5121289fa6c46975509f85d8a1ba4219058956f0be6bd50e82d12c8e2d776158d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
c1f9caf19384a7808fe577473c81589e

SHA1
c59a3791426968f59c21025681c36ee6057a9d37

SHA256
b66d66ea6879ef823355100bbda7b2685a48f2363406b5a971a11186ae842e20

SHA512
0a57cfdf2b3e344ef76289ce9a5438041c71f65905b8312dbf7b58a9aefd363291dd854c91df1190a8e3ca456a396a9def0432cc3f652d8a5442a5dcfaaabcf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1b21bd567bfb647b64c3abf29bb2f966

SHA1
b4059d85c88f7ff34adec070389ef26658ee32dd

SHA256
464969d01e90b201c0328c29db4469611668fbeb5d09290c0e5980fd148de63d

SHA512
8313596b7672f3cbb4d9cd28b8e12caef9f6d11783d4a05ccd5a1a9a0e4bb18a8ba9ae697a08694116f2ef9215e4260e5eb0993c734db059cdd1044ab26cd737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7ae00e19517e9e53fedc6d2253180ab3

SHA1
7c31448f1ec14fc3683474f3540c8380e18a5d23

SHA256
9fc9ac03b83608701b5a60cbb7ba8902d67f7c495f1caab4e2d4e0cb45e6ec3f

SHA512
4a89b71e8a9b5739860f24fc08600585b9308bab092dd2eb0b8ef83c6d3a5274f7c849e3b26849aee322b0ba7823842ce9c5bae18f76de9630637dc3d2f8ba72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
17418b925d990d5f08da86a497412b15

SHA1
6b73a360a505807269d6508dd2eb5c3e7fd9c143

SHA256
72d2e5ecbc1aa49f200af7d595ccff5028b00617fe6afabac0f3fe9c323b28fb

SHA512
f6958d81cc50e95e64a45983d6d558db3c6837b14399cf588aa5f41ffda2eb6c90475b4d22580cf59aa10fae7dbc326b114fed480e638d48702d6c2f6985a61b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f0697f46d4f602c964c54011c6b45223

SHA1
b0e62dd2a6486d214a72aaadc6ef06355df5020d

SHA256
9cf324a2f15fd2758a00b58e0102bef6f0833ec5a0618d653c40417885279ad7

SHA512
f3b9dd5592a5d033fc3a64d8caad97d280a08938ea53f75602c9dfed35b2e27ec007f48168ea5c579c963b109f6de3d5cba3318dff758769b3e53b399b0ae98a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
417b9adaf371ec0f61f5be77fe7694f1

SHA1
4749f6c2d3a98117370b33173da1660f5aea107d

SHA256
cc177c0c9fe510fc527dec29ad4ba9c5e3785d139d8210835d933fa024444a6e

SHA512
e9ca6dd8b9cedd856e33e7ab45cbbdd648e9a5610745edec077780711d863eb45db6a0a9f9a8c46080d81b3375e7da191a8bad6a9dc990f8f7c4a96d893fedd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5881fc.TMP

Filesize
538B

MD5
119455bc107a70e8399f58d7aaeae19a

SHA1
5a93465e3b2682e619a325068feb63fa3ed10464

SHA256
5e683ef150600b3cddc2f6119ad83787c0ed9bf6ddf949fee17cf8ca20f8f218

SHA512
652f2ecefcc72562f55b670f7cf9a842c675d23f2997a377de1e7c7523e4a1b67ccae1a2fd31b21414f9fc2612fb059ec60f9713b105b7531696dce9e5c2f780

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
76afe888a0c579171af159f87e825016

SHA1
c450a5246f5b641ebdf58b489ace41bd427e9f55

SHA256
672942e42a442e5d5d4ed5cb557567e49b223b703fe0f9f0a7d086da9fe3b59f

SHA512
45d60e9ffabcefdd5cbfa3cd34adc588496017495c4493d64de61c39dcf94e0aa3bf00b5f7f6dc95ad8965c9c6b9aaecce650329b4e0a5e132a6e85d98b3bebd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit