badf7be152d16ad7fc2e87e5834e3e9be4357dc2e9743866ecc8672f3b18576e

max time kernel
504s
max time network
502s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
28-04-2024 22:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

code.js
Size

4KB
MD5

a0958eec5d861c11e857b83f1a6f7701
SHA1

fc9803b3dde18a1467af040266d5e02c5f798ada
SHA256

badf7be152d16ad7fc2e87e5834e3e9be4357dc2e9743866ecc8672f3b18576e
SHA512

55af1f39a75d8c41a3993c8afcbd52565eb6ffbd6997d8093000700d931e6dd647dbcb6bfaabda766ea64a9a37e6bf092df46cbb16ffe1e02291fd0624f12fa4
SSDEEP

48:Eyu9yvCnwdZd8ZaiSOxj8WmJrT0fMuyHD0KQxgeqYk93GkUs++5ZLUIZL5RKS7d:3uMCnwjpiFmJrTHD0KQ41U7IZLr7d

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4128	msedge.exe
4128	msedge.exe
412	identity_helper.exe
412	identity_helper.exe
2408	msedge.exe
2408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2052	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 2436	4128	msedge.exe	87
PID 4128 wrote to memory of 2436	4128	msedge.exe	87
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 2392	4128	msedge.exe	88
PID 4128 wrote to memory of 4304	4128	msedge.exe	89
PID 4128 wrote to memory of 4304	4128	msedge.exe	89
PID 4128 wrote to memory of 2164	4128	msedge.exe	90
PID 4128 wrote to memory of 2164	4128	msedge.exe	90
PID 4128 wrote to memory of 2164	4128	msedge.exe	90
PID 4128 wrote to memory of 2164	4128	msedge.exe	90
PID 4128 wrote to memory of 2164	4128	msedge.exe	90
PID 4128 wrote to memory of 2164	4128	msedge.exe	90
PID 4128 wrote to memory of 2164	4128	msedge.exe	90
PID 4128 wrote to memory of 2164	4128	msedge.exe	90
PID 4128 wrote to memory of 2164	4128	msedge.exe	90
PID 4128 wrote to memory of 2164	4128	msedge.exe	90
PID 4128 wrote to memory of 2164	4128	msedge.exe	90
PID 4128 wrote to memory of 2164	4128	msedge.exe	90
PID 4128 wrote to memory of 2164	4128	msedge.exe	90
PID 4128 wrote to memory of 2164	4128	msedge.exe	90
PID 4128 wrote to memory of 2164	4128	msedge.exe	90
PID 4128 wrote to memory of 2164	4128	msedge.exe	90
PID 4128 wrote to memory of 2164	4128	msedge.exe	90
PID 4128 wrote to memory of 2164	4128	msedge.exe	90
PID 4128 wrote to memory of 2164	4128	msedge.exe	90
PID 4128 wrote to memory of 2164	4128	msedge.exe	90

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\code.js
1⤵
PID:1176

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc90793cb8,0x7ffc90793cc8,0x7ffc90793cd8
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,8501958945017294379,23438554218354168,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,8501958945017294379,23438554218354168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,8501958945017294379,23438554218354168,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8501958945017294379,23438554218354168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8501958945017294379,23438554218354168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8501958945017294379,23438554218354168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2396 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8501958945017294379,23438554218354168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,8501958945017294379,23438554218354168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,8501958945017294379,23438554218354168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8501958945017294379,23438554218354168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8501958945017294379,23438554218354168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8501958945017294379,23438554218354168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8501958945017294379,23438554218354168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8501958945017294379,23438554218354168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8501958945017294379,23438554218354168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8501958945017294379,23438554218354168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8501958945017294379,23438554218354168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8501958945017294379,23438554218354168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8501958945017294379,23438554218354168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:4324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
22cececc69be16a1c696b62b4e66f90e

SHA1
b20b7f87f8bc64c1008b06a6528fc9c9da449c2f

SHA256
d940b85bc83f69e8370a801951eb6b8bb97efbb3aa427664105db76e44707258

SHA512
2b2e548f2c8f84d321ef2afdf31128065c3593b884ca8111b05800960b5378b99c7efa6165d02fba4c11e6e4b49b14e419d89f76d55ef574f4ac2b7d6ecb3d48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a85ad170d758e61ae5648c9402be224

SHA1
e6dfce354b5e9719bc4b28a24bb8241fc433e16f

SHA256
af0da8b5ad8127ae0ef7773bc9c4b145ed3fe7fbef4c48278649e1e3aa5ce617

SHA512
641414d91c993f74b6b71654522359d606c7f94ac0fcca6478d1bc33c30f4a9fdb9ce6f8e281c79a2f9b9670fda8a4ccdd80e7d64347c1f66d8c9ef024bcb09b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ff1f9804ca953189ab034c31f7af1f75

SHA1
e7bfa38bdc77082bfe2d76760d775ec4fb78654f

SHA256
2a17dc783368a3b4a78390868e7870adaed727e9f3b2e8af15ebc0fe4c247c5d

SHA512
650c3b86c004e327f545cdc3c5971625180b8012c9c7975544e598d57a06a7fce45f9c079211e855018f7c083faafa65ddab1a8fa397d275c8bc344da711114a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
55a504f343a762a073da2ca16a9665a2

SHA1
e686a64cdbf87c6fa3ce2180d11907231c609c69

SHA256
ec1763dd73a914874162dfc707d2d0da7744c5e944693e305b35d779d6fedee6

SHA512
ee802b5e21aeb5aa9cbf229e1ba1bee2ddd3f8aa9ed4b5bc05dc3563b1725b21674590a36eb1b9b0d817bc7f5683be2ffb168b8ab867c30b48eb2cba0454aa39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
02f9de29093ac4291ce59dec29974f0d

SHA1
b198c0a58e0f8f6e08a89bd9662ed98497a74753

SHA256
c03018d607026712f25ad2f31bb676d07a6da5239973790e2a2b12fdd6652bdd

SHA512
1ea3bfc790d36e7968447e90c3584d0c9f24a652517e417296a7eaf78d6db7a985a6b1a1f1e2aae8755817381e74d362edc5c367833c056ecd66a9568aee7a2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
8bc7309bbe75224489f587f670ffa552

SHA1
379f371b457b9f4c9b6e58a1103b05a328843c69

SHA256
1f14d07b50d13bee2bfc4af31cd743ee07f92229befbb5da36652339c1181091

SHA512
914746ff48d595cf400300df1759409e3d55682be2e8766eb98767cf9ee48611423e1a554f02a79eeb8029a7a393ecf1b07ee42e1bf727f10ee9a81aa769326f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
ad381c48c7a48381aba5760783d054db

SHA1
a7866ddef4228e490eedfe6c553b63a4c93951fd

SHA256
6569238fba147b9303c3d049748e2b887852f41eb6970669d3ff82afe07d46ba

SHA512
c8dcaa1b8494ce6ea3e9ab43f47761da42f27534643680df532034a29a6075f3b2a640140a816a766aaa86e3c68d55cb3d9c66b255a8cd8039bbe2ff45fc749a

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
188e513ebbdb02e7447e280fcf7c004a

SHA1
5f355f09d4d47dd56eb1b661dd84acc22538597d

SHA256
191198b73d7476d1efb0c6b961de29a5c94f718542252a50677563495bddf82e

SHA512
b7a6544550ab316ad8e6aab7028a89fe8fd5fdfae3fed5862adc0a220a48794b00be28365d94fb5d11e914e6a27b14988ffe41411961bb54e9e35878109008e8

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
ca2881aff2401ea7b92a8dd8fa880aef

SHA1
9f64205bcecde6eaafdb61e50b4e95eb6e98b78d

SHA256
e006e798ac0006c1c0df12ff278fc0c7662cefb13785efc1f664573a1493cb25

SHA512
09a3d5a2fac0f3d65b1b1ecb4f295131b6e79f6eccbd20924d1361e39636d5cf7b09dedf3874013d80696947e999eb29be04bb9f90722235e450b0b419b12df8

Download Submit