a4e631f8f1a670d50a0a4c9ef514c45f253b01d5d19e68f48f4129df1b4271e7

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
01/06/2024, 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

1.5MB
MD5

25c68904b4ffd3ef0e85f67c31bdec46
SHA1

d4dacf87dbd8aaec1af74f4025360cfaa9922052
SHA256

a4e631f8f1a670d50a0a4c9ef514c45f253b01d5d19e68f48f4129df1b4271e7
SHA512

d30ee8337fb75bcac1042049efa6d05a6d813dd9b8d20bbdb11bd2f183b38740c4200bac249d3676ebc61efdaaf628dd3e6078b146f054e3dbf2c5177db5c7f5
SSDEEP

6144:pt1+ZcLJnJdUXPx0IFT3YskB5H5883ZRilEP+oHf8Sudms0X3Ekln85RL9Asns/0:ko3d6OIFT3Y7jHLilEP+peTCLP/7D

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3000	msedge.exe
3000	msedge.exe
2844	identity_helper.exe
2844	identity_helper.exe
1136	msedge.exe
1136	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4988	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 4088	3000	msedge.exe	78
PID 3000 wrote to memory of 4088	3000	msedge.exe	78
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 4892	3000	msedge.exe	79
PID 3000 wrote to memory of 3040	3000	msedge.exe	80
PID 3000 wrote to memory of 3040	3000	msedge.exe	80
PID 3000 wrote to memory of 712	3000	msedge.exe	81
PID 3000 wrote to memory of 712	3000	msedge.exe	81
PID 3000 wrote to memory of 712	3000	msedge.exe	81
PID 3000 wrote to memory of 712	3000	msedge.exe	81
PID 3000 wrote to memory of 712	3000	msedge.exe	81
PID 3000 wrote to memory of 712	3000	msedge.exe	81
PID 3000 wrote to memory of 712	3000	msedge.exe	81
PID 3000 wrote to memory of 712	3000	msedge.exe	81
PID 3000 wrote to memory of 712	3000	msedge.exe	81
PID 3000 wrote to memory of 712	3000	msedge.exe	81
PID 3000 wrote to memory of 712	3000	msedge.exe	81
PID 3000 wrote to memory of 712	3000	msedge.exe	81
PID 3000 wrote to memory of 712	3000	msedge.exe	81
PID 3000 wrote to memory of 712	3000	msedge.exe	81
PID 3000 wrote to memory of 712	3000	msedge.exe	81
PID 3000 wrote to memory of 712	3000	msedge.exe	81
PID 3000 wrote to memory of 712	3000	msedge.exe	81
PID 3000 wrote to memory of 712	3000	msedge.exe	81
PID 3000 wrote to memory of 712	3000	msedge.exe	81
PID 3000 wrote to memory of 712	3000	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xa0,0x10c,0x7ff80d903cb8,0x7ff80d903cc8,0x7ff80d903cd8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,8317869358229091406,15830883441401359974,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,8317869358229091406,15830883441401359974,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,8317869358229091406,15830883441401359974,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,8317869358229091406,15830883441401359974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,8317869358229091406,15830883441401359974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,8317869358229091406,15830883441401359974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,8317869358229091406,15830883441401359974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,8317869358229091406,15830883441401359974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,8317869358229091406,15830883441401359974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,8317869358229091406,15830883441401359974,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,8317869358229091406,15830883441401359974,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,8317869358229091406,15830883441401359974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,8317869358229091406,15830883441401359974,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,8317869358229091406,15830883441401359974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1756 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,8317869358229091406,15830883441401359974,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2640 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,8317869358229091406,15830883441401359974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,8317869358229091406,15830883441401359974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1744 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,8317869358229091406,15830883441401359974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1756 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,8317869358229091406,15830883441401359974,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6752 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4776

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ade01a8cdbbf61f66497f88012a684d1

SHA1
9ff2e8985d9a101a77c85b37c4ac9d4df2525a1f

SHA256
f49e20af78caf0d737f6dbcfc5cc32701a35eb092b3f0ab24cf339604cb049b5

SHA512
fa024bd58e63402b06503679a396b8b4b1bc67dc041d473785957f56f7d972317ec8560827c8008989d2754b90e23fc984a85ed7496f05cb4edc2d8000ae622b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d0f84c55517d34a91f12cccf1d3af583

SHA1
52bd01e6ab1037d31106f8bf6e2552617c201cea

SHA256
9a24c67c3ec89f5cf8810eba1fdefc7775044c71ed78a8eb51c8d2225ad1bc4c

SHA512
94764fe7f6d8c182beec398fa8c3a1948d706ab63121b8c9f933eef50172c506a1fd015172b7b6bac898ecbfd33e00a4a0758b1c8f2f4534794c39f076cd6171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
19KB

MD5
0f0c9989cbb18447d2f5d954c20ed99f

SHA1
9ad0fd560c0c478c67cc8f118e363b3a1d1cdb5a

SHA256
a43a9e5bbd2d8a8aed070df3b2c799afe064312d6f248c4a498a67c0f9a02720

SHA512
ad6a2c60d3e5aab48497169e380d0fa50d7a0fd2bfa0a07313d880afaafd2ff2be7521864ab7ec661866b1ee4309467ef2733a24dba7e0facde8d190739d9fa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
32KB

MD5
0ca678222114585bc701a81128e81da5

SHA1
7153ab703cebe63231f07951ee322af357b30d0c

SHA256
d9899ffd6d9533dd3c0c34f02c7ec9f36c0463e0b9386185b0fd0fc5a6247997

SHA512
173f744c73f5dc6578dde2a593a0b66688b9c90e2ae066fcbc75f8c080378cfb4c863047cc36785250e788bf08b77efaaef02b56c1a4a8874fef8654b16c4f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
24a07e81ff927b17c6b7ad0d3801f410

SHA1
ccfe574904af794fc9ed6601fecda2473f7f5fbb

SHA256
aaa4650cd7d93f1a7184d2920dcdcafac5f9c5f74b46085bc8c5afff1afede14

SHA512
c4dc5098523beb2ed8482dfbe27dea975510c02948ad48693c52754c39f4792aed063f84bdafd0a8b98346be97f31d6251d89729208fca0ed6afe0fd011b0fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d4e0ffd5260b206c2732bf065fa94609

SHA1
e70c113afdd142e97f3f3425eed9013fa8cf7feb

SHA256
dd25d71689861f33f9af8d8cfa9d652c8dc26544b001ddbb72afba1d8d1bdbbe

SHA512
6cea62988962c71beae582d83cf9f3e1cd3875e67c049762b2cd16702d16c3a21fb321cb096edef7e64a94e9ad2ef764904bffbc7ad9f6d97c4ab96d086b74b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ac98c0c6efeebb1c817d46c366766c54

SHA1
6caa60b5fedb5d0bd13e786f547346d13c9daa0b

SHA256
187e3621e838a45ab68143c8a7227ca73aefc60853e2dedbab57aed3878aeee8

SHA512
63ac96cd30435f4af129bdba234542fa83085b0e5565f93a41c470dfce84460748786c8335797aa053d9f5e75a6204750f8764732d927ad497493771cd35c9ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
6070e84b12d451bbd0ed0c5f54a1679d

SHA1
e3cf567c08e3df61b6113f609449b8a78fe26359

SHA256
b3c180c55371abc15299ff6a270dbda356ce88de33215e9b204ce0e248bd50b3

SHA512
577bf9cd9eab6ba5a12b52d350d4deb99a8ac68518ee2f0a11928dc3569ffd54be68a8bb515aa26f97a1f091642e9e0994c59dfb0915a554cdf3edc29c26fdd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bfbc8914cc3461e631728f551cbbf1bb

SHA1
f85170f415cfbf78b469abebc7b2aff13a7a1b53

SHA256
a8f65226d71de003fb4697994e9f8f3c535aca91f30ae26e7c4371d9cc47223c

SHA512
51f62287cdbd428f39129783f6461a665db495c3165532c6ce1c595841d6fd6dbb8d07b448c005005aacdf85e0f90acee8608761db77a07f5ac6044aefa559b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c7a78da41b5b3a3fd01c1256792e40ab

SHA1
4e1642036949b5a71be79c1013688d97f5aab3fb

SHA256
3ecb0a17198b29c835ad026206846a522990e226e5ab6ad5ce716bc2ed96036c

SHA512
802b37322571a289193968e13777f2eaf8fd6c4714feb221514237e49845ad24176402c488d2ae4c6915e707720a044e8243a871b7ffcef544ba05a8a4a30b92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f9a349622323e81a6e69184b5e9a9b15

SHA1
1b6c67f01251d8f83fd956ef0ea75568c7cb51f9

SHA256
43bce8aecc17f0c9d273017c38f4fccb2d93a456e10f77164d486172ce722090

SHA512
21882a717227a08e7945662c3ee66e51fbe4f3104aff4a49f586ed2dd215d8f90fb4d9bbf96f6ffa8226f3b651b2d06dfff1ad8f55802e0ee84d70f7279154ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3c9a84daa40a95c17066cbed55515cfa

SHA1
0862624c2724371681057761ee290705428b9cb4

SHA256
5b081024c0412dfc7b2d08dea259123bff14a7fe5bbb2aca6418897d8bf70fbb

SHA512
f58757f87f837e7a52ca495dba3131aa1d7e9a3471aad189adce09bc48f0cb5d18365e12950161967f79f3faf779aff8aa5aa111f01eba393ad2a96b56b55ce4

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
18951ad4190ed728ba23e932e0c6e0db

SHA1
fa2d16fcbc3defd07cb8f21d8ea4793a21f261f0

SHA256
66607b009c345a8e70fc1e58ab8a13bbea0e370c8d75f16d2cce5b876a748915

SHA512
a67237089efa8615747bdc6cfe0afc977dc54cfd624a8d2e5124a441c204f1ec58ee7cfbbc105ddc2c18d4f254b9e124d71630bcdba0253d41a96890104f2fff

Download Submit