hxxps://search[.]app/aYh16YDCnjwz1jHLA

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://search.app/aYh16YDCnjwz1jHLA

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1872	msedge.exe
1872	msedge.exe
2764	msedge.exe
2764	msedge.exe
5388	identity_helper.exe
5388	identity_helper.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 4488	2764	msedge.exe	80
PID 2764 wrote to memory of 4488	2764	msedge.exe	80
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 2108	2764	msedge.exe	81
PID 2764 wrote to memory of 1872	2764	msedge.exe	82
PID 2764 wrote to memory of 1872	2764	msedge.exe	82
PID 2764 wrote to memory of 4640	2764	msedge.exe	83
PID 2764 wrote to memory of 4640	2764	msedge.exe	83
PID 2764 wrote to memory of 4640	2764	msedge.exe	83
PID 2764 wrote to memory of 4640	2764	msedge.exe	83
PID 2764 wrote to memory of 4640	2764	msedge.exe	83
PID 2764 wrote to memory of 4640	2764	msedge.exe	83
PID 2764 wrote to memory of 4640	2764	msedge.exe	83
PID 2764 wrote to memory of 4640	2764	msedge.exe	83
PID 2764 wrote to memory of 4640	2764	msedge.exe	83
PID 2764 wrote to memory of 4640	2764	msedge.exe	83
PID 2764 wrote to memory of 4640	2764	msedge.exe	83
PID 2764 wrote to memory of 4640	2764	msedge.exe	83
PID 2764 wrote to memory of 4640	2764	msedge.exe	83
PID 2764 wrote to memory of 4640	2764	msedge.exe	83
PID 2764 wrote to memory of 4640	2764	msedge.exe	83
PID 2764 wrote to memory of 4640	2764	msedge.exe	83
PID 2764 wrote to memory of 4640	2764	msedge.exe	83
PID 2764 wrote to memory of 4640	2764	msedge.exe	83
PID 2764 wrote to memory of 4640	2764	msedge.exe	83
PID 2764 wrote to memory of 4640	2764	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://search.app/aYh16YDCnjwz1jHLA
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb44b146f8,0x7ffb44b14708,0x7ffb44b14718
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,1405482269449041484,11842508362689651484,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,1405482269449041484,11842508362689651484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,1405482269449041484,11842508362689651484,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1405482269449041484,11842508362689651484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1405482269449041484,11842508362689651484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1405482269449041484,11842508362689651484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1405482269449041484,11842508362689651484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1405482269449041484,11842508362689651484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1405482269449041484,11842508362689651484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1405482269449041484,11842508362689651484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1405482269449041484,11842508362689651484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1405482269449041484,11842508362689651484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2016,1405482269449041484,11842508362689651484,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1405482269449041484,11842508362689651484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,1405482269449041484,11842508362689651484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7300 /prefetch:8
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,1405482269449041484,11842508362689651484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1405482269449041484,11842508362689651484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1405482269449041484,11842508362689651484,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1405482269449041484,11842508362689651484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7576 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1405482269449041484,11842508362689651484,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,1405482269449041484,11842508362689651484,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2528

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a0 0x498
1⤵
PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
d3764acd6dc76ecfb1dda987d85cfe8d

SHA1
c6b2503b24e955e658d72f7c370b01e5320bbde9

SHA256
8f494300893f87ac07ebcc6acab19c649524bd7783f6b1fa9c223c5a5ad0c203

SHA512
9cc325dce74b713c80ec8ca74ba681a415b287cb8cacde030dc13dab665a48ce9fb4ae9d6367eb42df41245020a4c5c5413567c315cd3ad970a2f2d51582e928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
64KB

MD5
e9d809a1d7fd30047317fbd43fae61e9

SHA1
f787ab2f19856948bd9ea7aae25f45b2a8d08d8e

SHA256
0ba8c1a3ea7999dc49680abfe030219c514214972d20197ccf7def509471b72d

SHA512
e91109af437dfb88f8f97df5795a25e4efaf1a2fcf9ffff8410f19a815bcf80f62e21fe9d5de7e5b6df5e983eef8393c806e5df48353547a02b81c0780fefc50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
3bca7343ba253d78ae7f2a8fecbe01ba

SHA1
9bf1a72aff8d57fd06a49634d2c24e2e7a43d360

SHA256
dac90b5255ad8b5c012e4e847301083ce85b175b0385aba8e6e33028b17c342f

SHA512
5bde984b8708a439dbadcb456b52f1dafe88f016dfc113f9edffb49c33a2453e1d5573cdba15b759c51f0c43bf5493f94b78d9ed8b75b9c4c0ec3ecd7ed85628

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
2958e63305b01a8bd0364cc034e3207b

SHA1
22ac953eeceee831b508baaddfedb5484ab25cae

SHA256
e50d659e52f128b14890038f3720470d32caf8c3bd8d01341775a61b40b27ec3

SHA512
f39825dd25610884a51af64fa142d9026bce34b159021049197db95b48030853db816ed8ae53ee838ada902133edb7d5dd630e363bdd0514382e4f1797f994bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
ab655d22ac27ed65f3eaedbd88995eb2

SHA1
b01ecfbb88d375d748b3bafbef3301b179ad6ed4

SHA256
0b47e78fcabae2e9a0ebb3fb3b9c42075b56e105ee60bc6ce2b45437972fa4df

SHA512
54575ba8103fff35e668fa18cd12e3403641cbf5d731a74683679d263f9f914601a3ab045b9cc78f4447546aab5dbf9ac4375ba1f576b39b1ba6c4fd1d963dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
645a08ac2b617639692ea8e18991c5c7

SHA1
1fa188c4eab4ee1be438aff340f02fd264d24355

SHA256
0709d46c74ea76c5d55f104e466ad43139edd628b80fbb976f8337c696954d99

SHA512
a2cb285187267758c3b0188601cd9a7f22464bc15ba79a4ab3a050c59abcfbd2597c7bb3bba97da683cd499f5792549ca471ef95df0c94c3915b7230606247c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e346a543de61befd6b255ab4bbff6c38

SHA1
90690634384177b1605c95bb258d25742f560c4b

SHA256
e210402465a10ab3aa0d8f66dfdd08adb5c665f8005bf1682718a45186ac246d

SHA512
c17debb481f18e36fea8f24d7035ac4aaf11777d1bb8ee47b5504fae31c0a36a2c925c0b6ea9186228a9f660bbcf4e6e3e6ba01d3ea5c7b7ebed6a0f18a135c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58212f.TMP

Filesize
1KB

MD5
ecc74b3e4d0dff62e760db2253831dab

SHA1
e231988adb2902a811552dd170d39438b4380cda

SHA256
478ff397e04d2ad5f3c8c005677803e0090b6066a0a80d98791f58a60fb7d255

SHA512
6258c4cf4fea116b6fd45d7d2d52814274b2c607778d39f0b8bf0a48169a83e8e671af20d724f806ffcacebede02977bd5fd470d977ea1c4c9ce3202e1915972

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cb68bd963df490515c1d09614ad8e8c9

SHA1
4d4710a11cebc36bdb9b2bdd242dd42d0082b401

SHA256
a669f1a1db9b1080581b166c6c5fb4e8f46d61ae4d6fffff3f513bcb665f51d6

SHA512
60d29fd6bb0c27b0480d66820b61578f055d848bb6e401e948cbb2819718b00d405502b792ac50409822c431b6a2b4be06399604b7bef3a585391c98314153ad

Download Submit