23c75e988d1579ade684b8fc3e9ebea0f2d62b955d190c974c4a47112681048a

max time kernel
36s
max time network
37s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
01-07-2024 14:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

493KB
MD5

937cffd4aed2741d390f12cdaceedfe6
SHA1

6e4053037c6fb57b01fb8aadd59f1b4bab4413dd
SHA256

23c75e988d1579ade684b8fc3e9ebea0f2d62b955d190c974c4a47112681048a
SHA512

8296f202f1538be8425c725e8be4816e692aaec686c89b525c67d2911c4da968047676f3801bed62f7bd95f54d258d775ef42dfa54d93978981c5a4a4e58d444
SSDEEP

6144:5DoAwoAwKAwtAwoAwtAw5AwBAw+AwMAwpbQ:5EArADAEALA8AUAaAFAJA2bQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
5076	msedge.exe
5076	msedge.exe
3512	msedge.exe
3512	msedge.exe
1444	msedge.exe
1444	msedge.exe
3464	msedge.exe
3464	msedge.exe
3680	identity_helper.exe
3680	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 4760	5076	msedge.exe	77
PID 5076 wrote to memory of 4760	5076	msedge.exe	77
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 2112	5076	msedge.exe	78
PID 5076 wrote to memory of 4848	5076	msedge.exe	79
PID 5076 wrote to memory of 4848	5076	msedge.exe	79
PID 5076 wrote to memory of 4288	5076	msedge.exe	80
PID 5076 wrote to memory of 4288	5076	msedge.exe	80
PID 5076 wrote to memory of 4288	5076	msedge.exe	80
PID 5076 wrote to memory of 4288	5076	msedge.exe	80
PID 5076 wrote to memory of 4288	5076	msedge.exe	80
PID 5076 wrote to memory of 4288	5076	msedge.exe	80
PID 5076 wrote to memory of 4288	5076	msedge.exe	80
PID 5076 wrote to memory of 4288	5076	msedge.exe	80
PID 5076 wrote to memory of 4288	5076	msedge.exe	80
PID 5076 wrote to memory of 4288	5076	msedge.exe	80
PID 5076 wrote to memory of 4288	5076	msedge.exe	80
PID 5076 wrote to memory of 4288	5076	msedge.exe	80
PID 5076 wrote to memory of 4288	5076	msedge.exe	80
PID 5076 wrote to memory of 4288	5076	msedge.exe	80
PID 5076 wrote to memory of 4288	5076	msedge.exe	80
PID 5076 wrote to memory of 4288	5076	msedge.exe	80
PID 5076 wrote to memory of 4288	5076	msedge.exe	80
PID 5076 wrote to memory of 4288	5076	msedge.exe	80
PID 5076 wrote to memory of 4288	5076	msedge.exe	80
PID 5076 wrote to memory of 4288	5076	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd156c3cb8,0x7ffd156c3cc8,0x7ffd156c3cd8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,8105361762210710540,2953989176770277288,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,8105361762210710540,2953989176770277288,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,8105361762210710540,2953989176770277288,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,8105361762210710540,2953989176770277288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,8105361762210710540,2953989176770277288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:1972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd156c3cb8,0x7ffd156c3cc8,0x7ffd156c3cd8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,14821576601771615592,12829473867110849688,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,14821576601771615592,12829473867110849688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,14821576601771615592,12829473867110849688,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14821576601771615592,12829473867110849688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14821576601771615592,12829473867110849688,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14821576601771615592,12829473867110849688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14821576601771615592,12829473867110849688,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,14821576601771615592,12829473867110849688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14821576601771615592,12829473867110849688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,14821576601771615592,12829473867110849688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14821576601771615592,12829473867110849688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14821576601771615592,12829473867110849688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:1544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdede74f2de03b7255379e4bc671373e

SHA1
02cd96196233066ff4256737b2b17c021503647a

SHA256
22c12608f11bb39f06d1db0e9a5b70ab8b4ec151e27738453fcdab4c3cba86a9

SHA512
45967c83508caacbf52e1ac62656ef3093749c92cbf50529429062464a055202d187c42c4c1404ad93f150c3be37b520b36cc57a4032c5c812a82c5e139d04ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0d84d1490aa9f725b68407eab8f0030e

SHA1
83964574467b7422e160af34ef024d1821d6d1c3

SHA256
40c09bb0248add089873d1117aadefb46c1b4e23241ba4621f707312de9c829e

SHA512
f84552335ff96b5b4841ec26e222c24af79b6d0271d27ad05a9dfcee254a7b9e9019e7fac0def1245a74754fae81f7126499bf1001615073284052aaa949fa00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0c705388d79c00418e5c1751159353e3

SHA1
aaeafebce5483626ef82813d286511c1f353f861

SHA256
697bd270be634688c48210bee7c5111d7897fd71a6af0bbb2141cefd2f8e4a4d

SHA512
c1614e79650ab9822c4e175ba528ea4efadc7a6313204e4e69b4a9bd06327fb92f56fba95f2595885b1604ca8d8f6b282ab542988995c674d89901da2bc4186f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
9bd7860f5b1e45b8eaa6a53ae69b7800

SHA1
5bb1989c2fc1b64b68caaddfe2351fbd8cf99b6b

SHA256
8367b0b0ba59cbd3c2e8702d8b2c4b2558de96322330695092f16cdf1f2e8227

SHA512
db81f2ee4b09ffe0be8ba8fe44861cfc81906e2f2d613f688b78c134c6e84e2029d18f686531b97937b29330aa1a1d6c21dcbe46595e16a5526a84bcb1e6497a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
846a19e31dc9edfa9c0a5e47186fb7af

SHA1
53adab58f4b21d6c686c47f683aa214c1f9f04d1

SHA256
0d72310cb6f5f848ae862fb878dcd4ebdb01b45fafe38cf0acd8a781000d26b3

SHA512
90de9e31f3227b51397347e3956a67b861a2c46f5cd04d35cbab2e6e6d399fa181d30bdf3e0cbe8fb0376e1511a7f445f39cd476f4b68958537ac152392a01d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
4ea0580bca70fddc923f2c3a6fbaa3f8

SHA1
f992b7dfdb51bcf6382384eb9bbb6ac5e5addbf7

SHA256
12af68e6edd4e235d397592d6aa1eab96d025c1ce536955ba10f64e8698c8a23

SHA512
4cafc95da606d843c632d70f48dbefabf3133c5e6124dada9f9ec7f00947a34314f84da089eeab216f634eb66d068279e2503976af8e128783bd3962f0c8ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
599B

MD5
9ac1bfda3b9d8abfbfa0bde1abae7fc2

SHA1
beb734e0f8ef722eae3bf029bda7c03ad061e291

SHA256
5bc6cadc0d7a89625fe4376c5ee79b5be700f6e534c0eb1b3e8f1d0088f62602

SHA512
92cab82e433e497ce3be6917b19e9bd9a60102b5d10eedb095629a02a50c83cce0e715829842ffe94b8675e28a0dec949e607dbd96fa6343d10e4d96c588edcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
1a841b05e4338ff382f90d403340f95a

SHA1
90f3b1cecd1c8fb65cc3c6596056dbb8f21cedb3

SHA256
506f9ee8a4bed7941f65e1c6154f0640d8b4b30a224c5308a3549722bf0ee2f4

SHA512
7f8d4619e0d98a602b8d45bee16b258da5e2e64f37bee6cde7f1db3e914d3c90da9d85f9bf4c3002bbeddf6a49868c518592218f40dd56be4a8fef941099896a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
48b1168cbdbdfb6c07b34040c745fc25

SHA1
87d303713a310dd88aa25799b3e9c35e918aa6ac

SHA256
ad23407790badc1a39396b62bac4f9a517cd00771b6503279a0e9996d934c8cc

SHA512
5113bb9fa05f84342406927c40eadd32c6876ae33b5cce3aa42bc81e9acc5bcc0073c1f0c2cf6cb66ac5a4763b4cadcf183ea60bf2738e38c86e6e8676787b44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
96bb96fc005f07957538ee41934a54a3

SHA1
3be131603736d6590cd281ec2c24177266931f03

SHA256
a5161d780369d2c62a8a6d5b2536dce915157c45908bd5a556f9ecfa4bcced39

SHA512
acfcbb2934c1beb69b25424ff9817fee1709e749c4051f1655d896d968807ac8ec8a74797da7f4b19355622ea8931d439f95ef6c53377aa286027532966d0c8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
eeddfb2486fe6b9d4827f5f73fa2dbaf

SHA1
54680e6ca3a371050a92781bada21e85637bf50a

SHA256
a8a316feb561f2bbfe62517a0393dda4dca4ac5a0ea8c0e1af3785a387e6890b

SHA512
daab2c305dc974b9fcf8a140fa049a45ac781efb51405ed8ffde5020f6a3859387bc06e02aec280f2d03ad85a1c1c035ca8363bc1c8baf33fd2646272145248f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3f66a1c93b85df4dafd50e2ba51b0250

SHA1
9b197766cec181d2dcdf7bdc2156abd67a48ab20

SHA256
641e37bbb0f63666a057615bd7860d1bf3ea329f31556a90b66604811e25e2fe

SHA512
0f1b865a489604c5e7e45435b3bce74c13ff8f6283bc249f225badea0051d261bef0f972fab37c0ec9eac479c05da884a1f0f631e48d6f0a29e06aecc079fef5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
137B

MD5
a62d3a19ae8455b16223d3ead5300936

SHA1
c0c3083c7f5f7a6b41f440244a8226f96b300343

SHA256
c72428d5b415719c73b6a102e60aaa6ad94bdc9273ca9950e637a91b3106514e

SHA512
f3fc16fc45c8559c34ceba61739edd3facbbf25d114fecc57f61ec31072b233245fabae042cf6276e61c76e938e0826a0a17ae95710cfb21c2da13e18edbf99f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
49d6e229b447acd9cee14d11c45f881a

SHA1
4f8fb70aaeb0a4f61054a959a3c544fbf86ad973

SHA256
3255fd82a0b974947a43d85c86219efd37c6ad5d3d3a3638d0c0f8fc9731c114

SHA512
f48b31d805f3af18489e09a7aead5db6590caad14941784c028ed8237386cc27bd1e10fff343062474cd9e181fa5633a16697aab8c09097b6629d0f0e079d065

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13364316451035262

Filesize
1KB

MD5
2afb311344b7f09ad61b61f566ddb5d6

SHA1
90161c97b5264ec16e4eab7410b87a004c5f9c38

SHA256
3cc7a60e0b75e7ff0bf5ef9f7246f2ee5e7cb8b2e93ff548ae8d9235e40e43cb

SHA512
7e50895761c18e86f2e8864e2bfffd16dc9a7f1b873d05ebb2ef76cf513b145c356b87f1e154d6e3c7324cc2b11cf99bc09b53811544628f76f3ccc4b9cc4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13364316451179262

Filesize
1KB

MD5
9b2c41db612a1ca17651c3314674cd96

SHA1
4214640dd4b21f6d45b99351674f680e1e3f2971

SHA256
faf81680f952f9102682db48e2ced2e882578675271c03a6c0c08305174a8e90

SHA512
a16e2c23f2834fa6b6bcac1cca1f92410a657eddc2c603b1f0815a732c588754dae70f2eafa7e24889169f4dfdc26dd1926bbbb4b5949f727a342e061855ec22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
cdc192f2796412070bf91b7c9effda28

SHA1
b8b819cfdf6332d9fb477fcfb811c6e690dbb0c3

SHA256
7f4553791b4928a0eccb618b22c086b3d80d8ec436dfd6c50fb7f4d451e1576f

SHA512
e471db7f769210e7ca0a7e1a4feeec943448d817503a5cf94013eaef3af9acd08084f568b30a1dad28d80e14c592528a660d92635b1d8b25c20ac0ce21020354

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
87c2adf89d8e4be235819c1ee14b5d5d

SHA1
1fb16f0ba292082f9e580d6a5f9a6835fdbab4dd

SHA256
2ce7187207548a7ad1fa01553a7591d19b3f78dbe55dfb45b59de6a1f78627c5

SHA512
2d039e09b22cef379d6407004cce97f1ed0387d377761da43fbcec32fc7dd0004a1fd78b65a62d3660c99bf6a385dc22d3ff843ea8330743c1ee7ca3d108e175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
17cee19e5fbdf9a2cf455d6f43a31b5d

SHA1
f3555496252c2ec60237ad0fd4201ffd584088ab

SHA256
4addac2aa5fa1a92da4d59a552a86682700cadd30f015b05811b90a747299423

SHA512
2a4522e989596d31b3e31b9bfedeca32069c87cfa6f6467dd1edd6e4372f494fba455c08c106aacc944d3172c9e7442857513bcaf7bb71e9a93b74d3d37c0fd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
1e4ddc2c08bbf29b3495249ed307adc2

SHA1
7a5ef461cb05887d5c934f521d7a9d6af8341b8b

SHA256
f807c4f21e0b9020678520fa6c94b344b6d277b6c82e3d3f75ac29354b7136ef

SHA512
a1e1ffe8dabf3c8ecfa529ed0f7c94cffdc4b56ea296559ec955c5bcce2fc307fd36b372a078657c625d77b2f4d5467efe9afb3556cb90ea02ee3999540bc9b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
322B

MD5
493729e7716f0b64ce3975e4d3851808

SHA1
f3341492d0553341d645c609c9e3ae4cf03b0e42

SHA256
3cba09639ac4cda912a6d542d87dd8db64851dcc70d251e2fd08a4ef72d01283

SHA512
6d66f3c224e0b7b1ee307b920156ab10ce1fd625b0aef2814101f0f9d69730978295ce075f4cf6a9e79eee7522ff2b34552c824823a2455b1bb4876801088dd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
7c3d6e5e7e1e16a8f284f9a0a05a6c6e

SHA1
5f5a701aebe1ae5f30c0a5f95367f62022688de9

SHA256
610cc050649b6829ecd721a2eb70df2cb177f7b6082dcb022e4a0f8955000cf2

SHA512
cc2d8538198d3d3301d0f60a58f8bf8eaef2de0c64f98876bf2c71021905f7c64695e9a4943b92909163e632ea2ce38c3adb58ca2aa8f69d3ab1cc5887ad807c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
418e861ef136da92814cc79167de89cf

SHA1
492cd0cfd6de66da3aed33dadeaf96bf98c5478d

SHA256
edb9771c4c7cb61bddb15aae775aafd8fa413b70668e1c2e0dba487d2f68956e

SHA512
016889b89b11ddfbef8057cc5a2b3e50927c8dbb01fe3f1eeff133af09dc273f4c39a9f8f5107852926710e6d4649717866bf94a6fd578eed108ef96fb94747f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
a2926a2a4898bd9a11941859e9bb29a0

SHA1
a0c202106cc887a030c941239e32df315b915fc6

SHA256
23d3650180cd5a60013007e7e09b037e0a98ca21ba31bda3b0ee1a75bf146eb7

SHA512
19d4e6fedf32684a1b822ef76f7241262225e634d1a5419e5a7443f6f3df2ca247290ec99c398c8d9fc6f6f9a0b7ca4378176d52942c660046055ebbbf625c2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
d2f556bc43588e3f0211c2fcd936c10f

SHA1
e17cc2316e76d111fb94228fcfefdbefb12e9091

SHA256
0ef23912d1ba671c7c919c2734fd32cf7c8c5a1cdcc8d4fa4e9bc95149f25be1

SHA512
455e23a53e2da49d322b9a4470fb69d38db733b7fe14037f1370f118910ed4102b2949d022e787f03e7c7fedd218ed74d84dcae8ede0b64f9de46ee3623757bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
8767e4a291c3c7b631d18dec686c973a

SHA1
935c197d361ab3faa5faa621fad5e9dc574cc3d4

SHA256
2a9a4f695473d7bbbb6dd58d5f097bee8d19b857e328dced309f368ea746139e

SHA512
22a5aaadad1029de17b78d1cb101ac87c89a0244f40d363885f221e8396c129041140495d35803f6b237951f603e9d420b0b8ae7e53927b48127739109e35d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
e15df4af6a41a573340c207d1ed43917

SHA1
d8520be0f1c64a1465a751c2e2aed277c2b808e4

SHA256
6fb06421b5f58ee0bc2dbde81e06e85af379028095e682ef3ecfdb1d49b1127a

SHA512
64e6262f2699276c7e8a875e7decb7079dfb9f179679ce6bd71f49a5206eb97da970c72d3d4b4c882546ace3def0afbb8ee3819fe4af2bda8cccc47ec3454df5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
ef001d14b8906ae8442ca1f0afb36b95

SHA1
9065df605f84eb7da54eb9495f26802ab7469fb2

SHA256
5f5298695f970bfaa377c30889d6d75f3d26c4130bb52c77100d789349faf5c9

SHA512
af16f01bde69a91944c6c92a08ae50830d2609b7c0ebfd7f7d747fe16947411094c92633df85e0fb164143ae004f9ca8d5da9e5fdac028f204c5aaa6f50d5a5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

Filesize
5B

MD5
a59f9fdd48a1cfda0daa615df1843d38

SHA1
57e621c173d49dd31b76fc01c840d666958a0835

SHA256
aa76351ad0fc6f3a0778759b1117dbac5997f8720bbb970e6b7ac5cffabf1985

SHA512
c8599b561c7160b0919042cd5d61830d795623982e45f5f28a06daa2833a9a670ce35151e4361f9ad61088ed19621317e80024c007aaf77cc3ba88de99ab9900

Download Submit