hxxp://is[.]gd/hXkd9r

Resubmissions

17/07/2024, 08:17

240717-j61xjsvhjh 1

17/07/2024, 06:25

17/07/2024, 05:35

14/07/2024, 14:36

14/07/2024, 14:35

14/07/2024, 14:32

14/07/2024, 14:27

Analysis

max time kernel
139s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://is.gd/hXkd9r

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-701583114-2636601053-947405450-1000\{0A1559E4-4CCC-4A5E-AD36-4184535B71C1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
3088	msedge.exe
3088	msedge.exe
3696	identity_helper.exe
3696	identity_helper.exe
3236	msedge.exe
3236	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 2888	3088	msedge.exe	84
PID 3088 wrote to memory of 2888	3088	msedge.exe	84
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 2056	3088	msedge.exe	85
PID 3088 wrote to memory of 4832	3088	msedge.exe	86
PID 3088 wrote to memory of 4832	3088	msedge.exe	86
PID 3088 wrote to memory of 2016	3088	msedge.exe	87
PID 3088 wrote to memory of 2016	3088	msedge.exe	87
PID 3088 wrote to memory of 2016	3088	msedge.exe	87
PID 3088 wrote to memory of 2016	3088	msedge.exe	87
PID 3088 wrote to memory of 2016	3088	msedge.exe	87
PID 3088 wrote to memory of 2016	3088	msedge.exe	87
PID 3088 wrote to memory of 2016	3088	msedge.exe	87
PID 3088 wrote to memory of 2016	3088	msedge.exe	87
PID 3088 wrote to memory of 2016	3088	msedge.exe	87
PID 3088 wrote to memory of 2016	3088	msedge.exe	87
PID 3088 wrote to memory of 2016	3088	msedge.exe	87
PID 3088 wrote to memory of 2016	3088	msedge.exe	87
PID 3088 wrote to memory of 2016	3088	msedge.exe	87
PID 3088 wrote to memory of 2016	3088	msedge.exe	87
PID 3088 wrote to memory of 2016	3088	msedge.exe	87
PID 3088 wrote to memory of 2016	3088	msedge.exe	87
PID 3088 wrote to memory of 2016	3088	msedge.exe	87
PID 3088 wrote to memory of 2016	3088	msedge.exe	87
PID 3088 wrote to memory of 2016	3088	msedge.exe	87
PID 3088 wrote to memory of 2016	3088	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://is.gd/hXkd9r
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc72146f8,0x7ffcc7214708,0x7ffcc7214718
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,13469829795575508221,17897667806549248937,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
a0ed9119dad914ec4bbd0d40da6abfc5

SHA1
65c4fbb1098494c1f7a6f13049a8e1a330a91e5b

SHA256
18479c32b5df3c707a524d2ed32a1e5bdf4cf7a0aa71d52db775ba19d8521f65

SHA512
a8b31248c1e1be7a8d24c507eb6492433e55c000bd34d1ef1dbc2adee93feec3fe3a0c2f6016ed4518bc744091f5a337f5fa55c5d098524e9582c917d2f46f85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
84dd619543a456d0e0239e5dfab2402c

SHA1
c9b4b0edaa86840bbad2c5534363a4d98b21761d

SHA256
0095c238da0eede2c9a3ca195918660c4aef24e33cc0279134f2aa83027287ad

SHA512
113d9be5ded482fb612a59c694b53c3c53d5c91cbfd3209106aa2dd9326984fe35e23c65a042795bcb7f4944911f16059a818469ab129fc9a998edb95604c97e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
5272e36d7650e6879c0ff2b73baeea3b

SHA1
daa3fd2433f63ca42d7629adfefb4f7035d5bb7a

SHA256
028a42e7825e264bad522d7183915e199e614ba2972784ef8b9ea4c38a64978d

SHA512
7b9f2fd57a59c3674129f96d5c20e88a62b2d342f7358994ba5ed15c437a0ec9be5aeeecf3058e286619fa7d9a3899b7c88001e0c688d5e6f632a7c24ab91b1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
0ffb49590f614bd951ac5df21741ddff

SHA1
0e2f0402d851a55d6e291012340c01cd8bedef07

SHA256
a19bd45974dac2f7615fff2434511f2547ab768b35c264eecb80c62d0b1bc5d7

SHA512
f1cfbe5fc2639c703ffa4061958a2d257ff4afe13c8475456f9ff5ccfe59df3ff9225ea9b84b5f3fb132794133e01833b468b6d735ee0ebdaf2d8a31782b9040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
b4041f7d3834a8979dbcc8e3e0559b5d

SHA1
7d0b15c830ebb086aad5a138230a2f8833615afb

SHA256
9846ddbd6ae42a1280045ea5f6f0e93f7d6cb76edafd5a51c3f3835ba782c4e3

SHA512
1f0f1d296a8321ddc4db94968a417161af77563a4ccc0f410595cc6fc502092887cf5377895b8b2e43d252680548dd2f00231418661988276973ad196d6696f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e34f7a94809ec49a7b66d0d42f487e31

SHA1
14f3f9d7f2a518bed0764fb59d2c16eaab5aca11

SHA256
803dfcc079d9ec5d1a94b73112f8d1468966747d23ec81fe22d4724cc66e7b4a

SHA512
025493c12a15ae1b991cf83c85ec1897d0c2a5f1fee70eb3070654e46fa79b97838226be6df7de1f875c9c1e571bc7ecf0f966d6003bc9ff7412c4f4b69ac2a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4e27830df9780c1dd3a1860362d3b2f9

SHA1
368416e237b681647a7e5e4b472caec4be73c32f

SHA256
973fb72a5f90feed488d365dbe262a47f166afbfe69d7a35c2c4136a92905ac1

SHA512
bec2defd0b0567f67cb57032e3bfcc7ca06282207008bad56d2d32c9127b59c7cbc1cf787cc46b03016abfc2fdfebf42e9c968a96c32ca11c7b7df69006c07cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e697539a6088f18011c8bda5bdd4ee32

SHA1
0b352194599580b2a632062ac583d060a7abe1c9

SHA256
e3e4bb57cd7da076de45feb141459ba14bd8004a3376b2c52367316ad2dd8892

SHA512
7dd0e851956ced2356235326596654e8676cc7998015056b17b712cf9d3ca0a778ec5724734c333fed50e31d1784bfef35f8c41d3edae7cac706e63e5bef42d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c9045498dd95a9d9b1fbf7cee8a349a9

SHA1
63dd36d6834bd8b466396eab2a972c68efbd0807

SHA256
015c03b7575b3890561bfe8f3135ef4383e60b4701f8093c39e737ca6f38f932

SHA512
5b4dd7a08325be354f66da12f2a81a96b1262ceeef5d803ec69cdf402d4dbb90d12a89ffc4baa629f92c71dd5548f24ba07fcdbbba12374836487febb44ce72b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
296fa3ad6e114998041fde0a4261c407

SHA1
35515da4579fa23d58f9cd0edbcdcc7db7e0092f

SHA256
f3eaf26c8ea05a2425a7a18df5febc40edd183f4f1a79b1da7fed0efbb36e3cc

SHA512
6b0aaa761e4bcf3ed02b9c5cc4cfd40340721dfddefd269e4c14888e0f5a548606d97c4d1313c81b104eba34744cb683f6c0e7660e0085dea4b42018b0f24e4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
159735e58c90ab1309cdf0d8ace214e4

SHA1
227b3e143b0c9703ed63733a70ab0a94524849bc

SHA256
bfeb886fb863311b901fe4f6e9190dda334abe05e83f9450dbabf8a781a169d3

SHA512
6458d1047e6c82ba91493dda368d743244fe8bc3e98927631941fbc658c6d45715cf2c164e6bd0744bf54d408545c0b3a3e8ab23e6e472b7188883c27956de8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
49c5eedca6ab4e0e0f6ad9c228cab099

SHA1
6122b824d71302bff22c40335e193348008eca5c

SHA256
82666c155de735ff84a679641f0b1519971e84e8d5fcc60183bc73603f0e1b58

SHA512
288eb7e4870a414d01ee6050f64eeeacc21c58ac450299286beacc9d71f50bdb4d23ae6994d1697d5825f2d530828a4487d96daafeeeaa7a3aad0aabb6964370

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
49eb98866e7026c10e2a21581374ef75

SHA1
e6e8fecb86cfb5f1ec435c79c9ef81b765c4f0c8

SHA256
84dd2174747a73989db6e484b689a728a05d64119ad121766a7153aece0256ff

SHA512
29fe19fd0fb3f2e994e7e8c61a60a219910886f83dfc49253df5604b1da3eceb4cd14b969f6b885102cde5a2431361d44349744f7ed76049af126ffc05dcbed2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
1f1b293590ec1156463a506b8e9a6305

SHA1
5d73f5e43f97e7355c29a84ca52c9dcac2164818

SHA256
91e197aa09c54fbe14c14c1636e0f9bc59679f27ff018753560ba794cc37707b

SHA512
641025eb28731796168e9f9423c41cb403913a65dbce6b38def8936f1fbcd62f6745954ae3227eb2df73be2779d5b10c6ebc72ed2c2eec1b7d1677fa53bc1563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
1d579bf0f6c079598d540b3be58456d3

SHA1
255549651fc588c3969775b229183112f901cc95

SHA256
707cbe9e7f358bed32d313e9b9f3aa4e9f5cbe3f57911944d9532a6a8ddb3852

SHA512
26d8eb86860907560beec623019f29f31a2a93266668afc65c59d8a00c5aec934009650d301f8fe2701dab0cd29786dda131138b2d0b312fabf4d378d7135053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584baa.TMP

Filesize
2KB

MD5
0471d3ce7d801ee093e7a30544c82614

SHA1
dbdcdb242c0d252f89f6bf31f0eb224220ef4885

SHA256
c089d32a7bf4cda0f933194820cacbf62ca9fee2d34bd0dbd06e61791e864734

SHA512
6f6102a27cecc4f107e4c328d3e72e22127cde9f6701779b6a3b12af44957b0c5014ed991c93103e1e68f9d80a47bba2be80ceced092bca4260a600e5ae46172

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
005acff9a99733e1339f3e247ef2b152

SHA1
a15893f493488e8f0836ce6316d25c961b0207b8

SHA256
14896bdaaa0be3efda6864b8e6f27089002b776dd0b3cf34b64c18efe40bf1a5

SHA512
88258f5740e71c8b159be5e29870ab1221475580772943257a0d0ea0d375b413adfccf5f1b2b547fb779d3f21f1165f9d936f568339d7c221e656cd6f4eb1389

Download Submit