hxxp://google[.]com

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
28/07/2024, 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2990742725-2267136959-192470804-1000\{DE7BD242-C014-46BA-9024-9EBFD27676E5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
4580	msedge.exe
4580	msedge.exe
1204	identity_helper.exe
1204	identity_helper.exe
2344	msedge.exe
2344	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 2624	4580	msedge.exe	85
PID 4580 wrote to memory of 2624	4580	msedge.exe	85
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 2100	4580	msedge.exe	86
PID 4580 wrote to memory of 3144	4580	msedge.exe	87
PID 4580 wrote to memory of 3144	4580	msedge.exe	87
PID 4580 wrote to memory of 2532	4580	msedge.exe	88
PID 4580 wrote to memory of 2532	4580	msedge.exe	88
PID 4580 wrote to memory of 2532	4580	msedge.exe	88
PID 4580 wrote to memory of 2532	4580	msedge.exe	88
PID 4580 wrote to memory of 2532	4580	msedge.exe	88
PID 4580 wrote to memory of 2532	4580	msedge.exe	88
PID 4580 wrote to memory of 2532	4580	msedge.exe	88
PID 4580 wrote to memory of 2532	4580	msedge.exe	88
PID 4580 wrote to memory of 2532	4580	msedge.exe	88
PID 4580 wrote to memory of 2532	4580	msedge.exe	88
PID 4580 wrote to memory of 2532	4580	msedge.exe	88
PID 4580 wrote to memory of 2532	4580	msedge.exe	88
PID 4580 wrote to memory of 2532	4580	msedge.exe	88
PID 4580 wrote to memory of 2532	4580	msedge.exe	88
PID 4580 wrote to memory of 2532	4580	msedge.exe	88
PID 4580 wrote to memory of 2532	4580	msedge.exe	88
PID 4580 wrote to memory of 2532	4580	msedge.exe	88
PID 4580 wrote to memory of 2532	4580	msedge.exe	88
PID 4580 wrote to memory of 2532	4580	msedge.exe	88
PID 4580 wrote to memory of 2532	4580	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbcf3246f8,0x7ffbcf324708,0x7ffbcf324718
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1264 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2980 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1080 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,621512794570833365,12189916758015575781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2f842025e22e522658c640cfc7edc529

SHA1
4c2b24b02709acdd159f1b9bbeb396e52af27033

SHA256
1191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e

SHA512
6e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54aadd2d8ec66e446f1edb466b99ba8d

SHA1
a94f02b035dc918d8d9a46e6886413f15be5bff0

SHA256
1971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e

SHA512
7e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
210KB

MD5
5ac828ee8e3812a5b225161caf6c61da

SHA1
86e65f22356c55c21147ce97903f5dbdf363649f

SHA256
b70465f707e42b41529b4e6d592f136d9eb307c39d040d147ad3c42842b723e7

SHA512
87472912277ae0201c2a41edc228720809b8a94599c54b06a9c509ff3b4a616fcdd10484b679fa0d436e472a8fc062f4b9cf7f4fa274dde6d10f77d378c06aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
63KB

MD5
5d0e354e98734f75eee79829eb7b9039

SHA1
86ffc126d8b7473568a4bb04d49021959a892b3a

SHA256
1cf8ae1c13406a2b4fc81dae6e30f6ea6a8a72566222d2ffe9e85b7e3676b97e

SHA512
4475f576a2cdaac1ebdec9e0a94f3098e2bc84b9a2a1da004c67e73597dd61acfbb88c94d0d39a655732c77565b7cc06880c78a97307cb3aac5abf16dd14ec79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
69KB

MD5
d91bac1b60b58c54f87f1d1b7b16d445

SHA1
9ed78d3cf7553e3180bcbcd2ea9779e1e1a141e1

SHA256
4dd5f57067798bd3132643930620ccde1e4140289d52fcbc4fcf7b252876fe8f

SHA512
eb474a57cce34e17d00972b927846f087c55a76f5fc1fdbea0e43111f9d9a5af848862984431402a6a043e5a1a96815be84e114fc03c0372a03285fcf0c2623c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
43KB

MD5
ef32ba5b36e350407350f9be51258351

SHA1
c6f4def9193e37adeee8a21d2478c713968a119b

SHA256
6d3f34d3fb4e2c09adf141c2b613449f1c8bf1b1f5efaed3bb2570f061ff20ed

SHA512
84a4c57206364fe46ae277a01d7fcf1491ce348527270043777ca1c835b88b82d9287319ce2a2c08a2452f6022d0145d960900175d7e12b7126e4a2f2a7dec45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
a423fa9f7eee248ea116fd865b330514

SHA1
98293e936731d5e659a18741f68643a205606045

SHA256
5ad215c04a973312649685dddcd796943e21147a64509a8cfa1b1a70ecc735dc

SHA512
88f84c9226876bb137bffae0e96a9286fa2f30f634fb51231f9f3c86a6b7cc56e34cdbc89211ba45606b5fbd04d280239089d74c29fe7ae2694e9606cc5267d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
59016e2df76584fafa33ee6166dab264

SHA1
03412de25d97bade8588c76f56fae8e9f4dbcbf6

SHA256
53596e4cd55760b88886b25c241d4958684104319b86d84f3239c6f49aa48935

SHA512
573c9be4d9208629d6fec160baeac6616c671d79bb83a5836167c1de4c182c605592ab6de74149f9d5230f30cbff9bd52e4dfbdfd2c15072ee4347bddbf9c487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
815B

MD5
a80bdb12e05fb706ceb3917261410953

SHA1
258feb850504b28b4d9a94b41cae57bf1c4ef77f

SHA256
54a7529839a6c388f54859a36c0ca26ceff35b7f25b47f175ada4bbb275517e2

SHA512
94523c0c54c358ac9585d61c7435a2358ceac3103b75d016c5d418abd2c3c9786445d921702f52eae6628e71e159cc58f9c1ef063b0975cfc2e2d886699d5707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7a30107988b5a6021bab36e454dd35e1

SHA1
0a90c6efd96dea6268cc73f47de01629aacd8b39

SHA256
31cb95e0236a4fa71b90549b95bd4b20aea8fee9dcb614af12543e7a6fae1884

SHA512
8ea7f315eb0965e126e1ebcd1c80b3260960f2af7054d703855d37aa3da525872d154fa93666b91dd43e99bbe135a3f34ab4f7376917324dfe31700f69552b8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fa603d3680049f31d624481c2a763c71

SHA1
fb7e88b1524ac90bb1bbbecaba5f0e43749c6447

SHA256
cacebb5742e97d79f146f3432c7fea12b8cf9e96ca1b0d9fe6b4eaf77865f2f2

SHA512
57580ef48034631e0e54ab46dda8706358229c742d9e1868e87fe03ba51ab00e1a259f9a409631debe3c4d97a1bc98a15279cfcfb60dd77411b1f1fe79ba77ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
671d34c0d3e1463e4029c733008cb42a

SHA1
0dc69e09c421d76d85ab32332ac5ca1bfd5587f5

SHA256
7ec85d0485ab0e8e842bb97717eeb0fb8caecc0a45451dd2b801f30ad1ab1393

SHA512
bdd50dd37ca4c599d038ac07d4d06874e544c29bd4bc693ad3713c9a3f1f47b40d01c881cb250304261b97cced10109363edfbe0594be883514daedbae7d6413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4755ebb60f562472d982add2b8841642

SHA1
8c85ddf31b932951de46e6c2584b9fafa0072be1

SHA256
0732ff90c3f89347ebc3b4d9be26ee9f5182168662a5030539bee1b4a04c4664

SHA512
a402a5e3383cd7dfaa99f753e96424507a7f630152abc7e0ab4c75f9d2b7bec7f1ecd17deb8da742d9f844270df6e466ed4c44790b21753e3fbc9fcb7c16777c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
4c094c4b90edaa016c9683c6d6703844

SHA1
814784c812155221e8969c0a8855b7175a448f3a

SHA256
78b95880ce114258ca98927167f53f6129092ed77e60dbad970c34dc60ad10e1

SHA512
156cce7ba0d91aa5c305a29e31a497935faf544372d02f0aac7e6565d8d3168e02bb921cd897330250413e1ff3ce950bdea3ae0f275352822e8c28d3fb985da7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59cfc9.TMP

Filesize
538B

MD5
e3f1a6b70622f7e3ee5b67209744c9ef

SHA1
040c5988af49384db484341c6472c1cc8da2a85a

SHA256
a0daa3f646fb53410281897b8618b4afecdee64587ec234d1c81c1607ce067e8

SHA512
02b6a897724c1ce78d3fa8439746d7147494c22b56ddaf51bd2b82e8f6e32766f5009b3c5e5b417207f408556eddc138ad69340f74b2ca5e5d0999f83d0eadca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
61943bae4fb05a1238bfb49c6ce7d376

SHA1
cc34322f3fb1eaffb262c77b232219a4db1693ff

SHA256
ed092b8b51c39f471e74ee5f5e510ae9ba5047a31fdee60cab3f6dbe9f620671

SHA512
04cef308ec246fd0bf27d4b4b4809d3e98dda922bc75adc02323a2ca7c9eb85bf271265e546f0f6a5ad61dadfef1be69f58300631779cb9deba338f6536048a8

Download Submit