b0b2dcea28aa8fa75a4d90dc325915d53c5c5c2fec214bd1b8b8519327ef1370

Analysis

max time kernel
1725s
max time network
1685s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
02/08/2024, 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RUN THIS LOL.cmd
Size

241B
MD5

bf3d7e15cdd9bbf75ce7477ada7c108c
SHA1

85fd585bd8d6d8b834928af6f4cd08d1efdd5339
SHA256

b0b2dcea28aa8fa75a4d90dc325915d53c5c5c2fec214bd1b8b8519327ef1370
SHA512

129ac50a80cca7b91d30a41b4e4413756672ebb11345fc553a96bd8fcfaff7fa8e746fddbe8a613644cde29be9fc2a799b12db534211e50f78498d350354e59c

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
880	msedge.exe
880	msedge.exe
3296	msedge.exe
3296	msedge.exe
492	msedge.exe
492	msedge.exe
1280	msedge.exe
1280	msedge.exe
1664	identity_helper.exe
1664	identity_helper.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 880	2460	cmd.exe	81
PID 2460 wrote to memory of 880	2460	cmd.exe	81
PID 880 wrote to memory of 2208	880	msedge.exe	84
PID 880 wrote to memory of 2208	880	msedge.exe	84
PID 2460 wrote to memory of 128	2460	cmd.exe	85
PID 2460 wrote to memory of 128	2460	cmd.exe	85
PID 128 wrote to memory of 3748	128	msedge.exe	86
PID 128 wrote to memory of 3748	128	msedge.exe	86
PID 2460 wrote to memory of 232	2460	cmd.exe	87
PID 2460 wrote to memory of 232	2460	cmd.exe	87
PID 232 wrote to memory of 4364	232	msedge.exe	88
PID 232 wrote to memory of 4364	232	msedge.exe	88
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 5036	880	msedge.exe	89
PID 880 wrote to memory of 4320	880	msedge.exe	90
PID 880 wrote to memory of 4320	880	msedge.exe	90
PID 880 wrote to memory of 2340	880	msedge.exe	91
PID 880 wrote to memory of 2340	880	msedge.exe	91
PID 880 wrote to memory of 2340	880	msedge.exe	91
PID 880 wrote to memory of 2340	880	msedge.exe	91
PID 880 wrote to memory of 2340	880	msedge.exe	91
PID 880 wrote to memory of 2340	880	msedge.exe	91
PID 880 wrote to memory of 2340	880	msedge.exe	91
PID 880 wrote to memory of 2340	880	msedge.exe	91
PID 880 wrote to memory of 2340	880	msedge.exe	91
PID 880 wrote to memory of 2340	880	msedge.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RUN THIS LOL.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamunlocked.net/6b098-supermarket-simulator-free-download/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff4bb83cb8,0x7fff4bb83cc8,0x7fff4bb83cd8
    3⤵
    PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,4814510133358672569,15121073567024361539,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,4814510133358672569,15121073567024361539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,4814510133358672569,15121073567024361539,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,4814510133358672569,15121073567024361539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,4814510133358672569,15121073567024361539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:1876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,4814510133358672569,15121073567024361539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
    3⤵
    PID:2792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,4814510133358672569,15121073567024361539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
    3⤵
    PID:2004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1860,4814510133358672569,15121073567024361539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5924 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1280
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,4814510133358672569,15121073567024361539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6196 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,4814510133358672569,15121073567024361539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,4814510133358672569,15121073567024361539,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
    3⤵
    PID:1752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,4814510133358672569,15121073567024361539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
    3⤵
    PID:340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,4814510133358672569,15121073567024361539,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
    3⤵
    PID:1148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,4814510133358672569,15121073567024361539,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5268 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamunlocked.net/3b4a58-victoria-3-free-download/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff4bb83cb8,0x7fff4bb83cc8,0x7fff4bb83cd8
    3⤵
    PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,557915029120098816,5613388397475192007,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
    3⤵
    PID:3032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,557915029120098816,5613388397475192007,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamunlocked.net/4e2854-arma-3-free-direct-download/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff4bb83cb8,0x7fff4bb83cc8,0x7fff4bb83cd8
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,1972224721303512554,3239210695122774445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1972 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9828ffacf3deee7f4c1300366ec22fab

SHA1
9aff54b57502b0fc2be1b0b4b3380256fb785602

SHA256
a3d21f0fb6563a5c9d0f7a6e9c125ec3faaa86ff43f37cb85a8778abc87950f7

SHA512
2e73ea4d2fcd7c8d52487816110f5f4a808ed636ae87dd119702d1cd1ae315cbb25c8094a9dddf18f07472b4deaed3e7e26c9b499334b26bdb70d4fa7f84168d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fdbe80e9fe20761b59e8f32398f4b14

SHA1
049b1f0c6fc4e93a4ba6b3c992f1d6cecf3ada1f

SHA256
b7f0d9ece2307bdc4f05a2d814c947451b007067ff8af977f77f06c3d5706942

SHA512
cf25c7fd0d6eccc46e7b58949c16d17ebeefb7edd6c76aa62f7ab5da52d1c6fc88bde620be40396d336789bd0d62b2162209a947d7ab69389e8c03682e880234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
6bc7b1c6c54a790533fc50d72d6fab83

SHA1
0306ff949a26fb1edc6e215578d539e766680b47

SHA256
102fce7ab2df70a7dffcca07e83ac3f902654109e0f7ebc897c6a2814024e3cf

SHA512
922e416976696bb4b796056a706b40c225a870c3422cf38e458b611e163d908b016bafdc73bd95b421110142dd0382726752bdae0c6a8e9a0644bdb8116c8c6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0fa5aee71ce413336dc36e68edd35f65

SHA1
fa8ae18f22a2b2f275c956a7377af871684b4aed

SHA256
bc462fc89c46b18eb761440a228089b7a434c626ab7ef128cc8fea3e36cbe6bc

SHA512
7437776096533a7fc554042f8b2d2021a33fc838cf91a1d96fbb9b8241088acf903c2b4b100f2984ae4d0e19b3a9dda708d8087760908890a450161024f97bcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c11a1b61f5ff2d37ee3817d2032e890b

SHA1
7d265cc943ce4f98ebdbfa4582b9c7e9178c8cea

SHA256
325a4d9bd8175f926150df5ee9387d5cd65ea213b9eefabf63e1f0b02e49f502

SHA512
ff98c3ffaffa92977e5337fd41cd8c381b998e95cd09ae12d5d865b2825a0c3965df70f786f9bc258a9213ff859cfdb6680710207589f2d4677531a41c6431e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
41fc5d91206aef367987ed6059ffe488

SHA1
f7244a4371dadec33945ab2ea2c5c9cebc8d1262

SHA256
7d3d8879195cddcfe70f386b0cd4d1339a6cf9e37aad519647a47f3739b8cf8a

SHA512
0e6ad93efe971d996578ee8b7d950e8060315a1c0e7a32583e41b506485cefa1320ff1af0ea7449c5ea2e26d7dc08a9f4e329d1cda9fcdbc5980d8eff09a7e74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
180cefe973d40ba8f808f731e269d7e1

SHA1
f88705d0f611dfedc9b3e3337cedc8048aaabecf

SHA256
b0669c7b6ccc46a50e502c238bdc771ae6d6e66701efb6303a5277be8512b18b

SHA512
2c41f381cd7c84adef7389f9fc57b2807f30ba3a8778b611ce383ac00b6f8bf7b5410eb1666ab268788654d8c000fbef46aac823d19ef8d4c8db7f54b25341a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c8324185a4d7b1cdc3242fc94965273c

SHA1
69d11c856a907e552100cf0a4687816faf61c96b

SHA256
83751d8b04f433e2faf19147bc64603113451b2aaa2dd20feaf4be8ada4f3caa

SHA512
9845ce0af9058b2df6c342d1e063e2d7bc333ae591516cd8591ec61d100492febf1a29508330bb9947bd1759ae570951c713c50b855fe02232db7e6e68a89f14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3b4ca2247026f2bdeb52492bca1385ba

SHA1
a0d7167dc80ef1f7dcc37a54223bee9302fd0d33

SHA256
056db5d3d1b232c64dd13f00f24ce6ea91eb047e527c9e86237cf884b49941d8

SHA512
d3419d0e8d9f0dc7a51fee23162dafc10d34719191e0cb2d5d425f7a38c5d6493bcca136bb76bcfdbc5e8faf16cede5d66368e88279236e32662178aee671813

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
f99b5b3712c5feb1c2a61e1079341e83

SHA1
f8426daaa15f64b83bacfb9f7d7f7de9b6c2c770

SHA256
41a3106e1f9a676e5c1a939dfab5755b410ccc6a613b36197ccac381a7fa2196

SHA512
128acea7dcbfecf605d6e85e352bf722b26d64089b151f9bbc2f0fcb7284f385acf846d7b9107bd72d496b84c7de7f11ce3b5a35e7f159d7808aeff5319dafef

Download Submit