hxxp://bridges[.]torproject[.]org

Analysis

max time kernel
134s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://bridges.torproject.org

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-355097885-2402257403-2971294179-1000\{586BD393-5CF3-411C-B4D5-DF516F8AD879}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5088	msedge.exe
5088	msedge.exe
4952	identity_helper.exe
4952	identity_helper.exe
3704	msedge.exe
3704	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 3868	5088	msedge.exe	83
PID 5088 wrote to memory of 3868	5088	msedge.exe	83
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 4312	5088	msedge.exe	84
PID 5088 wrote to memory of 5036	5088	msedge.exe	85
PID 5088 wrote to memory of 5036	5088	msedge.exe	85
PID 5088 wrote to memory of 4960	5088	msedge.exe	86
PID 5088 wrote to memory of 4960	5088	msedge.exe	86
PID 5088 wrote to memory of 4960	5088	msedge.exe	86
PID 5088 wrote to memory of 4960	5088	msedge.exe	86
PID 5088 wrote to memory of 4960	5088	msedge.exe	86
PID 5088 wrote to memory of 4960	5088	msedge.exe	86
PID 5088 wrote to memory of 4960	5088	msedge.exe	86
PID 5088 wrote to memory of 4960	5088	msedge.exe	86
PID 5088 wrote to memory of 4960	5088	msedge.exe	86
PID 5088 wrote to memory of 4960	5088	msedge.exe	86
PID 5088 wrote to memory of 4960	5088	msedge.exe	86
PID 5088 wrote to memory of 4960	5088	msedge.exe	86
PID 5088 wrote to memory of 4960	5088	msedge.exe	86
PID 5088 wrote to memory of 4960	5088	msedge.exe	86
PID 5088 wrote to memory of 4960	5088	msedge.exe	86
PID 5088 wrote to memory of 4960	5088	msedge.exe	86
PID 5088 wrote to memory of 4960	5088	msedge.exe	86
PID 5088 wrote to memory of 4960	5088	msedge.exe	86
PID 5088 wrote to memory of 4960	5088	msedge.exe	86
PID 5088 wrote to memory of 4960	5088	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bridges.torproject.org
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa50b46f8,0x7fffa50b4708,0x7fffa50b4718
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1800 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1304 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,10224508205012022298,14420939912121672991,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3884 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
98ba5445b1cc2e074dda3ce24e99f174

SHA1
e338b4bb0427f332a3c17179859024e33bce58b7

SHA256
b5e183693c5f3d409d204c3ba6e1b8ffef368c43d626406a874a1b5d639cdd51

SHA512
3ac915139fa6f50d4f8b353be75e4c0bd243b4585cda966f0387d5037266aedf09e29dd118bbff97e893d0219c8c426ad9f761bc45654b6892d87d6ec1f0dda0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
f2bc525f8afb84cebf1b78b9e9081481

SHA1
39801e77568df6b83157525bfea08e88ca050b70

SHA256
0e8f8febdd59944227a21c2b7c405111a374e76baf304e645c109d86d7569d5e

SHA512
4f344f7cfec010baa4bb754797a44f8203702654a5ec5f1cc2141b9fd04d34532022492eeb4b0e6dca9a8776bd1943f1bfd6bcb0caa132b061b03320cefe2622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
606B

MD5
2d972ac5928ed8e987ed58eafdec3a0f

SHA1
f1fb1d6c1a05d9937518e7740d3caa057840e004

SHA256
409c42f4ad37ce31365449c2e1ddef4b714f2bb0f4639712d5b48d1dd80b887e

SHA512
20c4f15e4971a32c8f5c87ff835edd059e6c68d3a062e47e2c9bfe8ad65b9216612141e1f8ab630e9de5e437aea5f7ff94ec0d50d5097c13471b74d07643be14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
51bd660fd3d6ea8efe0e7a08b89c94cf

SHA1
ca4b356e38c1c8719d7dc39546f984ee87d578e4

SHA256
ad4dc01c81e99866e11ad4fd428340c9bd109b78a2b50fe3e4854010d64c3588

SHA512
6d314f039cf24e40c4bc33009f87d181f7521923e40ee116cc2b4e83a41be3ce87aedf1d765fe67021592540605a649109fcaf6462b5004a7ea5b1cfcee9da2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97ef8eb81f65974aeedd82227c4c8248

SHA1
2f007a4900d763de88376f4231151cde1a699085

SHA256
08b5bec751b8169723212885710d0ef3095dcd95d9ba0ee17152ac1be42fb62e

SHA512
09227f9d5e4518fa14881e829dd109560198c0e75b7a49cdcd6d8fd432bc844dc6728b23386c1fe80916e5ecb7731f823b78d6861b59ab1d28e7aa7b2914e8a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dc500d467862d741179c12128b92094c

SHA1
bea2a56e347d8ebf8b84b41c81dd85515d42df53

SHA256
db508dc5f129daf390fdc6e44b6adeaa49caa7d81f378083ac7ce63a78d6cd2e

SHA512
fcb125966c3b81ada6c72780d2a0a23a188e7b004d59435a361b52f1faf3c94b3b80e529940541a74056793d5ddb917279104dd2e1be33d1c491cdeb9ebc3dee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8d2340cabf733d163eff927cc1aa27e6

SHA1
589c8df78572da29a1aa14c5bde9471fee8ee1f0

SHA256
9e2648caa437d1f82ad33bae05a1e4d0fdc93613e09e42bf99ac4f00c8a65691

SHA512
ee8b35feefdf96336f940131ec652f387c34082ef0b8a1fbbe3faf9f019ca88a73870d246a3b05e76f0604617c9df850024771dec9027e275cb814dbde10ab6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
05df556d2b1504e3bacb0b00fa24a51c

SHA1
3ab5d5aafd2f482868e056d4a9e16e98143be0b6

SHA256
272a60734f710a5f865414ef7b1f468f670bcce6668a349e0bb63b96b35ad193

SHA512
52e61bf2628dfc622584dbd7a41da9a34f0d67ae06e3ad73184b582bc9ad28dc0672b1cfbd9df0a4c291f66af7e36804b5ce35cbc18cd2b689ff54df2065ce8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
540B

MD5
3175dbdb59998c473c88a715d969c1dc

SHA1
649e06c70cff5ff95d112bcf79e23eb1275901fe

SHA256
17a5986cd7a7a179b5802b40369f1fce7ae2d50eb31701ba0135046fdff6f94a

SHA512
4d3c6bff029792048e242a8921510a37b2bf476c6471c69939787db28d839b92e614b4a6237b8fbd9ff6cf3d36b24dce03e84d60d645933fcbd905a6d3f34d18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584c17.TMP

Filesize
204B

MD5
0a43c2232bb75678e58d7f82e71371b3

SHA1
995c914e490ea2ca0c6fa12cb2d8fae91b751c49

SHA256
61281a0d8a92052aff0e537b70c2eaa2e9a546b3934f3ca5fba97aed27106472

SHA512
63d60e0b41b4a1822f62d058d45b49e21eef592fc2db1cfeb2759014f4e8c7b230b5ce858bdf7020f1e4edfc3ec2111525b8843bc9fd83afbe5d6fa3db5cc5f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9fc08ce5afc3497ad085f0cf821fc038

SHA1
81c7ad51c6aa650cf698da7167e742d75961cbec

SHA256
a4dbac6eb75dd02794515042aa8218e623451ede78b738ad686b7c90667884ad

SHA512
b24acb1d4f0d4855adab603d708c3d27fd0a5da587c284f9f427679cc704b46fb9796af5567dbd0263bda18809d9d0ae1d0d38e3c4a25d0ad884ffc43ff9b02a

Download Submit