hxxps://github[.]com/Realmastercoder69/Nebula/releases/download/Nebula/nebula[.]zip

Resubmissions

09/08/2024, 20:16

240809-y2gens1glf 3

09/08/2024, 20:00

240809-yq81jsxdpk 3

Analysis

max time kernel
169s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Realmastercoder69/Nebula/releases/download/Nebula/nebula.zip

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
3780	msedge.exe
3780	msedge.exe
5020	identity_helper.exe
5020	identity_helper.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4256	msedge.exe
4256	msedge.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe
3948	Inject.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 3136	3780	msedge.exe	85
PID 3780 wrote to memory of 3136	3780	msedge.exe	85
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 3472	3780	msedge.exe	86
PID 3780 wrote to memory of 1784	3780	msedge.exe	87
PID 3780 wrote to memory of 1784	3780	msedge.exe	87
PID 3780 wrote to memory of 4136	3780	msedge.exe	88
PID 3780 wrote to memory of 4136	3780	msedge.exe	88
PID 3780 wrote to memory of 4136	3780	msedge.exe	88
PID 3780 wrote to memory of 4136	3780	msedge.exe	88
PID 3780 wrote to memory of 4136	3780	msedge.exe	88
PID 3780 wrote to memory of 4136	3780	msedge.exe	88
PID 3780 wrote to memory of 4136	3780	msedge.exe	88
PID 3780 wrote to memory of 4136	3780	msedge.exe	88
PID 3780 wrote to memory of 4136	3780	msedge.exe	88
PID 3780 wrote to memory of 4136	3780	msedge.exe	88
PID 3780 wrote to memory of 4136	3780	msedge.exe	88
PID 3780 wrote to memory of 4136	3780	msedge.exe	88
PID 3780 wrote to memory of 4136	3780	msedge.exe	88
PID 3780 wrote to memory of 4136	3780	msedge.exe	88
PID 3780 wrote to memory of 4136	3780	msedge.exe	88
PID 3780 wrote to memory of 4136	3780	msedge.exe	88
PID 3780 wrote to memory of 4136	3780	msedge.exe	88
PID 3780 wrote to memory of 4136	3780	msedge.exe	88
PID 3780 wrote to memory of 4136	3780	msedge.exe	88
PID 3780 wrote to memory of 4136	3780	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Realmastercoder69/Nebula/releases/download/Nebula/nebula.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce23646f8,0x7ffce2364708,0x7ffce2364718
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,11009245132735996920,14197757981870821790,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,11009245132735996920,14197757981870821790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,11009245132735996920,14197757981870821790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,11009245132735996920,14197757981870821790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,11009245132735996920,14197757981870821790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,11009245132735996920,14197757981870821790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,11009245132735996920,14197757981870821790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2252,11009245132735996920,14197757981870821790,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,11009245132735996920,14197757981870821790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,11009245132735996920,14197757981870821790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,11009245132735996920,14197757981870821790,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,11009245132735996920,14197757981870821790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,11009245132735996920,14197757981870821790,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,11009245132735996920,14197757981870821790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2200 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,11009245132735996920,14197757981870821790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,11009245132735996920,14197757981870821790,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,11009245132735996920,14197757981870821790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2252,11009245132735996920,14197757981870821790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:864

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1216

C:\Users\Admin\Downloads\nebula\executer.exe
"C:\Users\Admin\Downloads\nebula\executer.exe"
1⤵
PID:5092

C:\Users\Admin\Downloads\nebula\Inject.exe
"C:\Users\Admin\Downloads\nebula\Inject.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
265B

MD5
f5cd008cf465804d0e6f39a8d81f9a2d

SHA1
6b2907356472ed4a719e5675cc08969f30adc855

SHA256
fcea95cc39dc6c2a925f5aed739dbedaa405ee4ce127f535fcf1c751b2b8fb5d

SHA512
dc97034546a4c94bdaa6f644b5cfd1e477209de9a03a5b02a360c254a406c1d647d6f90860f385e27387b35631c41f0886cb543ede9116436941b9af6cd3285d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5257cff7fd23fc23c344faed31c0fd8e

SHA1
c5cf13c53fb6f451c9657224eca508d6cd710591

SHA256
656dc59e97e8b78e180d99f5b602a58dfd66a5d28d8f452568415b0cef9b3974

SHA512
37dd603be3eeb78112305c71510c135aff46f5e7750330fc336c75582bcb3987a2a73ed97cad6fc0c88ce0441898bb6f90aa35cdd5528b7d97439fd86e21386e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d2c53635620300d5fe7c8072e5f3cd96

SHA1
b4c5c463b1c8b18ac218d1fa220ec246739aae65

SHA256
41e52ce1f14d4a336e2458ae55b6071403924d720e65cbd97ff1a1ef84c9be1a

SHA512
88843a4d1f23a7754d8fb3d629f7663aa997218969aa3d32e9c36063caf0285da73b4906c4ec4d47222a7c6d8a27f2a9dd8ec6357405b906978d0c864d2dfc2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5a870d8c30ec4bcf63a7e5626309a7f0

SHA1
65b5a44763ec66e13c3e026f04a082a34de818bf

SHA256
cf4e412a4783e3e0faf2338d103fab4abc9122216bfce3f5b0ae2ab82f1340b3

SHA512
32030e3469db3cda2bcc6a11917e2aff261bf4b61b67c8549f1e4c7de56d435f41631999131ae793f1549a20dcd46c3404926e06f8aa4c9cd7f3d5029011c2ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
eff05133322664ce9fabbf0ff176f6ec

SHA1
d1830601c8e7dbe6baaf41aace999cf3f228ca80

SHA256
5a78cb8162c1215208fbc0a631a4ec7c06b25232807eb4d77b0784f82a7fddae

SHA512
557159e30ace92d166b5d74226ae6244e833a9c5cf0c14d160d64f1c93b26744ba6c50025c4a8e53db63661088e0ed62a11e75275783d339d3498379b6bd980a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
fb2112f8522d41989525b975c2d2e908

SHA1
61e3d447e2e48ec22c12e5e02fd37ef93a353949

SHA256
06edf84b886fbbf3c08c9c5862540cac15a21eb7e32167c1e986773618546eaf

SHA512
ce423d4403053c1e97304ef82b46010e370763f77bab538763be9693ca719db1689dc4d0481840e1fdd4d393ca921a5f099fc80ae5625a06ad0d16cac9478127

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0fbc43a77eaecf4bfba1b4388d5bd9d3

SHA1
821b43a6743ee10393e7df605475e89c4d0ce4f3

SHA256
a512053e62cc324084967aa3cbfd07de54cda074b7666fb6753597fcd5457fe9

SHA512
402fedb6c082802a728dfcaed5ad9954e0893f31e5c5abe43ebf0af4ff0c157ae4f6faa3e1c510cd023762f854e4a1e3bbb0dc681dfd6680465695ccf5b72493

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e17247224751f46e215db4dd28d482f0

SHA1
300f0c7e1fdb30392ccbdd74c63bff828da9bec7

SHA256
5b978a296ee4eebd481794ea8345232afe8304671bcc8224e5d1378dacf630df

SHA512
3cca0cc101b75705eb6d9d5684a40b270ab472daa09ac65cc8ac1d3c76815efcf339b2d2e8c7a12c6b9377c2997688f73c1b4496e6185f7696116cc553f9ee9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c575d650d66adc62552a7dd1f3c05a95

SHA1
25b02ca1ec761d812748dc0111cec7762911e11b

SHA256
43e658759886065850d7bebc1db4c09da0f6d8943c6d8415da21c1d569883943

SHA512
4c2b7ab3c17089359622ccd8f70dff2274b26bc4e884ba36a71d1285bfe92cf3fcc4e2377857b3d9b13cab34d229710ccbd7e4c9fc538370a770b09c1af5ca04

Download Submit