hxxps://agenciatributaria[.]gob[.]es[.]stt4k[.]com/ret_url/a98673feaa26dce6d0c0777d10e2e0e6/login[.]php?serID=email_auth&sessionID=RHnWkyVAjPgbu&em=dam@patrimonionacional[.]es

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-es
resource tags

arch:x64arch:x86image:win10v2004-20240802-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
03/10/2024, 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://agenciatributaria.gob.es.stt4k.com/ret_url/a98673feaa26dce6d0c0777d10e2e0e6/login.php?serID=email_auth&sessionID=RHnWkyVAjPgbu&[email protected]

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
1368	msedge.exe
1368	msedge.exe
1516	identity_helper.exe
1516	identity_helper.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 4252	1368	msedge.exe	82
PID 1368 wrote to memory of 4252	1368	msedge.exe	82
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 4608	1368	msedge.exe	83
PID 1368 wrote to memory of 3112	1368	msedge.exe	84
PID 1368 wrote to memory of 3112	1368	msedge.exe	84
PID 1368 wrote to memory of 4220	1368	msedge.exe	85
PID 1368 wrote to memory of 4220	1368	msedge.exe	85
PID 1368 wrote to memory of 4220	1368	msedge.exe	85
PID 1368 wrote to memory of 4220	1368	msedge.exe	85
PID 1368 wrote to memory of 4220	1368	msedge.exe	85
PID 1368 wrote to memory of 4220	1368	msedge.exe	85
PID 1368 wrote to memory of 4220	1368	msedge.exe	85
PID 1368 wrote to memory of 4220	1368	msedge.exe	85
PID 1368 wrote to memory of 4220	1368	msedge.exe	85
PID 1368 wrote to memory of 4220	1368	msedge.exe	85
PID 1368 wrote to memory of 4220	1368	msedge.exe	85
PID 1368 wrote to memory of 4220	1368	msedge.exe	85
PID 1368 wrote to memory of 4220	1368	msedge.exe	85
PID 1368 wrote to memory of 4220	1368	msedge.exe	85
PID 1368 wrote to memory of 4220	1368	msedge.exe	85
PID 1368 wrote to memory of 4220	1368	msedge.exe	85
PID 1368 wrote to memory of 4220	1368	msedge.exe	85
PID 1368 wrote to memory of 4220	1368	msedge.exe	85
PID 1368 wrote to memory of 4220	1368	msedge.exe	85
PID 1368 wrote to memory of 4220	1368	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://agenciatributaria.gob.es.stt4k.com/ret_url/a98673feaa26dce6d0c0777d10e2e0e6/login.php?serID=email_auth&sessionID=RHnWkyVAjPgbu&[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbacf46f8,0x7ffcbacf4708,0x7ffcbacf4718
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4164 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --service-sandbox-type=collections --mojo-platform-channel-handle=2104 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3056 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,2718551564170788897,12434636725506225251,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5400 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
214KB

MD5
8681c29159b8e99b1a55c659b0e04159

SHA1
d09d15f3efa442f20c613d1b4026ec4c0d11d074

SHA256
09f3a9be569f593b391588741045403fbf43150cac7f911d2462b8e3a0ae535f

SHA512
3de0ece2eeda427a17cf49e81e4b8c82b3a5a46e695b9d29bba85a85cd374dc1ff0b08ce6d92b873085a775d5de0d71e6e80435522bcd4e1b63ef3dade69d8d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
0f62333e3a701b0b60381529296a9da8

SHA1
0065a23376e6dbf4cb3d554ef92a93816bd8d305

SHA256
77dde0e1bc44b20be5271be0a7ee48ed670f741bcffba98abcf01009c252f3e1

SHA512
68db613158bb871c1d9a8eaa510a936a5d79cef97d7d3bf3631787c8eaedb0357824187efd7613bdcb5ee8e813d1575716396ea6616b85176a2dce1fd56bbac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9ab3bc25940b8d760c21ae173a5fb333

SHA1
ecfef6107ba8d943cea8934f272cabe857774d50

SHA256
29700131beef4a9ede56ace8d119b09c1891040757c01d6057c87a9a60548134

SHA512
ab0778c1c62eec15607b00fcf9c2f4023bec4beefff36df8be2c57b60e5c16321c92d83ee3c5a413d67085719e4836567a0084e5482f5d1af8d9627f96f1ca7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
b9572664e151effbfbeb53f8450d01b2

SHA1
acc7356c6c962507673c4add60189e0cf41bae93

SHA256
db804adcbe2caeca89e149f8de5dac02dfd0db1a8a55776c2a320dac79c61519

SHA512
acfe11d39bab37351da17bd040a039b948a404b82e4b34e43e931095ccf5f27eb77745812e3bacf179159047cbe6153a21c2cc6f3f09cd3a143592d36fc3094f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
11b7911b8a38987cf6ff306eca708484

SHA1
e076a8576187a373e141a8e1651175912b78df61

SHA256
bb00c42323980345ef61ceb4930f7c91535fa2f145b076ae8be374eff02bea6b

SHA512
8ba3cf9900f6b08ebed59b7bd6d3a8b2d767beddc78fc8969234c20009c0e645a3167c1246ebaa9a5cdddc1d0f2284804699c71cbfbfa45ec5dd7a7fbf28a14c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2d87c454b2af6d557ac8fb8511a69f62

SHA1
6a693bc72bacce1afb7c3e0ed5fb5a93de4ab51f

SHA256
9ed27afe38b92dd480ce9a1d8700ffc4cc4aab291d8c566cf6adbc7b373fd9c8

SHA512
f89a7287ae88b8aea4569bdfadb436d24de0bf16600313498da8be571f55a5f63e24a141908e22a936145694fa225b304ce1b3c1c56ae6bfb2960e346995311f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f41ea660736680c3de8e3999a017737a

SHA1
d942f4a7242832f21c7d1fb3dafb99fbe8f91dc7

SHA256
1317d939a1ae12a84799e1a335003cfa95e345865b1e6bdb0be964eefd4afe96

SHA512
db2959c480a85fde7731930cf4218363f76690e45038c014e644c50f4e7a1f249d5a09a1831c3d926e99f55d8cbbe74b044e4b2b245855134c96175f2030e52a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d760a573072a5464a9a71ee838f4b849

SHA1
1dc059b0c9ba89ee3cc925022eb9f55d330d0fcd

SHA256
1aa2f4ad3f9320bb69a065027a0c18ec0e2e171192dfcafd8c9c6e7d90246c04

SHA512
b804bddf0bfe8cb2cf0291f818b73cdaee716401b7f50db0c493e7b61ba560e471321c124db69bd5615530516d237863cc2fe5e8511c04a5c44fea4e19f8104d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
21deaf94238364701081a00d911cc1a7

SHA1
e803c50029f543664205bf0a0b88f0fd9db0b0ab

SHA256
30d9a7cbcc9bd1c533e0176cd9e830e25634ca72cefb9d5d234f3dca60dc2564

SHA512
e110db0b16253779875e854cfa43bb91a3c548f6339b64bfbfca41391d382eba3766e54c91977194c114956bd9cab03973653398f7a109dbf029ba932c86366a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
aad04ded6536796cfb869406f0ea95ae

SHA1
fe49d9efb6bf0926cb4b9d3dbb2b3bce970d57b9

SHA256
f673face1c0832ee9a2df3f8ddb7308263b498d9b343e01888791e442ed31aae

SHA512
44ba866471c2be079a4b1f5c28131bc0db64ee0f6b161e4006116a77648aedda1a8795341cacbf49317023737d6909efbeb6ba386b8142f3acc84df7e431f2ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d5c9.TMP

Filesize
48B

MD5
1836fa7ae108387aeb3c75e36b6d1516

SHA1
c0af7e2e1033757445f73c57ef599c85b33f8f43

SHA256
17955860488134484863e5fa3f1ee363d532978f9858511cde41893db2f5f170

SHA512
a6779367733a0c43710b3f0224e83c3405d738fd6c37268ec65135482b6871f1f3f5d5397d9539752e51be5b439f3dc578929606e9f0244bca99128fb59c4bb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3e40ec83f35ccb828cbac51b1ac98fbb

SHA1
72d211c8e59fc028324e1ba5536b3449be1f7b66

SHA256
387d02858c53c2994e48daad918b05c585e065ea52cee588425882391d13b3f3

SHA512
27e4c9495825baf3b24e977ef6bae5fd4e08178bd90f22c02d3abd2a4fa66ce94a639c43e57ceefed58e640442be911278a1935cccee5944b3c02884bf000ea9

Download Submit