95a8a01864eb330d0e8bfffb4202044e88f8c2e344d4b054ee943ab51a95c631

Analysis

max time kernel
209s
max time network
211s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
19/11/2024, 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

40KB
MD5

6b2396d081f35df536a1ef1d4435ef7b
SHA1

7909d364dbf4f066b5d30530ba5d6befc6d80e03
SHA256

95a8a01864eb330d0e8bfffb4202044e88f8c2e344d4b054ee943ab51a95c631
SHA512

dbe4c257470c882b94b11bcb62bd0a8e30620d55a89e18381857d748683f94e99136d172639e0537cb06d5955c5fc4e543a13634f191583a7f7a904ce51f9403
SSDEEP

768:jAXHyc4PQ919NVAHASzRugOK9DMtrEdc2Vm5ENj:jAXIgSbOUDMtMrV/B

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
4400	msedge.exe
4400	msedge.exe
3480	msedge.exe
3480	msedge.exe
688	identity_helper.exe
688	identity_helper.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3480	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3480	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 4004	4400	msedge.exe	77
PID 4400 wrote to memory of 4004	4400	msedge.exe	77
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 4104	4400	msedge.exe	78
PID 4400 wrote to memory of 3532	4400	msedge.exe	79
PID 4400 wrote to memory of 3532	4400	msedge.exe	79
PID 4400 wrote to memory of 1808	4400	msedge.exe	80
PID 4400 wrote to memory of 1808	4400	msedge.exe	80
PID 4400 wrote to memory of 1808	4400	msedge.exe	80
PID 4400 wrote to memory of 1808	4400	msedge.exe	80
PID 4400 wrote to memory of 1808	4400	msedge.exe	80
PID 4400 wrote to memory of 1808	4400	msedge.exe	80
PID 4400 wrote to memory of 1808	4400	msedge.exe	80
PID 4400 wrote to memory of 1808	4400	msedge.exe	80
PID 4400 wrote to memory of 1808	4400	msedge.exe	80
PID 4400 wrote to memory of 1808	4400	msedge.exe	80
PID 4400 wrote to memory of 1808	4400	msedge.exe	80
PID 4400 wrote to memory of 1808	4400	msedge.exe	80
PID 4400 wrote to memory of 1808	4400	msedge.exe	80
PID 4400 wrote to memory of 1808	4400	msedge.exe	80
PID 4400 wrote to memory of 1808	4400	msedge.exe	80
PID 4400 wrote to memory of 1808	4400	msedge.exe	80
PID 4400 wrote to memory of 1808	4400	msedge.exe	80
PID 4400 wrote to memory of 1808	4400	msedge.exe	80
PID 4400 wrote to memory of 1808	4400	msedge.exe	80
PID 4400 wrote to memory of 1808	4400	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdcc063cb8,0x7ffdcc063cc8,0x7ffdcc063cd8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2220 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1792,7239347577708047413,13896663666018100652,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  PID:3336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2924

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aad1d98ca9748cc4c31aa3b5abfe0fed

SHA1
32e8d4d9447b13bc00ec3eb15a88c55c29489495

SHA256
2a07cac05ffcf140a9ad32e58ef51b32ecccf1e3ab5ef4e656770df813a8944e

SHA512
150ebf7e37d20f88b21ab7ea0793afe1d40b00611ed36f0cf1ac1371b656d26f11b08a84dbb958891c79776fae04c9c616e45e2e211d292988a5709857a3bf72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb557349d7af9d6754aed39b4ace5bee

SHA1
04de2ac30defbb36508a41872ddb475effe2d793

SHA256
cfc24ed7d1c2e2c6585f53db7b39aa2447bf9212487b0a3c8c2a7d8e7e5572ee

SHA512
f0cf51f42d975d720d613d09f201435bf98c6283ae5bc033207f4ada93b15e49743a235a1cfb1b761bde268e2f7f8561aa57619b99bff67a36820bc1a4d0ec4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
b275fa8d2d2d768231289d114f48e35f

SHA1
bb96003ff86bd9dedbd2976b1916d87ac6402073

SHA256
1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1

SHA512
d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0323cf5f84d7783cdadd00ff8120de4a

SHA1
0e23bc3b56638d6c4a181c9cd8e5ad7ddf10a78e

SHA256
e5d71077a7fc01f6464764bbf5361fc31056d4564df7db5145f0ccb5cbc09834

SHA512
c4d576517226fe01fb8d8a7b8f76fb9ec599ea6c99c4388c32cf1a60accd5aa2e5be9f7c1e0210299375a57526ea7f1f73496bf66e34ca5a6dc08d4130795999

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
312a1d62c79c13b02ea91b69e1c1b0d8

SHA1
4bc87cc7c524efe04d88518163231022647790ee

SHA256
bbccfb9ee602be0fafc9aeea92a6e433c1f0cc4349b5978ff1dd0dd521d6e8c0

SHA512
722de72d14808eb6ecc2f4445aca12e0f9674c516902c3457c077af0ecaeb5de7aa1a1e076d4a77f3beda1a21ca50d982b813e22dca869c02bfe1ef978f349cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
236378fceacfea556896d1a169c932f6

SHA1
a02cbdb1670bf143a533d32f441526b174e66647

SHA256
38f3ae7e98af65fc741f0aa49215e5d4b224d1902627070003cf0a451b28a33c

SHA512
19ca17381879c015801988fac82ce91c8bab83e533ec518de5c17cc3b48bab76ab52f85c21928b7df7f3e9f77872384062d9e6eb4775a1a762079989a593ebba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
07cf608303f3f5449cc89f693e68f553

SHA1
7b86f1d6a7b686d5fca3d4c41a84cb8e905d6786

SHA256
54150443a7ea3f109af52159455084baff2686113babb29ba99c7bd13881e363

SHA512
9fdc2322f49c01dd993c57d1ea298b81248d15a00e7612c965580cf5613d3f733f0fd4453681175df765b2e3e4ea3213a58f26956a43ece51760a3931282553e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0d2a04ae955e073948c0a56ede3683a8

SHA1
f520ea79c34336703b27429f5d34e529861a00ab

SHA256
98a0411caefef246fa9c8a57d518a48c1798aba7f1b4528b219efb146b5dbaba

SHA512
0380cd5eefc1c248c25fbda9d413ad01e6d4248ec5f14de2996cc8fae42434d8c55ab688912fcbcfff34b36be47d3f6c9c7f415aee3578a6682da2d266a6ed36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
48469f4dfc6b68f16e3416fc8fc89a4b

SHA1
d6b2a92177d4145ba409e1a4a5720d0d3f0c62bb

SHA256
68902b039d5ddcf177d2aaa58a8f8df4e5a1d33efe1557eef5b10e0e03c1b0c7

SHA512
6077281bac513197d3d3670013afa5718a405cb6150ff7409cd8849f424a5fc34b754647862136973574ae673205df1cb297951d76288797d91df651784d7531

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9af5b626974fbb44568bb1fe893ecab5

SHA1
570842aff317ec35f97d6ce789c2d5d93fb89ec9

SHA256
5d280f542f0fb3b4a46a330c68a9d82c2c64cf44d86266d13054c04c7abd020b

SHA512
7e9545c3b66b0751b1820121d5b5cfdeb7325a1d939b58772819210a9860f82d9c07279a0c3fb16a9a93903a546e5e48b27fc7078681b150721d239cde3bbcc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
968cbc022a9097f21817a39a62743655

SHA1
cacb5a3c6b93140f1bb4380eeba76d1c93ebe498

SHA256
0f19d37db2140ebd86a3c047713a8f0f22a3cc2f7e167b59846d7967833784a5

SHA512
0c7ff68d24a295d5d45dbdca11b8a28d28ed82b1315e83f84d8204c723f868e279363150fec4cf9af25c717873add5271b439860d2668bc5baea9d893877ba5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5a2afe4759ee274bdd043220336ad7a1

SHA1
4ea0287408e1141094a45592f842a361d6244347

SHA256
678dca33e649427c2a4f2198d78524ed8f917a76578a86b504ef0da264c8b1d4

SHA512
9ecd42ceffe442797025dd60f2bc60955bd51bd485e7e5a5d7d0ac31bf0f97f3ab3435897efcd1dd18de3a1547303915375d28c57ec3d505714e23e6375085bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a257b.TMP

Filesize
705B

MD5
d63b4e859432d7aa3dc42e06fae43eca

SHA1
119a937277db722a550d1f1cd4c84bfda80bf64f

SHA256
07fc40084356e69f74518905feb9f0959d2001aa6983b59a7fc5c0b4741ed64a

SHA512
fba05d848b4b4a04a9f31fd11b6f4ee99684d25f70c0153399088973bcbb34e090ce398ea594c7d80de2e3d036743489ceddd9bd7f4c6ee8aa64df3f2e9fb383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
76a355f42a9653938279418d2a3af381

SHA1
44ca3cdb1d64fd49892eb8881c221157c28fab2e

SHA256
397530e228e9b95d19daf65a1b7b3e4da3e2e443672f38fbfdfab1f81153e63b

SHA512
a59ba972698e139ae1786f3b819ddc90064407a214c72e13dfd1dcb732c20f900bfb8f68883b4c6d883ea093e92554598faae66cd8b0ae155dd62a8851df613e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
58ea8484fb631adf41ced6427c291fcf

SHA1
00ac4b220a2119388f8ea5f0e61f62942a13b54b

SHA256
e10a97bea94f2a2c88ca96fd006ae9eaee6168ba0d4d4ffb1f976b95d0d0f02c

SHA512
603233f23ff477c3f5d61d79a17767cff1296a03ace300abe0ac524166c5e2be728c356154699d86b79897305ab88e42bb7955e7006fc0ccf4495492afe84fbc

Download Submit