hxxp://irm hxxps://massgrave[.]dev/get | iex

Resubmissions

22-12-2024 03:02

241222-djhjss1ke1 4

22-12-2024 02:52

241222-dc3amazrgw 10

22-12-2024 02:49

241222-dbf11a1kbm 3

Analysis

max time kernel
145s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
22-12-2024 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://irm https://massgrave.dev/get | iex

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3940	msedge.exe
3940	msedge.exe
2344	msedge.exe
2344	msedge.exe
4984	msedge.exe
4984	msedge.exe
4940	identity_helper.exe
4940	identity_helper.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1068	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2332	2344	msedge.exe	77
PID 2344 wrote to memory of 2332	2344	msedge.exe	77
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 4856	2344	msedge.exe	78
PID 2344 wrote to memory of 3940	2344	msedge.exe	79
PID 2344 wrote to memory of 3940	2344	msedge.exe	79
PID 2344 wrote to memory of 1300	2344	msedge.exe	80
PID 2344 wrote to memory of 1300	2344	msedge.exe	80
PID 2344 wrote to memory of 1300	2344	msedge.exe	80
PID 2344 wrote to memory of 1300	2344	msedge.exe	80
PID 2344 wrote to memory of 1300	2344	msedge.exe	80
PID 2344 wrote to memory of 1300	2344	msedge.exe	80
PID 2344 wrote to memory of 1300	2344	msedge.exe	80
PID 2344 wrote to memory of 1300	2344	msedge.exe	80
PID 2344 wrote to memory of 1300	2344	msedge.exe	80
PID 2344 wrote to memory of 1300	2344	msedge.exe	80
PID 2344 wrote to memory of 1300	2344	msedge.exe	80
PID 2344 wrote to memory of 1300	2344	msedge.exe	80
PID 2344 wrote to memory of 1300	2344	msedge.exe	80
PID 2344 wrote to memory of 1300	2344	msedge.exe	80
PID 2344 wrote to memory of 1300	2344	msedge.exe	80
PID 2344 wrote to memory of 1300	2344	msedge.exe	80
PID 2344 wrote to memory of 1300	2344	msedge.exe	80
PID 2344 wrote to memory of 1300	2344	msedge.exe	80
PID 2344 wrote to memory of 1300	2344	msedge.exe	80
PID 2344 wrote to memory of 1300	2344	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://irm https://massgrave.dev/get | iex
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffab87c3cb8,0x7ffab87c3cc8,0x7ffab87c3cd8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,15347031020383165459,2681769147611075345,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,15347031020383165459,2681769147611075345,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,15347031020383165459,2681769147611075345,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15347031020383165459,2681769147611075345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15347031020383165459,2681769147611075345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15347031020383165459,2681769147611075345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15347031020383165459,2681769147611075345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2080,15347031020383165459,2681769147611075345,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15347031020383165459,2681769147611075345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,15347031020383165459,2681769147611075345,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15347031020383165459,2681769147611075345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15347031020383165459,2681769147611075345,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2376 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15347031020383165459,2681769147611075345,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15347031020383165459,2681769147611075345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15347031020383165459,2681769147611075345,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,15347031020383165459,2681769147611075345,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5556 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:764

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:4976

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1068

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5431d6602455a6db6e087223dd47f600

SHA1
27255756dfecd4e0afe4f1185e7708a3d07dea6e

SHA256
7502d9453168c86631fb40ec90567bf80404615d387afc7ec2beb7a075bcc763

SHA512
868f6dcf32ef80459f3ea122b0d2c79191193b5885c86934a97bfec7e64250e10c23e4d00f34c6c2387a04a15f3f266af96e571bbe37077fb374d6d30f35b829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7bed1eca5620a49f52232fd55246d09a

SHA1
e429d9d401099a1917a6fb31ab2cf65fcee22030

SHA256
49c484f08c5e22ee6bec6d23681b26b0426ee37b54020f823a2908ab7d0d805e

SHA512
afc8f0b5b95d593f863ad32186d1af4ca333710bcfba86416800e79528616e7b15f8813a20c2cfa9d13688c151bf8c85db454a9eb5c956d6e49db84b4b222ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d19c7c73556fae75485812d04b891440

SHA1
06c52667e0de6e41b880e25003a7f3755d6570b4

SHA256
5869d5bc609bf8e6f4f3e25dba98e13dd1a35184fbdbea32c79653560bd2d881

SHA512
73fbdc0c5118e76cea181eb0b6355b75faee3e266b6495078ca9d4aa3fde3168eefa7b2b260e8110008a894c6c72c01b673b2661c5acbbfa89752f4bd562af87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c85858eb42a93f26bf81009863d2cfc

SHA1
bfc5d000ac1745ce0bb86e4c221a34d4d2bec3e1

SHA256
603f25e137b5b5351bbce145db98e793bc4dd3b85a5971fe41d29cc4051fed91

SHA512
701bcc1ff108c99e7f35476f36895f9ce3717f368fe6cf9e77874b7933efb5b7b0fef3aec4d7dfe10ac2c4f7c90e2503496c9c50959fd2d6caf130c500f5f58d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3491fd5cf7dee701caa1136f2debd49

SHA1
3a117883acacaed7de10cfa8f9be92104bf6d4e0

SHA256
badb9aa9f5cc92059e414b25d1249f9785eb3683ae156e4618f4c425cb110a09

SHA512
a17c2527cb32dd14c2a871f1edb9f391b17f8525e5a4dfe12e258fcae2dd39b0675c878880de29322e1219d53aa5ba803cf1350932b50efea9889f3cec28902a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
31c9133bfc4175d21782b2dd9c205fe6

SHA1
6c8d6182206670869a9f2da8e1f716b692dc125d

SHA256
dbfdc730c2c941f3395e1c21a175afd4ee792e3db80f9ce2e018a1adfd151cd9

SHA512
76455019fe18b86ce2c98f97366d18cdc0c8add7436ee37ee3cd7991d2ee0387fb81e0d99cf15dad4c8b51e03e95a16eba20efee3a147659147b4ee7bb66c26b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4fa2c1e799a1c71250bebead4cf51508

SHA1
676206c78c8cb3e9e7016cc3d5467029687b5644

SHA256
e8a4fdb419445b840eb1596226baf2d4d0b4c02d177c539f7b0c572bdf07738a

SHA512
4dcc3b0b737855cf30b8eb24129621b2c8a0983cae7b6aa49b56547734c845a83528f406a626d72a70329f109afd7606f1252601d05de04c73470f9b48f68096

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9890da74fed6dc8c01d3f5c4786ea8b5

SHA1
114d853628370f574d4842d1e851df6d6f446d3b

SHA256
82309bd973ad8ef9ca7b1f230dbc60952f56f66876ae5c919299a875ce468884

SHA512
59270e67a6730c5f100721e5a7d8da4e8e5226947a91548dfe7550ef2a40f25a82f017ec1b56e409acd66478d798581e3fca2b1b2cacdb142809aadb58dbeae1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a0141bc358c7e4ad366c6404e4829cca

SHA1
585fafde689b67a955c8142b2b4f71983b082afe

SHA256
18f7d57f2ef82123465a8f21f83280d0185656a7ceffa024b1826ac865bc852a

SHA512
c6995531d7481410b13a4bed8c3e1fa769ddf6b8d73e91184883f030556d23bb076188fc8a19c51b3875ca510fc55fd3d627a43fbc86232340e880d7763d040f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d2070fee02940f7c61a872be8c79f2f5

SHA1
14789bc2878a711df47da1e4798b9ec54624b144

SHA256
b1c7c6c04be0d66580bdd98d800c17fc07a8d3081b0625caefc1236c2388c513

SHA512
0a29d3bd571a0693fc094b9270f2b853cac00483c73c2f36351baed06ff831a6da05e9c2bf82454a48dc2de4c9a1e791fe3c9e57572ef437d0d9996a158106ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ae679d78ca98853e21a1b21937c008f0

SHA1
91772f0e8361f4b86764e72f5065ddd88986a3dc

SHA256
e435d0e0ee84f5118c12909ac5daeee08a3ea5d698638ec46f8a90e3056a3114

SHA512
459ed22d437c98279a4187183530bd8f063465d44c4c62a08582f816c4cad60604752caed97afa3285baa09452a0b143a95110b257ec2dd45a47c270e3157cc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0f44c9284dd5a35b52a09870174413ef

SHA1
b027f2001e7d0cc1ecd204130b567babddb4f6dd

SHA256
a4bc0f599d441e74040f22e7c1b147d22d5a8f57a9556c583654fc6a5555e1dc

SHA512
33daade4599484c717188b5bcda6910a3b27a725469c376c85014879b779d5e19aae817c278e1d7c9454d5269efb82c5c7d93e52b0dab060201549a71906c668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3cfecc3f0c69d0f1ff97fe6d233bf18c

SHA1
d38df5fd0a42274a964d0d4fea9313cb9e6049a9

SHA256
52081dfb21c3751827a35e53144c8fbe2ce03683f983db10a8325cbdfad61c3f

SHA512
0be03d355f6809b3e5c427f285a40fae9437e510c24f5bcc10bb4b2915b3ad094aafb02896070e9ce4d017cdd7ce51a95e44abddcdf74f72e2e2663648086376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7fe1269b8bb7bab738a53151549076f2

SHA1
760956caead5faa620c439cee89e6db1b8f18491

SHA256
7416a21d202a4576af6c73d835093d1662e07b67ba77cc217af55addf6da32fe

SHA512
342091625681382e6e78ca8d8fab5c942e07ae64f8b51d02ff4c2b915f7113ffec7bcb5c30dc0929bd068dc19d28374d92ccb9331d5945268e74e29f4d714cad

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\6b7b66bd-c9d9-44c2-9ea7-431eec004d99.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmp

Filesize
10KB

MD5
1301a13a0b62ba61652cdbf2d61f80fa

SHA1
1911d1f0d097e8f5275a29e17b0bcef305df1d9e

SHA256
7e75ad955706d05f5934810aebbd3b5a7742d5e5766efd9c4fc17ee492b2f716

SHA512
66aa4261628bb31ee416af70f4159c02e5bbfbe2f7645e87d70bb35b1f20fa915d62b25d99cd72c59580d1f64e6c6b5ad36ace6600d3bcdb67f45036d768ed8b

Download Submit