hxxp://google[.]com

Analysis

max time kernel
632s
max time network
633s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
26/01/2025, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com
Sample250126-2cdt2axrgp

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3920	msedge.exe
3920	msedge.exe
4808	msedge.exe
4808	msedge.exe
652	identity_helper.exe
652	identity_helper.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4472	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4472	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 2880	3920	msedge.exe	77
PID 3920 wrote to memory of 2880	3920	msedge.exe	77
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 232	3920	msedge.exe	78
PID 3920 wrote to memory of 3568	3920	msedge.exe	79
PID 3920 wrote to memory of 3568	3920	msedge.exe	79
PID 3920 wrote to memory of 5104	3920	msedge.exe	80
PID 3920 wrote to memory of 5104	3920	msedge.exe	80
PID 3920 wrote to memory of 5104	3920	msedge.exe	80
PID 3920 wrote to memory of 5104	3920	msedge.exe	80
PID 3920 wrote to memory of 5104	3920	msedge.exe	80
PID 3920 wrote to memory of 5104	3920	msedge.exe	80
PID 3920 wrote to memory of 5104	3920	msedge.exe	80
PID 3920 wrote to memory of 5104	3920	msedge.exe	80
PID 3920 wrote to memory of 5104	3920	msedge.exe	80
PID 3920 wrote to memory of 5104	3920	msedge.exe	80
PID 3920 wrote to memory of 5104	3920	msedge.exe	80
PID 3920 wrote to memory of 5104	3920	msedge.exe	80
PID 3920 wrote to memory of 5104	3920	msedge.exe	80
PID 3920 wrote to memory of 5104	3920	msedge.exe	80
PID 3920 wrote to memory of 5104	3920	msedge.exe	80
PID 3920 wrote to memory of 5104	3920	msedge.exe	80
PID 3920 wrote to memory of 5104	3920	msedge.exe	80
PID 3920 wrote to memory of 5104	3920	msedge.exe	80
PID 3920 wrote to memory of 5104	3920	msedge.exe	80
PID 3920 wrote to memory of 5104	3920	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff84baa3cb8,0x7ff84baa3cc8,0x7ff84baa3cd8
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,14378310371954093896,2547443698437828639,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6664 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1492

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004CC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 53d69c9cc3c8aaf2c8b58ea6a2aa47c49c9ec11167dd9414cd9f4192f9978724
MD5 e1544690d41d950f9c1358068301cfb5
SHA1 ae3ff81363fcbe33c419e49cabef61fb6837bffa
SHA512 1e4f1fe2877f4f947d33490e65898752488e48de34d61e197e4448127d6b1926888de80b62349d5a88b96140eed0a5b952ef4dd7ca318689f76e12630c9029da
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e
MD5 9314124f4f0ad9f845a0d7906fd8dfd8
SHA1 0d4f67fb1a11453551514f230941bdd7ef95693c
SHA512 87b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85
MD5 SHA1 SHA512

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 215KB
SHA256 747c584047f6a46912d5c5354b6186e04ea24cf61246a89c57077faf96679db6
MD5 7b49e7ed72d5c3ab75ea4aa12182314a
SHA1 1338fc8f099438e5465615ace45c245450f98c84
SHA512 6edf4594e2b850f3ede5a68738e6482dd6e9a5312bffa61b053312aa383df787641f6747ac91fa71bb80c51ed52a0c23cc911f063cd6e322d9a1210aea64e985
SSDEEP 3072:xnFoCqtH0TTVwLdezRM6vC53MTQlq6ot8ZGZlAwlTyo1t694+m4nOn5ZC6dhk6E:5F8OWLaM6W1lnogK2o1M4+moiPC6wh
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 df2eed267bf48d1fb3598652dc599c0531a60e7e6eb468c98029f9ad9450072b
MD5 3696afa82e0e23d60ade8ba8f65eee8e
SHA1 426db8f02424e10abd8a659ef9f0b9fd35839333
SHA512 9f95e80a4deead814f7d4e1cd258439de9bd50733ff66e8b4bac659b70099f6907fc2062bc1dc716b5526da26813599da20454015b3b71f46671cdc79cbd3830
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 7cf2b8640d35750d78dd262007b900151971806dbf374c729d93b0964ecfe4eb
MD5 f05bfa1030c3e57d79495cd88488dda6
SHA1 3b28c1a51687360c4d74001f6d4c18136bfea793
SHA512 c0747ae3f10241eeb958c76882ea301fcd1b284cb3af990912851067dc61946b5677c935c8b903c94648d45c519cb7de8f96c8079b4b912082e33d3fc6235abc
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 dba0ff8ccb2090598a40677d0e6db32152f3c6935c736b94cbb844d0c1133cd9
MD5 0b855b0088fcf4c9d3819e906c720b52
SHA1 2c24497e9dd5cac03bd219c2c534459054041630
SHA512 e9e953e46f66685ea428d25a418edf105031f6aff72e35385bc251a5d3fbba2dd84ef3b28c88843090baf47e829dc692de3a256be42ad533d745718a5faf4a50
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 c5aab7ca2c5779c8201d7a8fb654f9ed423407fed20df5ec144b41ea68ea9317
MD5 818b462ca53e46d1228b9dcddb905aab
SHA1 3984b54fcb1ac05e831c5fbf06b9b7513f405f3c
SHA512 2c856e695db6f82087928370f9e246fc74c80e4cc03b6e5daeab226384931482db9e1202a343fbfb4f999e62fbbeda8c0c0bf813390e2cd68762d39b26f7767c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 21a338fb24f8726a5a9c4ac5a0dc744fa9592bc6b4acd39dc604a2e562036872
MD5 04f34cb893a3e3adbaee572caac3b942
SHA1 3ea5207e6ca5c6b31513b5588029b1ac8dc79944
SHA512 60eebed18abdd9a6345ebcb36eca72d5341d99faa617fcc66aecf369dfe2ada93b890bdcc92decf2fc5230ffba8a1ed5f8d6cfcba2bf35525222fe73392281d8
SSDEEP 96:nuk31gRk8kswSv0MoiVmdHIQJx0WQyV+VuziX3wI3:nuk3qRk8Pv0MAImxLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 22dc73b849818e1773f8b229eed32479ce692527027728f84176628533dc7f4a
MD5 1da5802aa7f09cc59e147d5523887d77
SHA1 296c51c27740715be8f944dc7ad870bac03dad91
SHA512 861d09e5aaca6359ff86ef5afa18ff879b44168c0093fce25f32beee25e8af2aa702cecf3b5da08b9893753aa56b8728a8ac9560789c76358293d81ef05ecdd0
SSDEEP 96:nuk3jgRkykswSvtx0MoikR5mdsup1wui10A2IdJx0WQyV+VpAiX3wI3:nuk30RkyPvP0MkjupauiaA2IHxLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 7b1e2169dfe4d4fcb838833ff3b5b8a2c7fb49d7b5f2d05d81e6610e78512b20
MD5 f4f9ac7bc69634ae65775127b80b298e
SHA1 1833482d6b8108e2512ec10b6e09b43771d2c211
SHA512 b165638e3cff3b64e7a25b764957d0a6f10226d1b5eeab706f8089cac1e4a73755a1f39f6d4fd2d7392a1797c9bad3d0e562d16342239d6b6a9f92ddf4f64e1a
SSDEEP 192:nuk3xPRkPPvP0MkjupnYJUui3Z9IWxLe93:nuexRkPP0YEYEWxC93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d796f8f951d0b3a1f6cfe5e678aafb0907a1df7ae3259331a293e22e57d21203
MD5 01f95411a866e4a451589ac0bd7db4fd
SHA1 eb7086b2e8b14e9279ca06872e5c171caa64469e
SHA512 e535fc38c2eb608ec1fcce9421648433e74a7b18ed6fda3b59c7b42fd6cf96efb64a498f86d7a73a66881d919e3557a58048a03bb71abc5d3000b68b0a4039a2
SSDEEP 96:nuk3NgRk0kswSv0MoiVmdsup1jIIJx0WQyV+VpAiX3wI3:nuk3CRk0Pv0MhuphIOxLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 e3b568bdded606e33aecdfcf709ae4d88abb408133d053057dcd3c352c5af3fe
MD5 05a9c751f5ac78ae6796380c7cfbf1b2
SHA1 164564a6b4292511a81dc55a7198bf3c88af45ea
SHA512 fb0483e8672525f4abf7e58453e8cffaef658074327f422f87d8d23548b6fb205e5bf78234b894fda82caf2b36d5d42efa0f921aa2dff5d24eb8da0f9d42df6e
SSDEEP 192:nuk3HRkPPvP0MkjupP1yawaui3Z9I1+xLe93:nueHRkPP0YeiE8xC93
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 97f9d7cf97914989493449365c5a1853b7b1059524d0e0e6f7cb49378f67f603
MD5 dab7535fda25c65b341f8b2dc652cf89
SHA1 c2fa775bb6b67ac87a65ed9cf017d79b473b5ea0
SHA512 88d536ac6a932b2074d0ba3ed452b2d02597f1e42bb0b06b918b5204554ed37a14cfd8ebbd7c4a6b7ed7aaba4a9375fa85572f5e13695337bfd8e0e89dee62a4
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 d2cf15d83c29d8646d60ec47e1ed866df5139556b50f142f68f77120fa099430
MD5 d26bd33e71f12f59e9c0f2d97c319239
SHA1 1cff085737f5ea9677fe11c0a963b3af49c68504
SHA512 97d5720a41c4fd663e3be16e7a78ff43caf6f1c3f075be7437e48fb488489000d37aa5e37aff843aa1c348efc924598184fa2f75e1c2fe7304094a492cbc89e8
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 9a3a92c6d64adc0b6799374a45e0d5d7ec3ca3afeff35040484283a05e49c953
MD5 04bf5e9004a42a5a9f05dda45b96a9da
SHA1 ede34382e0af84f9c9a224dcd7d2fa5b6a678230
SHA512 90c05138a395f426d497af8e2f82a8fc70090990a0c529f34be2bdb96485883a13afb7ff143dbd38ba0947ff54d8cd4924223c493b9de6af077ca0bbcb855283
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 1dda0f8feadb8f5152a490ad23eed381caf12feed5dd5cebfd6d949d051bf76b
MD5 771223eaed338bf3ddcd8ee49853712e
SHA1 71e31763f2c5630b9abd6add41ac200705058234
SHA512 431a2afeb5c1160cc770b4d3a6a499350d985486630b5f8367bdfba8e0c5f0b954955abee9f35b50b95343378e642fd7ae96539c03100cee29300ffd325a8c1b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 85b1366462573147fbed60f9159f0c1eabccee63a73e6a38df2433a2c2f592e1
MD5 f88a69f21ab96dd836dda046b4530afd
SHA1 66dd8535c7211ba456e70307a9a47059e550ee6c
SHA512 023dd18061f464fe3e2ae81b847f3b201f4b355283f031ec6f449457eefdc95c52f32c6bfb1bcdf0ded44b1ae1447430202b1d6ce0b6111cbca2c325412e2c3e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 b8d4d545a6b3955936e2f8ed6894580273edf98fb40cdf967cdbc8aeac2f4c50
MD5 bd8af222125e221043ba742b79c5f8b3
SHA1 0461754a17479f8424fbde47cd56c5dde960d037
SHA512 60e529ad185df28369b80c6c796d127b00ba7933b86908f4cfd8b8202884195a3016e308e9dea7b4dab8e33424f810f8891b6dca3a84f6c94cfcafad22e96162
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 d59cc838c5d670f85cc96ec25876d8f514bd8b4c70135e1674003bf46f386aab
MD5 f0c69e94f74d3bda581d27752cf441ae
SHA1 cb1ecfabc9158083523050189955d649747577c4
SHA512 bfe6214095d8a7e583e3c3fd9b5e720f3cd368b51bb9fa547354eade9322ebd89ed73dce0fc345bec2e939926596b1548edac27743c15a47be338ba8d88ca1de
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 c4c4988b6f6675dc3b2bd57c8a6a8a12104694fe9cd0fa45029df3f530eb968c
MD5 e784bc3f40a4fa3536a350a4855e19d9
SHA1 29f1e7cc7a6bd9a1d1de2f7d5bc7707591cddbfe
SHA512 cab98603c8ee000c288a48e0a60d45e6eb91f830419cf546962184b0e515cdb1aaefced07354e6a13cc1d3defd98280b8d76304cef5a68b40d401556ee050636
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 15667ad2262a9ab56a0e681805c222ef567d6ce5465079a8de4081321cb4632a
MD5 768cffd2f6888b1888d3772aae8b0569
SHA1 6dade9af007c2f59eeab5d851e8235f9ed82064f
SHA512 5f41819cac15a64d87570d57c599bf93a124fc3211859774755c118db1ff7d919bb848ea36f2a39f7a04c17a5dcaa95e1bd9d89f0c340c0fd264bddc7981b7bb
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 3196d918a19c081ba0846e8f9eee5a87326a4a63dcf0e9d888ec9146b3a605b7
MD5 7fdcd74923217318e5c9eac1f51579f0
SHA1 83814cc0e6c6afbb5f9dce54df559168d844eddb
SHA512 26005b085eec78912e3c64d6a10e9eb7627345df20e14fa71bb753c63f119aa8cc65728827e36a2c2f5cd51e2bb660258e0cef87b65a4985ad77c3ab3fd0a805
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 5a0e349fb5c5c21976ccfbac6e782c21ad06f845af1326272ef556280996a81c
MD5 b7f0c491ef74a89b07af91f345ed94fd
SHA1 72daae78ac667d26efc1e2f513964c4baf1590bc
SHA512 15b2f680808f307f8a5b7e43accb90b294e6affda2a7e30115cdaf440bd7b194cd6a4484f1497a8f9f14003bc741005d701d557666658a57399e5db6a8ed8174
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 464fb96f3eaa6d8620c5703f9d35feb92ebb6c0dbb71dee66edc62c4783ef4b0
MD5 4745c8f9e3de8b76f71e1356523cd9b9
SHA1 a2dfc03bcea6b230887a8c55b0f1c53e515e4e4c
SHA512 4cd5db2793df2b2ed1de935298db765c6baa8d3e9b76c76cf33087753b37c344279d7160174567bf308ff4ec806f301d3e889199724b102bb303398701a04dbb
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 3fbeb92be239c051d164a21d5191108dfdcdcbc8159e0d6c66ebc9b4899df2cf
MD5 a47b8bd7aa34b2a722fd6ab950e022d5
SHA1 eafd922238c2c26ee37b459c1ae96b90e88be09d
SHA512 28dec6b3df5ed67d891e65aa24fbf725ff6bc14e04b29acb0e2b1b8c0dee3a9110e1f92aa61f3cac9ac903d758f6b48b1298cd2369a53bd4989b4220128f1101
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 630785a0ad704d7135ed4ed5cfd55e4158831f54a80a5f6586be2028ec343666
MD5 c24e5f595b7913b1ea8dd28ea28ecebd
SHA1 f7667f908e341ab9b317b1f5bdc19898d8ae005b
SHA512 ea4c53818af3f13456d685639f1fb63a0490bc8b11aa61422b9cf7d6e9812d7d83766dbdae6c16fff0f9cee2d99c13b30e27c53fc8b423af68079c1a824a031a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 711b532c52e6e341465a659cd21c393082121f310633af957a3bd63fb83c7952
MD5 e8671ede5bf54ad86c50825130281b28
SHA1 19a3a815bb539f5a893c60acaa62df5fceccf648
SHA512 e7091562b0af6843311ccd3f91f3fa055a742f2b63364e26896bcec8ad7493bd5eb82eff326420c3e30065d3b4860e20b2bdf43c18b475214e61d5f2b99ec5c5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 552d6ffdf69e3bcbf73828b303032c8648b99197a6a31139c4f803c98c462339
MD5 44988aaca51325b7089821da7d8ba2f0
SHA1 a19d6c38fb37ce415b0483c8ebfb04ad58fb8117
SHA512 185fcee6e2f6cfd65fd52035fb1ea1e919181d6e966e93509a08b737a896da840dc42c859af0c4fda79cf4ea484bb660235f94ea275adfa3bf5f11d0fd155319
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 bbdaa4d7833561f2d2b13cfe75dfefb0d7b215453dd84147702eb2aa955d6c02
MD5 af4a4e3ca82dd7baa5bcac034f05c7de
SHA1 670aa2cd281d763412ba82e8ac18f87c1e76014a
SHA512 347d652fdd90995f56d8106e89324eb34d73af8cfa16c9a3c8057648887ef55f95b5de0c6c6b398ac0a8d53d7d29fe867c7e43f254112967ec9754c924faa7d6
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 227b34e07df7ffca9d2c0787fd8b9be14c7a0b91fdc7ebe42c8159ec40339045
MD5 81d7bedb6850390773719400bd4ce46e
SHA1 8848ddafa72a70911b74c86e3b262721e29bddd6
SHA512 4c7b4c4ce03096870a3e11df7e91122ffed66f0b82399063561a383b8c6b6993bdf46f80ef6b8717a16fc40887e6d3aaa32bd1db0fb2ead970904bc303a18f0e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 67ee0edcf8911b9a146af0e92c702eb6c09abaa3b5b5077d1e7672fa1c837b62
MD5 dbe19b3adf212475a9a402adb7214cbf
SHA1 0ac81b8c5b0aafae0a3ae15727f5571b58e09573
SHA512 3af104b1ec8368d1d3d233512577830bc0bccd7564084a128fe5e470f3df4a55657b6a6f7ded675ae0fd5d6a42b4369e70ef4d0f1dd7ed1c8d903a39499f2e7d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 3f1be3e974234231fa2cedd73f92650415830dd54106e6c8dc1556c4667493d9
MD5 8d2d18135a888e86706bbc6868b2ab8f
SHA1 6672aba920da200397c7072b97ec641dc6c06295
SHA512 1c07e7ec6b44256a607adbbd7d07937f9c0562556d188d87d7ccd3dafaa242516ce8474088d14db26c77f74e66ba5ff5ba1a3ef91f60fd16472ba2e68656ee62
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 8eafeb2d79c7b323f9d0ff8e0c35e7b2459f8c86b7d0d5dbbf12edfc98cbf469
MD5 a04795d23bd07b1a4d30d43f548f1501
SHA1 df334e9a9a71fb5fe0ae7feed4ebceca6557708c
SHA512 7ac605c695eb30bae94826b0e30e13744c5bfdf88d35036afa94fc673428d0a7289d4ee15c841c9e56247b07c5791536a9123c90ec2933b5703e7581c8e61297
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57fadb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fadb.TMP
Size 1KB
SHA256 fd05e72ecc9a3bf1309b9e547e0fb8b25638da6ffab9c00641842d8b1e35715d
MD5 a02493b1ae7c3561ebe4efe6f39ba8db
SHA1 78da5e9bcd91d9a30f028c76d6994984ef254e69
SHA512 cfbf1b77bc77c626cea76e27ca5516fd49df0f89aae0a4524ffc99f8d83c46c0f0f1e3ac807dcd0e924f5fe0f3f5e8129854dd2ea867ca90a4f1c1c9b5464fac
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 b3c26ab37a23d8c8f87bc4f9cec6c3fbf61081867db14917ccf61ad03d060a72
MD5 74e906e73fd904c2114790b1a3416d6a
SHA1 9518f21d69a61c1e20c20a3060b4e3a5e576e43b
SHA512 ef5701fe86eada50ee227ea7fe6a957dcae8edda484c78894cb558d61a0c4569cd58fe89065395b9324e7c53ad8e74e57a3f3b0597f8277f7777a1bfb81ee868
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGHzzFve2RUj7SO7jpJscI21SL:M9iIxuERzA83h09RZxASGTzRW7htJscy
MD5 SHA1 SHA512 SSDEEP

Submit Download