hxxp://greenbookglobal[.]com/travel-the-world/11-sundown-towns-in-texas-you-should-be-aware-of/

Analysis

max time kernel
262s
max time network
281s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2023, 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://greenbookglobal.com/travel-the-world/11-sundown-towns-in-texas-you-should-be-aware-of/

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
2284	msedge.exe
2284	msedge.exe
1992	identity_helper.exe
1992	identity_helper.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 3020	2284	msedge.exe	45
PID 2284 wrote to memory of 3020	2284	msedge.exe	45
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 1320	2284	msedge.exe	83
PID 2284 wrote to memory of 4228	2284	msedge.exe	82
PID 2284 wrote to memory of 4228	2284	msedge.exe	82
PID 2284 wrote to memory of 1616	2284	msedge.exe	85
PID 2284 wrote to memory of 1616	2284	msedge.exe	85
PID 2284 wrote to memory of 1616	2284	msedge.exe	85
PID 2284 wrote to memory of 1616	2284	msedge.exe	85
PID 2284 wrote to memory of 1616	2284	msedge.exe	85
PID 2284 wrote to memory of 1616	2284	msedge.exe	85
PID 2284 wrote to memory of 1616	2284	msedge.exe	85
PID 2284 wrote to memory of 1616	2284	msedge.exe	85
PID 2284 wrote to memory of 1616	2284	msedge.exe	85
PID 2284 wrote to memory of 1616	2284	msedge.exe	85
PID 2284 wrote to memory of 1616	2284	msedge.exe	85
PID 2284 wrote to memory of 1616	2284	msedge.exe	85
PID 2284 wrote to memory of 1616	2284	msedge.exe	85
PID 2284 wrote to memory of 1616	2284	msedge.exe	85
PID 2284 wrote to memory of 1616	2284	msedge.exe	85
PID 2284 wrote to memory of 1616	2284	msedge.exe	85
PID 2284 wrote to memory of 1616	2284	msedge.exe	85
PID 2284 wrote to memory of 1616	2284	msedge.exe	85
PID 2284 wrote to memory of 1616	2284	msedge.exe	85
PID 2284 wrote to memory of 1616	2284	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://greenbookglobal.com/travel-the-world/11-sundown-towns-in-texas-you-should-be-aware-of/
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb442a46f8,0x7ffb442a4708,0x7ffb442a4718
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,5486375737467544107,2965770189383416834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,5486375737467544107,2965770189383416834,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,5486375737467544107,2965770189383416834,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5486375737467544107,2965770189383416834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5486375737467544107,2965770189383416834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5486375737467544107,2965770189383416834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5486375737467544107,2965770189383416834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5486375737467544107,2965770189383416834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5486375737467544107,2965770189383416834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5486375737467544107,2965770189383416834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5486375737467544107,2965770189383416834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,5486375737467544107,2965770189383416834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,5486375737467544107,2965770189383416834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5486375737467544107,2965770189383416834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5486375737467544107,2965770189383416834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5486375737467544107,2965770189383416834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5486375737467544107,2965770189383416834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,5486375737467544107,2965770189383416834,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6692 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b5f5369274e3bfbc449588bbb57bd383

SHA1
58bb46d57bd70c1c0bcbad619353cbe185f34c3b

SHA256
4190bd2ec2c0c65a2b8b97782cd3ae1d6cead80242f3595f06ebc6648c3e3464

SHA512
04a3816af6c5a335cde99d97019a3f68ade65eba70e4667c4d7dd78f78910481549f1dad23a46ccf9efa2e25c6e7a7c78c592b6ace951e1aab106ba06a10fcd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
180KB

MD5
497835d373e12af4cd257487dd5d3612

SHA1
425950e9427926ac0aa7940c4a18a44ab59df47a

SHA256
e11ff08dff0a884b311133e2469146b2a54319cf60094511e098df0c3677c4e0

SHA512
aa05611f56185e02289345f9c286ca98f96d5e1d24c8d152605e866e60013dc2945fc60f826e81459003ca9c2b7d439c0f6fdd173cbee57cd751ee51b18d2bf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
840B

MD5
461baabe4681c44c64539693840d9ab4

SHA1
52c0555d7ba3f34ec6d16e2a89a7910c824f53e6

SHA256
3d2bc802919b77c7df5c2bc64c1ab34b7ce54b5a5859fd6da0c25e2b9761fdd0

SHA512
b83a00a3d68b537d3d47001fcda63491e70b321039f7c2b6554e922f5896041752e38bf6f9b3707a953f27af9c59a8408554c690164b01e60f94e4b10334f3d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f48f2443a387dd6a480b7d6effba45b2

SHA1
5217a99e830c66371b9992b5f6fd931b33a9afca

SHA256
66c333e8065b268eee1340c26cc682f4e70687407417e6da04503d9be064c537

SHA512
f9bc360efe05fcbb5ff394bfc71619441d3babbadb90cd5bc7858332a9955cc623bb9f33d5c38072d6b7fdfe7fc9b4833425b275ff8566d1b74e1b8a64bb22e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3152b6b0186f3799f18f13d07163dd6b

SHA1
ee5f9794b26c877a0181396b24d991ecd0bc72b2

SHA256
2b5307835c46dfa1e8dc929d01afecbc9161389b38ab88712b90329cb72cd321

SHA512
01443a343961952e7f865b9d9ab2741e2bcb7b4d66fb0531e5c8e0d5700f38ae9f9ece1e5594de3478e146cedc3e1d3c91a16fa96907c2ef027742b68c583cdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
82bc509b85b3f6d8707d5a5daf68ba57

SHA1
d3b4cb7ca7fa8730af4d81c7dc1a137aa1155846

SHA256
cf743f1cd0227b4bb31698c1a202853dde2652685afa861e0659696ad07ecade

SHA512
f05fb6e757ed1eb1e73df2e38673f948799632edcd56066518cfd7afb24e3147fa80a8d9301061dd7d164a05fd54f7b3b447f2cb4a3f914bcdfd20999038788b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4d7f55b9ab7fc1f5a6587f8700124383

SHA1
18beb596031a6031206365af1093413af8b2484c

SHA256
74d505121c1bbc223e6bd19d3e0ce50d5cb31fb2c865e2c16c481ea8336ebaeb

SHA512
8a5f0709a6614e90e0098b5fc1197c6720eb16cd7eec7435fad8c5d106f1e2138733cb24068144dd88fb88b472c27cd26ddff4ef516a4c211c15ce6a209002db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7ec520d4bda35210a580a6d9bc71734f

SHA1
ad7ccc763e04629c9ee9c3feeb190a865b897933

SHA256
da94e7a7632b2c779d502206fcab58165c34b72c74382fb872f3ee4fed601e7f

SHA512
67793a57791edfedb8cf7e473d8b2c7434a5870319bcfb0aab83e736c0708742968ba6dc1ced07947b866d03a2fc2916e57419423ac676790825b2b23905aa66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
18011d3d3f197d0f10ae99ff4701ea57

SHA1
4d82769bedcb7eaf929871cd8d2802d5e9059b3c

SHA256
5dbb807eb2d0db2bed24ba40293d9495e9904c99344a01ad2cbbe2efd876f078

SHA512
81539d9bb395a6bd522d511f8a1bfee182218bf1ceb18f54fe3d792c7299d9a2f08ff551524e6149e1ab894b862a2885c6f21783b5e3436d5b349f72de34fb75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
29213338df67d29d6454ee5d61ad3970

SHA1
8c69ca76a2e639060d5ce835a9600e6ea3764a83

SHA256
d29fc0d97fa74d382d0f557ecea4e42b7d50dbce43915bfc0c114c16e532aa51

SHA512
14db25eba8a863d390b97fce4315402ed7c249598ff6c31d5a191b0f71c274eead42ba0658403e744110de072e6ff1cac3bccee1e48875bde6b1fe39a60d2407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5cc5821f571c98df8537ea60e6a9b253

SHA1
dfe1236fc847c3612928041f36b10898fb581dac

SHA256
1eaa354929a76d5fd48364328d21a87c3b14f73a54ae0aa3b8f5797295a46b76

SHA512
d18cf6bdc6a334c359b759cb1043bcfc3269a6fa48b0c013e5e22b2baa23c56d891f7a034eae9fe54ac5c75a5649f6b778b0a517d81d4259334c3f3ce2e6cc2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582584.TMP

Filesize
1KB

MD5
e1c439a306cd3a085601c8eafd8de357

SHA1
0a3253d538c5ab43b15f528add57e355e34555fc

SHA256
3d47c2e651943cecd5f913ae9a8ffdf30ef47a3da19d20808537c53c32459d91

SHA512
9594fb108e3ec738edc2b7ea8b9330c3524d1c30648b77050b0f91776bdae45a7973466efc8111ad4ef38e99bbfdac21339bb6907dfd02efb7e8e3c2716007eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
59ac94710ab6ef480550c6927450b889

SHA1
3b93445960c002ea6ae5b1bb883ff325adecb96b

SHA256
c0463403a27a1381ed8b1a386114557f7be0b2b13511c196ce0f20c657ef9359

SHA512
bb41cad37fb531494c46b09bd37bfd96a7c6f679a69ec96be48ed7ac4f6526a7861f1b720cfbef8c3ffb85a43ca1d3068105f180d57c5e255d570ac594ca252d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dc32dd3168c1c6170cf551c4372308d2

SHA1
11fd0891100e2c0174698ed1c16d04127a65747f

SHA256
b55635ad4e9636911f83266899f24e36b97bee51a89e8a29f7a61580c8d50874

SHA512
d08a1390398e1ed42a8e1b09c6426f110d194fec5e30c808577e598895c53fc1c6bb5a1323342d4b9f92417ae7f020eac46f315401d5e0ddf4ef6498a46c809f

Download Submit