hxxp://tersale[.]com/?fbclid=IwAR2hUI3MPAt2oLfSM-po1UfbKqvIXLhvAN65rfgzntMAn6j6x2_k8M6Wbdw

Resubmissions

12-01-2024 18:19

240112-wyg6padge5 1

12-01-2024 18:08

240112-wq337adaej 1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2024 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://tersale.com/?fbclid=IwAR2hUI3MPAt2oLfSM-po1UfbKqvIXLhvAN65rfgzntMAn6j6x2_k8M6Wbdw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
1536	msedge.exe
1536	msedge.exe
3192	identity_helper.exe
3192	identity_helper.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 4556	1536	msedge.exe	18
PID 1536 wrote to memory of 4556	1536	msedge.exe	18
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 5092	1536	msedge.exe	91
PID 1536 wrote to memory of 4560	1536	msedge.exe	90
PID 1536 wrote to memory of 4560	1536	msedge.exe	90
PID 1536 wrote to memory of 2944	1536	msedge.exe	89
PID 1536 wrote to memory of 2944	1536	msedge.exe	89
PID 1536 wrote to memory of 2944	1536	msedge.exe	89
PID 1536 wrote to memory of 2944	1536	msedge.exe	89
PID 1536 wrote to memory of 2944	1536	msedge.exe	89
PID 1536 wrote to memory of 2944	1536	msedge.exe	89
PID 1536 wrote to memory of 2944	1536	msedge.exe	89
PID 1536 wrote to memory of 2944	1536	msedge.exe	89
PID 1536 wrote to memory of 2944	1536	msedge.exe	89
PID 1536 wrote to memory of 2944	1536	msedge.exe	89
PID 1536 wrote to memory of 2944	1536	msedge.exe	89
PID 1536 wrote to memory of 2944	1536	msedge.exe	89
PID 1536 wrote to memory of 2944	1536	msedge.exe	89
PID 1536 wrote to memory of 2944	1536	msedge.exe	89
PID 1536 wrote to memory of 2944	1536	msedge.exe	89
PID 1536 wrote to memory of 2944	1536	msedge.exe	89
PID 1536 wrote to memory of 2944	1536	msedge.exe	89
PID 1536 wrote to memory of 2944	1536	msedge.exe	89
PID 1536 wrote to memory of 2944	1536	msedge.exe	89
PID 1536 wrote to memory of 2944	1536	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://tersale.com/?fbclid=IwAR2hUI3MPAt2oLfSM-po1UfbKqvIXLhvAN65rfgzntMAn6j6x2_k8M6Wbdw
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8355a46f8,0x7ff8355a4708,0x7ff8355a4718
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,3013830678896589854,15654339097646801937,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,3013830678896589854,15654339097646801937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3013830678896589854,15654339097646801937,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3013830678896589854,15654339097646801937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3013830678896589854,15654339097646801937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3013830678896589854,15654339097646801937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3013830678896589854,15654339097646801937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3013830678896589854,15654339097646801937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3013830678896589854,15654339097646801937,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3013830678896589854,15654339097646801937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3013830678896589854,15654339097646801937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3013830678896589854,15654339097646801937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3013830678896589854,15654339097646801937,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3013830678896589854,15654339097646801937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3013830678896589854,15654339097646801937,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e71d66ce903fcba6050e4b99b624fa7

SHA1
139d274762405b422eab698da8cc85f405922de5

SHA256
53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3

SHA512
17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
55KB

MD5
7eb56e74565e07c132457fb673e6e71e

SHA1
a6ae36778f7b70116575a3311bcac5902a2daa20

SHA256
68ae58153501399f3c970ce005e5edd5bd785e767362f1f0c4d6ae2a6e524d8b

SHA512
4caccf6f8db7471d64191f9587d3bc47fd01d8e1ab03b57ca0a1071c4dfb5e28d1852585e3422bde46bff05dba04e2c9f32fe95b2ccabf323e2af7d3bc9ace8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
17KB

MD5
d4245d1aaddbb90ec96b2e12d45df4e0

SHA1
e3575d177d77fbf9b18612ce30540d60398fcfe3

SHA256
65fa218102995898b38a848a020b45fb8bdfb06e3cc3a76e39eed04fdcb14f0e

SHA512
2fac98ac9a76b4f4779c433c212c434701f878d22198b0f2c23073e8f08a44d8fee5f7e357246c77fb5a22dd2cb63bae27d15367e957b741269cb6df5b3c20b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
35KB

MD5
66f0bf20f953c37683f9e8e8ff52b74b

SHA1
4f3167c9d6ff6f8f9609928604d97fe67764660a

SHA256
1a9a7008a3468228e981f8878ed1e0abd114bae235096e14ef2cd49fee6d8361

SHA512
bb7ab53acfe95e5804705b9cf4035aeebaa67dc811e2e834a664bf8143bb5b3cec214fc43462286c7783bfa1354bf08e0194c68675d137d995058f44f1bac5ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
36KB

MD5
5f5e7007cefc4ceb58e7980620220f53

SHA1
6270e1992e82f090ff7a12bda9f22258e3b960d4

SHA256
5c7dedfc8512745e3f058ababf4465ac4b86086b95d99e4b64de60704dc4ce2b

SHA512
e7edccb273851f16efee6423eb9ee0940c94d8fbc10356ea478e08a302bd86a805a1fcfd7dc816f4c30c5e1165894bcecc130b5de76b0855d5aa182adc38251c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
34KB

MD5
a9e7c3937f445b1636316002e63d8924

SHA1
697167f61d0fbe06b35e8f777efe6877b4037427

SHA256
6b8aca8fe6b72eb08ad2ac4d69974ce8999fbae0355b3c50f7153295bce49dbb

SHA512
cb78d79794b2c27e73f7d73727bf31e6d51eb41a01c93bd2c27e9bab05ed9c99cee8bd0bf4b9eff511dddd21fdd2bc0f69d2ab291648abfefbf842bb320c607d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
34KB

MD5
c32018e7aa3a148236f3a5c97d0dfcda

SHA1
b4f940c1e156e6193368ecc9dbf4fe96665b4204

SHA256
2d84463de8db9786fca521ae6d956b372f0ff7b77bf5677fd580400265207876

SHA512
8c2f2a3fe73fc783f8ab112939991f7f5e323e6d6024e0e604f8d8af012071149b4dbca3be18c4b3ffe66b3bc915f08ba3d45c20a16c82640fb2dfccb27774bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
71KB

MD5
3b0b1e65749dfd1a8753a1a7cc999b9f

SHA1
8ab67bae8f0483304bca9cb3e843db0027e41da8

SHA256
05ececda8f7790b13a3c3f2612a791091a7b4a4c37cb85f2ba2e1ca68fb11e9c

SHA512
22d953ddc3a1f99df6003b79131a3098e5dced892fd51b3b5628a036bf302e5fd38adb931fa0097288e3fe536b4ef97fdbd1fb006a6eeaf4ddc3e3e82883a785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9c482904833baae488084f4766e40524

SHA1
c12cad34687cbe77b1d6f5e64ac1dc408626a076

SHA256
6c16e971d1c44ecc9a1f02dca0c037f3f15a07e3a527d2de1e450ef81da51364

SHA512
30c4c1e339d21e264f0e26617e97c2955bc8b02ba95fe06953cb3d716c1412cdf0f854bb918493381fe34afd171500e2f3fc2b4f905a83fd643458f3790e5141

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3d77f5658ebfdcea38d96467a46ed8b6

SHA1
ebb7a64fb4b38670e9ac2a20da75ae619aea838c

SHA256
283edcef83d777fb3be41867b54d9fca49265ae77ad8fee331c3efab8539e057

SHA512
7220b7206a31045336a057f9c8bcb0a684d85de277f28278f0873be9c7bf135e9e5a6704432593889ef7cc74836da402cbc1decb599d08c1bce5325187919427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4cf12f4060b8b742c982f493a56c3ee6

SHA1
796776410ac4d605f7c39239561090729f60dc3e

SHA256
94e379e821faf8f312ba0445c99e14e2ddb7abf776feb998c2dc32400fd75423

SHA512
c93e45662a02cf089b8fd350408a17090cedd13c42670bb1c03766a6810ff5efe7dbe52189d482111426d7bd235baf3b0899477e0c190d95ec5d71d43a21cbbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1da2781e38005eef43ac111ed5940b39

SHA1
b79f0593cb93de48feb837c9974f98afae7104fc

SHA256
047390b1c6006259333303e9d6cf4f551498d044aa869975105704c2a2fa6ae0

SHA512
9f5c5b9bdaa88eed443b8dce2beb847bdfe3fd5d7a01593bfb8e0858f01f26daac67f198bd1372edf762c57db7e73d0fdd0a44aed2c9369346a81433dd3c13ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
358385d1dfa58e0600b86fdd3e9e9fd0

SHA1
f106deb8b3aead53e7f77087680bf720fcefd23f

SHA256
6fd0c2570b7f912124660cb0a7591c48920124647d99f9b56e71fadf965153ea

SHA512
0f29d89a0d92ea354ad6da0c6c35ac5a51774862da7c5637873ed9461572ec9365fbf8f00e4c5ef3c199c910f3089b9b6a81ba64a6e31631170ae6d1c9610ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d2578e941e7d37be8030d0b145818868

SHA1
199eba9d1a4616a2c21dee1924b27457b8873bc7

SHA256
e462cfae75c0b9b40300475d49528dcb87531bb55382d5b8fe5f8648302067b2

SHA512
0c57eeebea61682172867f216372d41869ed1109cafa035d6350793cd3f556752ad72038498a196bc62b08a0c041b258b27a964769e6bc5cd17e76d78b309c39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
015ebe6d4ac87d25805413b94359575e

SHA1
61d7945e122803eb838f6ec83703bbfedbfed7ed

SHA256
644f7b9f75b9d97e00b2f4aa433c86da76a6f5b4c5fc98df44f597d09bceac5f

SHA512
27b70eca68e95efeeaf9cb44a772cc8c9ab5351920c530cae5961207e1e4f2b5632768d426c314badd759950075e12ecffbc28b05eb59df17544c29967d898f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e01908c5530605e389a31f77a0a723fd

SHA1
02f393bc942a59dff1d5aca8cd41d3be0524a0ec

SHA256
80aa0ea061e7d047c2ac942d2e0b7a0f7607fcb73e930799bef473c0e9a40682

SHA512
9f8eef7e996a61a25971de55a26cdb6dfff973a01c5ef09fd86a5bbd01a5bbba558ccfcaab27b14478c6442c2924e68400a21d0864e833521de473a9c14b5899

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1b1b142e24215f033793d1311e24f6e6

SHA1
74e23cffbf03f3f0c430e6f4481e740c55a48587

SHA256
3dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1

SHA512
a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2531b85d21d0fcde2ce15940fe41f8d8

SHA1
cb461b0133eea1b20796508252e7b6ef6a427dbc

SHA256
737309a52b6aea912dea9238ab49b2ebfdcc94fbd1e2086bc3ad080c30cc559c

SHA512
d0c2782e025067cb12ae510785bff9c827742cfe6f2ed1293f6f6bd414fabbda280590ec07c678a3628a68ed51653764f467294d0f0b5c41d5f017d92b4ab932

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
1a2b191c93604942006e99b8c27a5f72

SHA1
75ad4f0f0d8d83ca4fc815e54713cf06aca8c078

SHA256
246f655a874097b5f82d9c42488409ea75a8852190cbf3593810d5d8baaf4a38

SHA512
21abaaaba3073ad5bf4d25687ef91450e5caa669a039dc6560afbc626bf751e90f7ac87340ddfbbde10e46fb76880504c3d2d40789c5dd059c5df97319806d11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
63eff9f5b26838034d987f5ab0e01d2b

SHA1
043c6c48f8a779466167b94d8a5df43d7018e652

SHA256
a864a36fe285228cd673edb1d82079fa6aadb839c7d8c2db618a64bc5435e625

SHA512
3154b9bd260c919d08fd79f0b828131278dce969ce9a82ef29ed74ad273da1cbe43fe60a388316a26ad31b30f87cc5bca7ba676f90d31d8ddd7996294f98a8e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b2a6.TMP

Filesize
2KB

MD5
54d2b0ca03682bf18da100f34e35458b

SHA1
1d40421c63e8d0abdc9bf2910d41c033cee0906e

SHA256
76200d107aae7fcf91950b3f10f72d4ed56cddd48f21f0d96214b93eb39b7225

SHA512
ac291a8f537ac964f26c03772e4d982148a1ebc20caa0894ef757e4768acdd0ab97712160d8add2e1f49fa2b1f978c5de3c29927ba48488c1cd876634eae24ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0e744a06d11210523c5cb581735708f4

SHA1
9e644bddf1783275527aeff818fc4cc64d5470a0

SHA256
876e4aa6932265a059460eea33af7c4cbc1b19ffabc9038d7d2bb862b2c769e6

SHA512
30e713e65e7ed83fc28f96a79fd59b10a3796295334ce1cfe7733230fbec4dcd2be4935e23d588f9cca26f8d5f1d36b9c235cefdf3cbbe0511788fec9c33b58f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit