d166b98219247d6de5b94e62cc5068759c6be803e53bd26b3e0bac9feb99db71

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99faa21d9b825016be15ff8b75653aa5.html
Size

430B
MD5

99faa21d9b825016be15ff8b75653aa5
SHA1

8f8acf7098772ba13f24f79e0576c67ad8a43d35
SHA256

d166b98219247d6de5b94e62cc5068759c6be803e53bd26b3e0bac9feb99db71
SHA512

59297db6c9ab0644a1be989f19781ab12fd4876ba5c46996100ea665683c90fc23cb0b188e5d275b75422ed5232189742dd43cd672953e30488f4501da3a6eab

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4980	msedge.exe
4980	msedge.exe
2144	identity_helper.exe
2144	identity_helper.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 1696	4980	msedge.exe	15
PID 4980 wrote to memory of 1696	4980	msedge.exe	15
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 1180	4980	msedge.exe	25
PID 4980 wrote to memory of 4648	4980	msedge.exe	24
PID 4980 wrote to memory of 4648	4980	msedge.exe	24
PID 4980 wrote to memory of 1604	4980	msedge.exe	21
PID 4980 wrote to memory of 1604	4980	msedge.exe	21
PID 4980 wrote to memory of 1604	4980	msedge.exe	21
PID 4980 wrote to memory of 1604	4980	msedge.exe	21
PID 4980 wrote to memory of 1604	4980	msedge.exe	21
PID 4980 wrote to memory of 1604	4980	msedge.exe	21
PID 4980 wrote to memory of 1604	4980	msedge.exe	21
PID 4980 wrote to memory of 1604	4980	msedge.exe	21
PID 4980 wrote to memory of 1604	4980	msedge.exe	21
PID 4980 wrote to memory of 1604	4980	msedge.exe	21
PID 4980 wrote to memory of 1604	4980	msedge.exe	21
PID 4980 wrote to memory of 1604	4980	msedge.exe	21
PID 4980 wrote to memory of 1604	4980	msedge.exe	21
PID 4980 wrote to memory of 1604	4980	msedge.exe	21
PID 4980 wrote to memory of 1604	4980	msedge.exe	21
PID 4980 wrote to memory of 1604	4980	msedge.exe	21
PID 4980 wrote to memory of 1604	4980	msedge.exe	21
PID 4980 wrote to memory of 1604	4980	msedge.exe	21
PID 4980 wrote to memory of 1604	4980	msedge.exe	21
PID 4980 wrote to memory of 1604	4980	msedge.exe	21

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\99faa21d9b825016be15ff8b75653aa5.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb15fa46f8,0x7ffb15fa4708,0x7ffb15fa4718
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,9501209606993796469,13332826359314417114,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9501209606993796469,13332826359314417114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9501209606993796469,13332826359314417114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,9501209606993796469,13332826359314417114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,9501209606993796469,13332826359314417114,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9501209606993796469,13332826359314417114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9501209606993796469,13332826359314417114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9501209606993796469,13332826359314417114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,9501209606993796469,13332826359314417114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,9501209606993796469,13332826359314417114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9501209606993796469,13332826359314417114,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9501209606993796469,13332826359314417114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9501209606993796469,13332826359314417114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9501209606993796469,13332826359314417114,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9501209606993796469,13332826359314417114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9501209606993796469,13332826359314417114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,9501209606993796469,13332826359314417114,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1300 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1176

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1386433ecc349475d39fb1e4f9e149a0

SHA1
f04f71ac77cb30f1d04fd16d42852322a8b2680f

SHA256
a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc

SHA512
fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
425B

MD5
56236ab0521f8d8b8dffbf0a46bd6634

SHA1
abf23e39e04cbe4308e21b0469799aadd7312cad

SHA256
a85ac73691cdbdc1ad7bda5f49c30d962bb5c393b83a144bfa70bafde96e9edc

SHA512
bcc98a835c8a640e6a1b9d59ff3b0df97ce9c8e4db18710255a26752d9a64ad526fa92f8f14af8156881094e72910f5e568a45875b6710c663adc0ce6de6b678

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
84bc1603def37c0011bfe00449a35df1

SHA1
8dfd50ef38706ef8f1855c866d5c58babf6eb518

SHA256
49cf00682014ace7ae40463d8b0e2e6a440f7250b712c09cfa273468f56cde7b

SHA512
c8830421e7a92f14a79659160235bc7ef9038ff5fff79f7bfc34d5df2c2f27fa244348782fd2c699f9b8046cf9a3cc13f6bf722ee58e9de72739631dcec17fa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fe0fdfc3a8ef17c3bb8d9a7a3b0ece53

SHA1
1d0798963fe2ba36ba90a95a04af4dcbfc1d7bae

SHA256
95b33fc4274f7b5b29965779d2e789b3b3782f772dd333675a81f609efbf3713

SHA512
53fc34b6b17fa3430f9a419a8ad3ce4303a3d4534aad3f88fb3a34ef35acc4eaa30b0210c705207416d5d32c8b2c99225c36520998a4118802c0908a8cbbf686

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e664066e3aa135f185ed1c194b9fa1f8

SHA1
358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5

SHA256
86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617

SHA512
58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
56b9ac55106e0431bab4e002898b13ba

SHA1
07d2346d4c0ee370cc6495e77e31966694a69961

SHA256
08d5768bf58d19619df74195d5d8f5eb3987bf8a9acad40c5524ce482ac4dbee

SHA512
e2e2684710b22b67c98f743e87a8b7d225260a3fc43be491b28a24db33dff2373f261c1ce7670cd96ea80c7f63be050a2fcd49dca79a480d7fd09c7c8352936d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57a604.TMP

Filesize
48B

MD5
b45c1708897a7930c6e5f876c14b9514

SHA1
c413d355fc7490fb9f23c90f48fa6787ae83cc8f

SHA256
1721e14c2d87a04f9de900cc2d12228b04e65ad65a66ec70249fe7ff83cc1b04

SHA512
50a3191da90aae7aa13c2eb6c3545d2a649ad336c42f5a7ba249aafb5f1900bef1b3ea0b8b28bb789e16882dc85b4e6ef761358670e13104dfb6e31e00de97c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
28d9aa614a204ec24f81e3d006a3a674

SHA1
837980348cafb2c41893b50e4f08f10bc7319b21

SHA256
f8e96f501e1c0bfa8c1d4c5815ea017c34f2320485700fbd2491c25fcbfb1307

SHA512
813bacc8917e5c81a6eac49e25077826051106dbcb9e7c3b882672df8fa6b70d6938edaa213e748016520a220a0b00aea6a142e80a4087e0d3e5367135cd8bfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f5121e422bf048cf1a52b51890620ec3

SHA1
a7b9bfcfe89de4ad4b7a770dd6d8dcf443b973ca

SHA256
b9e1134110d83615e7072405300862f9f54a1730a03be7c4c62e0bf19af68282

SHA512
d3eae4890f575f90dd07d2e397173fc4982106f3b8fd66a3cad7e77632d974054523d09f491af943508811c14a50eec6dc07f9b1eaa6f93ac014355919ed63f0

Download Submit