d520ed363bed917f0483114c955e5c174bb4953893e29e7ff3f2d4b0b86f6fbe

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c28413ef3355acb52e7de1b5ceaa88d.html
Size

432B
MD5

9c28413ef3355acb52e7de1b5ceaa88d
SHA1

cf23cfaa79a60215341f3895ef16101456c9f1ba
SHA256

d520ed363bed917f0483114c955e5c174bb4953893e29e7ff3f2d4b0b86f6fbe
SHA512

e65db59cfa2bd75b904bd35ac517bd0f0dbfc138e8e2847d6c33ef0a2942053b05f496186756f9cac72706b3d20be0eb821f89f511184e658a32b007a68a93c9

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2008	msedge.exe
2008	msedge.exe
2680	msedge.exe
2680	msedge.exe
1756	identity_helper.exe
1756	identity_helper.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2452	2680	msedge.exe	85
PID 2680 wrote to memory of 2452	2680	msedge.exe	85
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 840	2680	msedge.exe	88
PID 2680 wrote to memory of 2008	2680	msedge.exe	86
PID 2680 wrote to memory of 2008	2680	msedge.exe	86
PID 2680 wrote to memory of 3016	2680	msedge.exe	87
PID 2680 wrote to memory of 3016	2680	msedge.exe	87
PID 2680 wrote to memory of 3016	2680	msedge.exe	87
PID 2680 wrote to memory of 3016	2680	msedge.exe	87
PID 2680 wrote to memory of 3016	2680	msedge.exe	87
PID 2680 wrote to memory of 3016	2680	msedge.exe	87
PID 2680 wrote to memory of 3016	2680	msedge.exe	87
PID 2680 wrote to memory of 3016	2680	msedge.exe	87
PID 2680 wrote to memory of 3016	2680	msedge.exe	87
PID 2680 wrote to memory of 3016	2680	msedge.exe	87
PID 2680 wrote to memory of 3016	2680	msedge.exe	87
PID 2680 wrote to memory of 3016	2680	msedge.exe	87
PID 2680 wrote to memory of 3016	2680	msedge.exe	87
PID 2680 wrote to memory of 3016	2680	msedge.exe	87
PID 2680 wrote to memory of 3016	2680	msedge.exe	87
PID 2680 wrote to memory of 3016	2680	msedge.exe	87
PID 2680 wrote to memory of 3016	2680	msedge.exe	87
PID 2680 wrote to memory of 3016	2680	msedge.exe	87
PID 2680 wrote to memory of 3016	2680	msedge.exe	87
PID 2680 wrote to memory of 3016	2680	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9c28413ef3355acb52e7de1b5ceaa88d.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc4a0946f8,0x7ffc4a094708,0x7ffc4a094718
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,1270314046134147517,12792628359137883289,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,1270314046134147517,12792628359137883289,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,1270314046134147517,12792628359137883289,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1270314046134147517,12792628359137883289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1270314046134147517,12792628359137883289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1270314046134147517,12792628359137883289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1270314046134147517,12792628359137883289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1270314046134147517,12792628359137883289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,1270314046134147517,12792628359137883289,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,1270314046134147517,12792628359137883289,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1270314046134147517,12792628359137883289,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1270314046134147517,12792628359137883289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1270314046134147517,12792628359137883289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1270314046134147517,12792628359137883289,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1270314046134147517,12792628359137883289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1270314046134147517,12792628359137883289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1270314046134147517,12792628359137883289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1270314046134147517,12792628359137883289,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,1270314046134147517,12792628359137883289,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1364 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1386433ecc349475d39fb1e4f9e149a0

SHA1
f04f71ac77cb30f1d04fd16d42852322a8b2680f

SHA256
a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc

SHA512
fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
194KB

MD5
36104d04a9994182ba78be74c7ac3b0e

SHA1
0c049d44cd22468abb1d0711ec844e68297a7b3d

SHA256
ccde155056cdce86d7e51dfd4e8fb603e8d816224b1257adfcf9503139dd28f1

SHA512
8c115e3e5925fb01efd8dda889f4d5e890f6daaf40b10d5b8e3d9b19e15dadcb9dcf344f40c43f59a1f5428b3ee49e24e492cf0cb6826add1c03d21efdec52ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
95d769095f99fe764a66fdd8406cacfe

SHA1
4f3e8e62d41fe03da1569ac9f0e5ba5df37cd9b9

SHA256
1423f50740c8d528be8071e2a872ab6eae653dc80e71daf9de6ce3e270f9ac83

SHA512
29333ff6628e440d8619033937397cd63507f2899381b14b2b7a2e5fcf68130a2b70fe2fd6e66ef7d958bc134fed88dbf30d95998a41ae5caa388968fe4e2d49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
eaa14f186fc45120b5596c7460cd4642

SHA1
bc0a8b2dc94b02ba1dc13700bf6dd5d44c6e13f6

SHA256
b0470b2fb1b4392d5f4637380779661b3a2aa6d4eecd483c8d3b7dfca647bef3

SHA512
ed6ec2c3d7fbb7d827bd948926eb62faf51c6b13f7b3a9e1e6d271fcbca47daba2dd71f73d367edba1766b85c9038ca82432fff714531a81cb9274c243256b10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f3070fb305ac21abb5c8211df87ab03a

SHA1
183d0f0c041d054c84464eca3f2809a6c268dad4

SHA256
97764e1be4dd0626782ee80579b70078f44311212d6cbb37837f785c4accfa51

SHA512
aef3cc085ae779ee57cb9e1530dc10356b802fab5ef0ed2e09a3bc231daa714cc36ba1240ab0931620d9eab0aa72a7777e96b4df8cf03f9dfae26c27eca90c99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e664066e3aa135f185ed1c194b9fa1f8

SHA1
358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5

SHA256
86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617

SHA512
58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
16fa84fb94f297679fc1ebf4074168c4

SHA1
709266ee3031d65d24d3748b311cb9223544c24c

SHA256
632a4c4cd1b77b543e26bc1b178e30120662979ac0a30b6e2ef1c0adea4a14fd

SHA512
638d2c30110eea398544a5a61abd85c9530c948680909e56e2a9aaf148d8c77d9fb4c5d91d8d1cdf0867203cf0f2521c7b6126702b8bbf6ee73a1f4ab6f736c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe579ee0.TMP

Filesize
48B

MD5
4ee40c95afb33603402534e10853095c

SHA1
49569709e7b0082750e162402d2e493e9a9b3c64

SHA256
bb43b64ff6225193093fc3dadf7822cbc6585e9f24b7c6897c47aaaca772d3cc

SHA512
3ea81afbe726612014bcf4a58e4c6cec6aa389e41b17d09807272a21c07377a7081072d1ab86f15ec6ded3abce9d1f234f951bea8ed88efc3ec8bf17c4feed03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dc9ae627-b5bd-4747-be1b-cfba807825fa.tmp

Filesize
5KB

MD5
cff038e329ad173cc5f127769bfbc578

SHA1
8ecbd3088fde62f5194f84624d36a2d7f02f6a3f

SHA256
e45114d08c7959ac085bed1e10c5a4929a7136e312f027f9e476bd6628736b1a

SHA512
39397d9cd413971818eed61fc8de2b1d99755af1a87d5a9e45462f5ddfb0d054a8edbf02ed4377c0863093969c6113a7574ebf8214206d79f2cccc2dec1d4650

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
64dfcfd60c93b0b79ddb44ebda8ea7c4

SHA1
c52a9aa9e8dd0dd437042c1bc784dfd9e848d10d

SHA256
2562183682438d3e2e911b1fccc7571148af7c25f966b0178adae9db612fa9b4

SHA512
42b47063b0d7ddfc0d3bcd6cc8493dad0ead5d4db6252427559bed05f584afab07dc4f1a409282348d5a22a23a112bbbd29990c6e6428bfc288d6d6994ca4509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
766c92df1dfb30c9f70bdc0e569b16da

SHA1
11eaa3f16d0c9794ac6c4fc97ce5f56a358b09ab

SHA256
a87657572662408d15e8926c40ba992b03a3198b06da646db02430ec2a236771

SHA512
c73ea311dff873eb9e0158173cfac9cc90063d6dc22776c96b770c524e8e50d0c615db1c4e0569ad6661ebcc55919b3dc9fac8caf470f7e1b606c807aee7bb46

Download Submit