hxxps://orteil[.]dashnet[.]org/cookieclicker/

Analysis

max time kernel
86s
max time network
90s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
20-02-2024 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://orteil.dashnet.org/cookieclicker/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
2416	msedge.exe
2416	msedge.exe
4836	msedge.exe
4836	msedge.exe
2152	identity_helper.exe
2152	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4724	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4724	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 1704	2416	msedge.exe	56
PID 2416 wrote to memory of 1704	2416	msedge.exe	56
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 4408	2416	msedge.exe	80
PID 2416 wrote to memory of 3204	2416	msedge.exe	81
PID 2416 wrote to memory of 3204	2416	msedge.exe	81
PID 2416 wrote to memory of 2448	2416	msedge.exe	82
PID 2416 wrote to memory of 2448	2416	msedge.exe	82
PID 2416 wrote to memory of 2448	2416	msedge.exe	82
PID 2416 wrote to memory of 2448	2416	msedge.exe	82
PID 2416 wrote to memory of 2448	2416	msedge.exe	82
PID 2416 wrote to memory of 2448	2416	msedge.exe	82
PID 2416 wrote to memory of 2448	2416	msedge.exe	82
PID 2416 wrote to memory of 2448	2416	msedge.exe	82
PID 2416 wrote to memory of 2448	2416	msedge.exe	82
PID 2416 wrote to memory of 2448	2416	msedge.exe	82
PID 2416 wrote to memory of 2448	2416	msedge.exe	82
PID 2416 wrote to memory of 2448	2416	msedge.exe	82
PID 2416 wrote to memory of 2448	2416	msedge.exe	82
PID 2416 wrote to memory of 2448	2416	msedge.exe	82
PID 2416 wrote to memory of 2448	2416	msedge.exe	82
PID 2416 wrote to memory of 2448	2416	msedge.exe	82
PID 2416 wrote to memory of 2448	2416	msedge.exe	82
PID 2416 wrote to memory of 2448	2416	msedge.exe	82
PID 2416 wrote to memory of 2448	2416	msedge.exe	82
PID 2416 wrote to memory of 2448	2416	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://orteil.dashnet.org/cookieclicker/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd66ee3cb8,0x7ffd66ee3cc8,0x7ffd66ee3cd8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,9416998413318504047,2774972335114242227,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,9416998413318504047,2774972335114242227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,9416998413318504047,2774972335114242227,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9416998413318504047,2774972335114242227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9416998413318504047,2774972335114242227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9416998413318504047,2774972335114242227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,9416998413318504047,2774972335114242227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9416998413318504047,2774972335114242227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9416998413318504047,2774972335114242227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9416998413318504047,2774972335114242227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9416998413318504047,2774972335114242227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9416998413318504047,2774972335114242227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9416998413318504047,2774972335114242227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,9416998413318504047,2774972335114242227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1868,9416998413318504047,2774972335114242227,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9416998413318504047,2774972335114242227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2000 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9416998413318504047,2774972335114242227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9416998413318504047,2774972335114242227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:3868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3384

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53b9b1800c90e0f055e0daabb68cc97e

SHA1
beb76399e32e4ca5c634228e2d4001e197249cf0

SHA256
edac0665854b4e7aa3f2b866e6172c71b2e1c6a169a2a04cf1e74102ee9c0e5e

SHA512
87d516b7ae594902b2544e13c6224760e1ec40d676a2f699da3242b5d3a9eb962dc7b3ca7e2a3eed1dac5375cc6fd8379dfe47d127fd3c18a653a05a8f67c31b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
888B

MD5
c9e8a19115886b7144416d1d0160e1c4

SHA1
171388daa4a88f02ac07d8c0e90b0f1cc6a7e556

SHA256
2896b532e142a52155f8d335a7198810140a8829272fdb0528de54c22b534e3e

SHA512
45240904c1230bc913a46bebdd51b79cad49bea325bc3e59add9eb1179ce7e0f31db1190a548ca74caeff89063ae10b39cc6336aa7fbad15af2f697ef3e4aed0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
37a0aa163158958b2e79336320f1110d

SHA1
c94c47b8585b03708ed5ff124700b1beff49b450

SHA256
50d41ad1d83cdfdcaedd04d3d0fdfed394f87de9c4077467f8a58987d2bf7dd2

SHA512
59a18a99f0cda02401c925a49e95d423558722db126a76eb159c2cb41a1b76ae00aa95f6e91ffb116f8f214b35e42c13be00945e7e1bc929391a6337afc3c43a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eae18d7047552be2ea130c526fec805f

SHA1
b5683d94c8dd8d823ca828554b1fa950c02c092e

SHA256
cb10e6e9ea1896923623ae7385289e90b34696eedc8a89c51e5ecfe188941ab9

SHA512
f8fb3df71d24e7af9f914f6e741702a6952c9c74f181ec4c1679a7def40dd234ce37a0c62c34b7dd3152f66f8a747ec289f2d7e6b849e1f5ee7a890964e52964

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8bc60bfcc3bc3558d7f51d4e661be56f

SHA1
5e5c6878329971c135e89079db7296d312b60043

SHA256
d2fd869003b01467068127207f6e868c157432b75b81b41885d6733a94102d5f

SHA512
3a8c4a09ea5aeedd88d9c1d69e996fe29453c5fa4f488c51d04fe89055407f4474f9a063129c84cb01ddb145794a3db4546007e075775516bb39cbc0a72c61fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7ed161ec08d8de5872b127f1db50d886

SHA1
9b54fef1a4bcb040b8705cb004cbdc437c3c6c3c

SHA256
ff114fdac1aaede5e67cf8632b05d852d850ef7ee2ea94a7161b9f0731612351

SHA512
776bfeabb9af66120ea5fe3bc35fdc86b283d5a5729f122a017b2238e6a032fb4f4b642aa7a241ba62dbc621c932d597e925edb5bedb645edf018df51aa3e943

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
c82ad8ad14e526ec66559c47de1a763f

SHA1
b10b0f130da2c65e86f90dea7ee0a7023d5c2113

SHA256
daf64997d996dd9b5fa74cfcf401181709c99c832ecac0765dfa2685a4de2d26

SHA512
77f20db71a5452fe0de763080ca73b3e55cb0f38bce7805eed977eff6d932b7b081f896be7d9baa8758cb0677e12848f60e08dc2b19985dad0476962b0ffcf66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
66c279f98e89c8742a9ce43af4b58852

SHA1
d88a5385834d7c473951db79958a3f614a6eac2d

SHA256
88325e8a99fa00b7e065e064fb254719b8528fd23cc2c206f6e618991861d0f5

SHA512
7c548bb6e3496105df5f3cbd5d2d3b97f6d3f7e666e9e95fadec4eed623218fdc3b59f07a44a2b7c7502d3aa0b2077e1d4d48b20d461e5eda1e1ee21fe5d150e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c081.TMP

Filesize
706B

MD5
578b46465fdda8d034a08080767ea823

SHA1
f281bd8987f7ca4aefa8d5939462c1806ddf0ff6

SHA256
77d2df3225f79741814f79c2b1cbd507bdb9aab3c59f3132342886012d75511c

SHA512
6c227d980a320dfac99098abbb4948cde4f72079b9574b7473258760fc482b5dccfa00db0310b88201822498240513c8e713b131f02048188d53c6bb8d54df58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a28cdfff-78de-4c87-9a6b-d0616aa228de.tmp

Filesize
5KB

MD5
ed850eaf628b7a7ce28e48eafbeac4df

SHA1
7451c5e30e3f6859869ac7ac42271f776a9c4e7f

SHA256
13f365564e29bac3f23a0a52595c22768b9b4340defb178bff898b152ddd92b7

SHA512
8bf9528682c95c7564cf7b711d8350190327e1aa181012cb541ec7822b409fd43efd18420a9d93683a2dcaf6e71f7fd96cb900b9c6b8a6e1f61dd0432988a230

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dabd3d87243f1f0424d9dfd2a88bbea6

SHA1
1a141d64fa705dca4f69ba86aaf3e06bd440c427

SHA256
a3c3c8d47c2b9c214f3eb980abde83dfc42acecc8dd0cca77199eb200b651ba1

SHA512
27428c463ed7ac24446d629e3b557a20c95c47d2dd1dd5989602832f6f214b2d1375fa2261ce98395495dd74c631c5388ff4a251d5a40002f03cf6e18f0075ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
784d47c0afe888e094e37fd2b58b0a6c

SHA1
9a668f01bd09e6e37cb5262c1d71e4cfc330ed8d

SHA256
8e09ab750f4a094bf4aeeb97fb976a6929f31dad66ba123e70a8e602c624d7e3

SHA512
d3b430d237d9d8285ad29ee0630b358b85a3ea08b97a896b89af7cb9af6282eb984ddbbe8e72c476bb4b429ee5bae1dc6f1118f09b85f05b73945d57a1a33b31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7ac351fafa1c41ba4542b0b085b5c1b1

SHA1
26a518877f0f6d6fde5283c687eb38bc04252d75

SHA256
a24f1c56a031a88c495c0fa184cfda59c80093e1d4885190a610c127d28eee0f

SHA512
e6250c5c1e75eeaec8761312eaa95490d2dffb062c0eec233b4d33cc1800e3bc57621665e7a903ec32b65352055a412978158924882efae86a7b2ddf15d8a208

Download Submit