hxxps://explorertransactionspdf0ff18c558df64eebd3daaf0973[.]cc/?dpvysoeo

Analysis

max time kernel
1146s
max time network
1151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://explorertransactionspdf0ff18c558df64eebd3daaf0973.cc/?dpvysoeo

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
4732	msedge.exe
4732	msedge.exe
3280	identity_helper.exe
3280	identity_helper.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 2236	4732	msedge.exe	88
PID 4732 wrote to memory of 2236	4732	msedge.exe	88
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 3560	4732	msedge.exe	89
PID 4732 wrote to memory of 212	4732	msedge.exe	90
PID 4732 wrote to memory of 212	4732	msedge.exe	90
PID 4732 wrote to memory of 3572	4732	msedge.exe	91
PID 4732 wrote to memory of 3572	4732	msedge.exe	91
PID 4732 wrote to memory of 3572	4732	msedge.exe	91
PID 4732 wrote to memory of 3572	4732	msedge.exe	91
PID 4732 wrote to memory of 3572	4732	msedge.exe	91
PID 4732 wrote to memory of 3572	4732	msedge.exe	91
PID 4732 wrote to memory of 3572	4732	msedge.exe	91
PID 4732 wrote to memory of 3572	4732	msedge.exe	91
PID 4732 wrote to memory of 3572	4732	msedge.exe	91
PID 4732 wrote to memory of 3572	4732	msedge.exe	91
PID 4732 wrote to memory of 3572	4732	msedge.exe	91
PID 4732 wrote to memory of 3572	4732	msedge.exe	91
PID 4732 wrote to memory of 3572	4732	msedge.exe	91
PID 4732 wrote to memory of 3572	4732	msedge.exe	91
PID 4732 wrote to memory of 3572	4732	msedge.exe	91
PID 4732 wrote to memory of 3572	4732	msedge.exe	91
PID 4732 wrote to memory of 3572	4732	msedge.exe	91
PID 4732 wrote to memory of 3572	4732	msedge.exe	91
PID 4732 wrote to memory of 3572	4732	msedge.exe	91
PID 4732 wrote to memory of 3572	4732	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://explorertransactionspdf0ff18c558df64eebd3daaf0973.cc/?dpvysoeo
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8ef346f8,0x7ffd8ef34708,0x7ffd8ef34718
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,5290572203924760589,934866812569659376,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,5290572203924760589,934866812569659376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,5290572203924760589,934866812569659376,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5290572203924760589,934866812569659376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5290572203924760589,934866812569659376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5290572203924760589,934866812569659376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2720 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5290572203924760589,934866812569659376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,5290572203924760589,934866812569659376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,5290572203924760589,934866812569659376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5290572203924760589,934866812569659376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5290572203924760589,934866812569659376,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5290572203924760589,934866812569659376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5290572203924760589,934866812569659376,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5290572203924760589,934866812569659376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2076 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5290572203924760589,934866812569659376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5290572203924760589,934866812569659376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5290572203924760589,934866812569659376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2068 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,5290572203924760589,934866812569659376,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3364 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5290572203924760589,934866812569659376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5290572203924760589,934866812569659376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5290572203924760589,934866812569659376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:1
  2⤵
  PID:1500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
19KB

MD5
92a840dc3d177339dae03fedf22a22b5

SHA1
c1c9a6e6442388d07a9d9d72c12da25094d6920f

SHA256
4a986ba8875f22a0eabc356112a6790f90e114adb72eaec4632e03812ec1ede4

SHA512
98c705395dd249501d8069a03e0068bc9ccf4f2d139bec63a00564c69cd21c05cb25cf56ba7b40822963737989d5048ad310e20d6022e84346c982cfcef79e11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
16KB

MD5
12e3dac858061d088023b2bd48e2fa96

SHA1
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5

SHA256
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

SHA512
c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
3eacf4ac18d596bf2358105fb25c919d

SHA1
9f2dc9c704657ac9c556c08a19a6f011217b7415

SHA256
1c8cfbbb9f8c305ba4675c27c93cb1f11539105b23236e08764da87934a989e4

SHA512
2bfd7b9fc8922d9dff778e993daa36f54dab1bf1b797b4fb17966a64d6253640fc775a9a1f80cc41f071da48dd3aff8110be6581f0f4823917be45a1842baa79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
71ee47df627725f61327b7933804dfe5

SHA1
8de8fbe1d81617d8c8b24a55d27cd5f294dc7460

SHA256
55aa09454cb5dec8f48b3503658f1a61b4712d4f2edd39383114d472983af993

SHA512
943958124acdbaed73f524be92189d2dddeaf932283dd44bfe8a1ae6a7f59b089e76c721858f9b0c33addf794d20eefa148406fcda4c84341c284648cf28361b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
d2d5a4c8159395b94747ae8d82205db6

SHA1
a26cfcc8b2e78a82b606db207f234311db41cbd6

SHA256
3ab641dc9f4194e6a0171f390b27dd4258c6f1b81ca1ce22ed886ee41e25bf48

SHA512
a7941adf23420eba4c447a786184ca8a39d629263fd9dc25f449bc886533c0d91c5a580eec8237982153efefc163ab1e0d3c4f2c93bfcf7267d7fa868e44e3a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
38aa60643897ab0cc1efc2122e2d3fce

SHA1
2704ac9b18557e563d722562c426aeed9e8d81ea

SHA256
90cd2b953d2fdb47c45a71a62e8f7bbf17c4a64e34f964df920e56e6f912f238

SHA512
76f9eaa64a6748dcc7969b959a43e683594383ff54fe3212045e0c67f26efab20716ff2c62d3719d6b72836ba6d4b3252f2fef2e8fc7f4467b8b7463263370c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6b8b7e0b4dcdf82271684125efd33a70

SHA1
ccd9a89d9c2df00f45130314ca41ac1943a5517c

SHA256
8c3fcf57fdd296b69381c477ecac2ae7d8a77474e6cd76b7e52fd99eeabf9086

SHA512
8c10e4886f876b0e90306432549b69fe130e68a544951950923c65d2d75078060f33cba822fdad71383ecb1bb596d2386d61be1f28dcaaf9b68bdf2e71b8e27f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
885B

MD5
1eba691e4926cab2695e752056e31296

SHA1
c41f84c0de3effe5054fbe4ebcb956c9e14fcb8f

SHA256
13d9eab555c59d640b4f4dd99c551215f8d0167c6d73e43bf8128a74336fe186

SHA512
9359804b40d826d39803e4ba2e85e1c400f7ece1944afacb0d59db115d32e8a4a0fe5343d94c31ff8a8ae076acd873e8af59b421c9baf48aac4d239e2dc95480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
631d8099b839732c483fdca039f04d88

SHA1
19b12dd4d4be8aea9eb18e24ddc3881662d69981

SHA256
267f892f5ff9b426b73f6c617bd1998550d0d0338d025b705a3959bf8009cb89

SHA512
ff68e5bbe4a792e1324212d832d61410438eb6286717f9fc6dbe5cef4322ee7d6c00fb8c3c968907cacdc96445175d4fe3021d121081c83e796d12344363faa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
841c30beff1bac9e56f361b3e2fec0cb

SHA1
2c3315c1c4e79c47eaa903ae1bf5c6ec17e453bb

SHA256
ea7653bbf3a73d4298e87592060dd2df34540e00cb2bb03e4c84e3033dab6d2c

SHA512
b83a4a6b7e19a038441f8b9d4cd7fefcc5c93e37a6246c855c542aff177f25be7ad38623c2c6f4d4bc53876b11c95645a0485da74a7bb77d42b86c8c6df6e0b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
adee30523e88d228f2f61ed3b50ad54e

SHA1
4411a4449871f98fcfd02c0db3e1888f6b3d9bb7

SHA256
ca53336d69effb94467a234dd01b1c769f097533bad5d676e34bc0ad821daf60

SHA512
ce512a6f5b1056298e29c88cffe7d78bbd6b1cf184f615513eef50dad8462d0eac44827a387cd5859bcdb2a46006c415bb4ae8b42428a59b0c6a6c846706ecbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a1da77be46f5de1488c5814d0b5b76f4

SHA1
8227b2b93e9167c9b8cb019253bd625f974dda21

SHA256
80b4ad5882353571b983c6d292246a92e773884b75ab810075015e5aba568573

SHA512
9dd219e2d742ccd097089f9034b56d70eb84b686f704f5e6d87d139f3fc44ddbebc8dc6a211a5a78d116eda5922a749db98059407039937d5b7d67e56fd8d472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3e572d93569a34972395714944d907af

SHA1
8302fd37ba12f09a543c42daffedb87aad10f60d

SHA256
de0c2fe4633bff967a5d7b192b8d9bb5d2ce410b36b9586a30a4daee135a84b1

SHA512
2c9b13140fffac99e5abf5d0bdfb697a595eac3747df0af0e7ba9525698600dc35c6a859717aed773515a2ec7ccf13c66663c0d4844fe7ebbc345891d3880c46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f6670d8249aa8e89a46e39eb3c2518b0

SHA1
b13394c96f367a7bd3f6989bcc107ae7dd3fe5d6

SHA256
d1565bcece29c2f47371275f1847d20bb889bd1c6e7fd9b9135402462a8dcba3

SHA512
715cd2dc2eabb02fb8151611254b597d64eb645221f09e8869185ef471cf81c95f70680536ea79ab88a4c7aae9e20a58af1ca879846a8a5b666ff3adf9614ea7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
744e90f2229a08a613bdef224a48bd55

SHA1
6eacff6530b39a9d7ec52ab6b3b4885b335b44fd

SHA256
b74368e1adab5d6e4d3d79ba0bfd5abe0ad472f5224512e9c160ec050d59f23e

SHA512
79a869c725ba2f0d64c755df26c5e5bc440711c99985431f5ee5cc9daae6070a9cd54362aded175a6e1d952d47b64089725358e77b1d1f94a36e0e8147882570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0560d885d436ce9fc6c72350f9d6f9ec

SHA1
e6b85f4b3681ab8a2634b409f5d2ee567fcc40ec

SHA256
385d4c0db6853ceee1e3f69081bce4690e73b0e8881d7e3478d8ce7e6f33c904

SHA512
a26bc9c83fc8efb068bce93089c168d786f41bef6e34c680e408b81c3ad471f1c3a79317634e659100060facb5a49f7e0d85c4c574cd4ee6ecd790712a83825e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6e238a55805985547c4186169d9938f2

SHA1
805d258c78cdd1220a9ad4debedcec04fdbecf47

SHA256
d061705055b3058c060f5f1ef22ec7bb4244d13abe5b29f09456d4df6bd92c84

SHA512
5cf7f0dcb81f723286fd394e0664e4efe78e0cf20e8e84d82592958bdaa198a80e063c46be9f491dab1df0d6f20c50a4c74c2593ef5e8a992e1f1a296dd0fedc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
25abf5d804e7601b4ebc4f7f540e6636

SHA1
fdd3b1e5c0f64989a77418d5ef4bf67dae99e9e3

SHA256
5e5fcdb55a1aad1199ad1dd4e5e61496ca054218d80df3e3bcb493382f55c198

SHA512
7d275fde0ca17a756715a5f4ca41b842c5be26519b8ee33ea2bf9149efb81c4768a0f0314ec5787b6ce54d5d92d682100d92b15ae12ebff96cc069f5527aed8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5a6ad1e3decc0d338a9d553b3bc08240

SHA1
f5b1eebe223d319cebe8c7d19d5f8dfd28f181db

SHA256
cde15098d6bceedf0625ccf6203373e340d9c83c68bb660f6d344bddda37363e

SHA512
0a1a05f5a7c2cb0a2259e31f535633d6ce9965869d10d54510f4a2caa27630730da7c221d588e6ff461e843ee773856e75b59d17b0c75cbcbe06722396048d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cf0a45638fe320928cec08ce5d99f9d0

SHA1
53bbf23802b230cc7e99c023734cce4b90dbba49

SHA256
b24d8ae73558f1adba5d0f4b52f1d5c061d82a8e029ef69a0910cd78407af659

SHA512
8dcb14ab9fc234cd160e394e073b6675d1cb5a6a9edaf4ab0ee0aa0184fb5734506d92b59612d0ae497a453c5f4c9a13468eade755fd72e5789d901d3ac8c063

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c86c.TMP

Filesize
701B

MD5
bf719cb9637f291cfe91028f0414b5b7

SHA1
9d9e99a318d6a2bb8759bc1456ddabacf7c74383

SHA256
7f3b9fd4b6c4b4135b57645cdac3703413e1b27134707b039997f15d3d6839eb

SHA512
054b36a695715be06b08bbc58e43f1dd27ce43fdc71d6aab24d71447ef87dfc0be6f5109aad2a37504734cf43101fb9e1170184b065734cc1e2cc2795da48527

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c9ce0d22-8376-4d0b-9eae-b3fc9e27733b.tmp

Filesize
6KB

MD5
2c0d13240847309a87ec2fd8e6a79568

SHA1
f9d51c01c7ba20dde1213e348153ecd9c2f6c46d

SHA256
1867b23a18461021270e060d1b9462fce328d57914bcefebaffbddd6ecaf56db

SHA512
5605e472e59c07d7778116cb117852271a2e97ed22c757c2bdc4332697ee917675a807787444b180dc1dcfa652e5b305d28c2f774535972ae6f832303041e000

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
60508f01f02d3fd664caf4d439febdfa

SHA1
9c79179b9462aef4106706bc2c02a58177c83d9b

SHA256
a6bcebc142d13038f0e76a6f8a7ff6ff53c61a0a4896168a3d78923811a3804c

SHA512
56aefff98924332e38368c09ae3d4aca3a4321bebf7f78acc50c3e111e6b1cfdc572ae78681ea5b51011856aded51521961249d26f00352e7ec487b4c2680a25

Download Submit