06a19e1545ba8a1ca46c72baed67a4ac54fa9737042cd164648248933324f9c7

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

9KB
MD5

73fe7149f1c2153d4109eded17c53986
SHA1

d7a7e5e3349dce5e4962b955c33469872edd6425
SHA256

06a19e1545ba8a1ca46c72baed67a4ac54fa9737042cd164648248933324f9c7
SHA512

34b3a07c1342564e106e8049361669f21ed7e6c5b2f076710e093b96ebdad799d3990edc996a5df310c150c9b169239481465349eafdb9319436603f69b4cb2a
SSDEEP

192:D4t9+AkZ/lgA/996XnFN8FK6SlYibq0yThr+C1Vlctn8OdxN:yI1Z/ll/L6XnL8FKlbq0Ohr+1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2116	msedge.exe
2116	msedge.exe
4020	msedge.exe
4020	msedge.exe
2664	identity_helper.exe
2664	identity_helper.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3732	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3732	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 688	4020	msedge.exe	88
PID 4020 wrote to memory of 688	4020	msedge.exe	88
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 3640	4020	msedge.exe	90
PID 4020 wrote to memory of 2116	4020	msedge.exe	91
PID 4020 wrote to memory of 2116	4020	msedge.exe	91
PID 4020 wrote to memory of 3076	4020	msedge.exe	92
PID 4020 wrote to memory of 3076	4020	msedge.exe	92
PID 4020 wrote to memory of 3076	4020	msedge.exe	92
PID 4020 wrote to memory of 3076	4020	msedge.exe	92
PID 4020 wrote to memory of 3076	4020	msedge.exe	92
PID 4020 wrote to memory of 3076	4020	msedge.exe	92
PID 4020 wrote to memory of 3076	4020	msedge.exe	92
PID 4020 wrote to memory of 3076	4020	msedge.exe	92
PID 4020 wrote to memory of 3076	4020	msedge.exe	92
PID 4020 wrote to memory of 3076	4020	msedge.exe	92
PID 4020 wrote to memory of 3076	4020	msedge.exe	92
PID 4020 wrote to memory of 3076	4020	msedge.exe	92
PID 4020 wrote to memory of 3076	4020	msedge.exe	92
PID 4020 wrote to memory of 3076	4020	msedge.exe	92
PID 4020 wrote to memory of 3076	4020	msedge.exe	92
PID 4020 wrote to memory of 3076	4020	msedge.exe	92
PID 4020 wrote to memory of 3076	4020	msedge.exe	92
PID 4020 wrote to memory of 3076	4020	msedge.exe	92
PID 4020 wrote to memory of 3076	4020	msedge.exe	92
PID 4020 wrote to memory of 3076	4020	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3c2d46f8,0x7ffe3c2d4708,0x7ffe3c2d4718
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16573036055843054752,5905338877838094496,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,16573036055843054752,5905338877838094496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,16573036055843054752,5905338877838094496,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16573036055843054752,5905338877838094496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16573036055843054752,5905338877838094496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16573036055843054752,5905338877838094496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16573036055843054752,5905338877838094496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16573036055843054752,5905338877838094496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16573036055843054752,5905338877838094496,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16573036055843054752,5905338877838094496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16573036055843054752,5905338877838094496,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16573036055843054752,5905338877838094496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2084,16573036055843054752,5905338877838094496,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16573036055843054752,5905338877838094496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16573036055843054752,5905338877838094496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16573036055843054752,5905338877838094496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16573036055843054752,5905338877838094496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1804 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16573036055843054752,5905338877838094496,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4884 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4928

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504 0x4a8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
252B

MD5
d9a1f70b068c3c8576150e849205ba1b

SHA1
b7dba19dd163357ae71f4fd21a9795cddb9dbeb5

SHA256
8641ee12c372a3b9f2669811eac8de22fb1d9adb11dea80633efc376cf66f427

SHA512
f7afbcec2c1b75b05a58035292a7b5eff535fabe14fbe8645d732ac69220ca55f08e2b281834ef9fb8cf5f216bba7315323ddcf610071a57c2377445dfd75090

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
414KB

MD5
b2f82751b1e32750ffa671db22c8a6a3

SHA1
4a6e5be10b8d123fb039e33c05c99d95274daa6d

SHA256
699c69ac37e04b58fff47f13a4b51540ef8bb774a7e60593ed59f03ebfa7bff5

SHA512
6b6c782ead9686091b3e6675e285760079e23e07691c6c5c25cfaf07f44966760cb71c4734f2c8aeb3fda18abccaf56fd6deb61c51e83acf74aac8bb921a0adb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
329KB

MD5
46c62563e47f6acc474b5bf81c1538db

SHA1
e76320a0ab32ecfb1a867a02f593a12c96d2e1f6

SHA256
7f719e1820b55308357be998a2b5dee71017d8270c79bd1194ea822fa2df1e91

SHA512
5b2150232d8504a080477c6e99ca3ec57056321a8f3fbd4659fae1018cf8aa5fecd042e3849ee04c102c971d1c28c6efbed8734e97dcd6cc1d50d240de22a821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
33311ac05d76d57bc93eb2885ffdb65b

SHA1
8c650aecab6af40c3450934cf88ba15defe0ea0d

SHA256
0b6ca427d4e6c12454de71171d63e5618b1027918a32a83d054fb889e3b57bd4

SHA512
a6e08a7770914e8f174266909751a0589f756bd7237738d05f933a77e2a832d881969ecc284fe7a48802df66df8048211517c11b5024bb2a24fa91b3cf93dd93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5489cf577efc253e520b5758e1b705bd

SHA1
b3d42d41e7dcc6bf4b0df867e9a1d1c2994403de

SHA256
720cdff525d5122d1fe9037fa215700e7e8021b0fe84b1d7eea687d2109db4e8

SHA512
32934be68ae70ebfd467e71627c9f284b27db7026a712ef9bd583c9a1da3ab88a90a35583f33c6d8097d5b1f96e4c3259900822b44f44b63e29dff384b892050

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b8f0ee77835a8e215e16f383b1ba4204

SHA1
b1f7fc52a06cc7971ea9628cd6afea67ae4024d4

SHA256
c38f957d63964b02482f986f7fc29bd80a913186e5948e2c5fff91e1c7335953

SHA512
c6a9b4f2ecca9d1af9e01e611e3fbb1b7dde62f9d8d3517ce702495916ca8513491be658b9077afa3364d222370e3f12c5a1e0d20d92454278dbf1f21ace3ba8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
02dd2f79c70734866dfa6c0d5526d530

SHA1
58c97659e2ef7aa2d7cb784d25584a23c98b57c3

SHA256
c7e967c9615d19c7e57060a8b4f81e49f56d0946b211f9f236bfcf2167b8fed5

SHA512
f9705f2269e8ce35cbd14f49d8dab8687e909dd50a95e18d3b68ae713e962ac5df6da2762d09433cb8f2259dc856b163a2ea22db97da29d14c2a9bd75ee88342

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cfa60e2fd2e8e7d6f576cb6a51d59501

SHA1
893f4f03ac9ee66dda798120fd8b1737e0541d81

SHA256
9fb852de6fdc0b357d136783eac4aec6bec5322aab06a6c282a321237564d022

SHA512
070c03e74bb1e72722234cf9d3ed3007f27b015de7f688dba4cc0d6cee426b1db7be33717668dd193abdc8a9b977edc74818ace44098885fb918a42ab198dc9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
87ef845c9eaad9fd18049581e016ff3d

SHA1
b6131bea63e20825256d782bff4d24ab3ebeec22

SHA256
a37e2e1b8daf0cb78f8989fe8000b39b7dd178a813bbe439c2709c9c8fb4d1e8

SHA512
aed2505b1f9afed2c81121abb2f76b15505fafe30cc0bd39e17955fcf20785c40d5d99d8e57db463bd7ccee2a0c3ba705f57ef81d37e208082b360f4538d2470

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e96c543f0c13a73f6ad2b79f56707ca6

SHA1
88aa69700ed8dddb2ae5e8e523d52437819f01e0

SHA256
50eee84bcc67ce5e232bb979eeff791590a784f6d0f1e5a4d506c81371c06908

SHA512
50eb2100768a26ef028a60be07035412d586dafb64f4f953220264b3322ec7a3a2ad912fbc3046708f54b1a62d9bf561b1841296d904bcb0be0fdca15e1a0293

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
86c984b94e7a6ca92a5d0abed45a6cf3

SHA1
f9a154ddd77b9b71233d97ce9b304776df09c8e6

SHA256
0f392b045ec3424701110d34ca3b024c0bd2815bcbce6327eafbfb42ce977b93

SHA512
f8525e0e25ce7531fec0753bed0bce0a64fef199b800e742feb4b05590674a1c1a3b82a89bb3382b0dba8ecc28217ec3c72d78000343c07656a0571ff46610f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e6b6.TMP

Filesize
538B

MD5
69fdd74abc384307ba606071dacadbd3

SHA1
fc3a17dc486f90ce42e63ef2c34673802a23f604

SHA256
10c4ca98bac434388a2fcfa2a0a946ca777fa8e1e73b8f7836727c7ed5790383

SHA512
33bce66a0c9f104644d0885682eaa9e717437b20625337422d22f9d19b4ba7ee722280c41ed3b15d6d7f90ce39321c4df26efe4780fbd1c73293fb6bc786d6b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
38416a7a3105e993efa7aa5eabbf0015

SHA1
162683d5f6b35b8471d668db96d35ad3702ae02f

SHA256
d7e65c6cc88d3f613e9f9c72f84f97be4bb231225cf026d2577b87e42c254e28

SHA512
5b3b72d63649558035dad238f8c5be0c32f342ad1d4be66217651f3c3f500cc3566a4cf058d29352106dbb7e92bf4f74895061a2a497fa7dea9d106cce1da307

Download Submit