d39815712102e31e8ca455fb6b601384278a1223546720dc2977402fd21f5198

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b852062544851633eea358ad5871a79a.html
Size

432B
MD5

b852062544851633eea358ad5871a79a
SHA1

1b839e30c7517ed6ccc81bdcf6642e267b8f4f2b
SHA256

d39815712102e31e8ca455fb6b601384278a1223546720dc2977402fd21f5198
SHA512

12e05b83d0755adeb70de546238ec413516608c5dcdf42ba84a8db8616d67de39ef8bec208acd00d0ab2d6924e2046d9687e51423f16defa6bc676c690b8ee9b

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
216	yandex.com
218	yandex.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
3412	msedge.exe
3412	msedge.exe
2720	identity_helper.exe
2720	identity_helper.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 4052	3412	msedge.exe	89
PID 3412 wrote to memory of 4052	3412	msedge.exe	89
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 2200	3412	msedge.exe	90
PID 3412 wrote to memory of 4460	3412	msedge.exe	91
PID 3412 wrote to memory of 4460	3412	msedge.exe	91
PID 3412 wrote to memory of 4408	3412	msedge.exe	92
PID 3412 wrote to memory of 4408	3412	msedge.exe	92
PID 3412 wrote to memory of 4408	3412	msedge.exe	92
PID 3412 wrote to memory of 4408	3412	msedge.exe	92
PID 3412 wrote to memory of 4408	3412	msedge.exe	92
PID 3412 wrote to memory of 4408	3412	msedge.exe	92
PID 3412 wrote to memory of 4408	3412	msedge.exe	92
PID 3412 wrote to memory of 4408	3412	msedge.exe	92
PID 3412 wrote to memory of 4408	3412	msedge.exe	92
PID 3412 wrote to memory of 4408	3412	msedge.exe	92
PID 3412 wrote to memory of 4408	3412	msedge.exe	92
PID 3412 wrote to memory of 4408	3412	msedge.exe	92
PID 3412 wrote to memory of 4408	3412	msedge.exe	92
PID 3412 wrote to memory of 4408	3412	msedge.exe	92
PID 3412 wrote to memory of 4408	3412	msedge.exe	92
PID 3412 wrote to memory of 4408	3412	msedge.exe	92
PID 3412 wrote to memory of 4408	3412	msedge.exe	92
PID 3412 wrote to memory of 4408	3412	msedge.exe	92
PID 3412 wrote to memory of 4408	3412	msedge.exe	92
PID 3412 wrote to memory of 4408	3412	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b852062544851633eea358ad5871a79a.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa6f5e46f8,0x7ffa6f5e4708,0x7ffa6f5e4718
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,17215328158154621931,16457200759857009092,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
b5631ed9fc3701aa026badda74be566c

SHA1
616c976a341c647ed19e7fc63338f158bdfd767d

SHA256
631d0c405688078514b10b9ec35c0c374201f34be7677a865d61241a12c10448

SHA512
a00b05859041c079da311dd04017c1902917080dd596d9a7de177368023ad4d36346f5fa3aff68a2eebb61079a019848e9cb35017b1ac32d98a7903ba0ca9c98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
3cd9bccc3fe26c12da925afb9b334ed8

SHA1
063290a833d8aec0f8156d56abbbb186da63850c

SHA256
868dc51b788810c00ca13549c3c4ca6277e0c003b4fdea9fcd11036c2fe4a0ad

SHA512
ae9ba260477adeceebd1ea837948f59d7f2e5a33a9b9c73d1120cc556bfbde22883daaa0b6a89cb7a6afda836f53fd0cd6c3447d560cedd2649559d92457f474

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7468739ebf60aba6e33fb71992952e1a

SHA1
1eda21cb30ec209229745c147610adc7e4870691

SHA256
5acc42b1b601b191a5035e305fba983459272778382eb1eb6f7240391eeafeeb

SHA512
9f10f98751b5c1259b3f353b222117d12dde8697a7242d5035d89f6aef31377e72d8dd93913a2b700ba454c11de6e57cdf46ede81f07a8bfd0a76f2ac086b6be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
578e6beb9e138ff48f40733b93ff45a2

SHA1
ae8317341f59f48e01f2503f52f142307d4901ef

SHA256
ad998fa516fd399ff202c91ad76d0924212cb1081c7f95c9057253c765075966

SHA512
9001835f2effd9d98e6de2605daeb7324e3326aaca46bfbec38504c8ad845463e45688970ffa1aeac616ea02476d88950918ed3626679e2cec41aabe5152b309

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1187f6a7abebbd7ba865f6bd0753d1b0

SHA1
63f326d737b82381ae697e42cf011c8b1b68b430

SHA256
0045004ff388292f16bfcbb297ed75d4eb330e8e51fde35ff172b2178931cbac

SHA512
3cb8dd813b0545163d6c645e46a4c464e625d39bee635d43cd8c21eea9d09586f441120bbfa2bd9052ca701a84427fd920f5bdd0455b56dca508872b9f63a25c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
de33a78fee307630561ea663bef83e65

SHA1
86c9cb65333e91264584df7c456c6fa1a76b8334

SHA256
1103e1368ef75bd1a02f9c3500c9000af8c38bb94deeff3dc62358130b874a01

SHA512
34005a19e7c8cc078e470456c54900eb8793e66f7c927f563c88e6afcd32728455cbff0a910a1089757ba32105415dddce8fece142aac1c9c776875b5d6aa9eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57a151.TMP

Filesize
48B

MD5
cb538cab01c8c13180d56b8c41b898f4

SHA1
8259d8be7e53e892e99723cc4b5ee4f476c9a767

SHA256
afe4011080403c3fd26c5929e32a3cf244698eee3d0faffd01bf38ddb18918c2

SHA512
8d4836c3d3516ac3c3c3877fab2c16e8bb0248a50426d3e357e96459b192eb0e5b57dc7f2f6b1c4f577a564cac4c5898b2a760d1798d5d5e38000333be60e550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
f50feed037992abfa7677b81a41ec418

SHA1
d1b43078f7307dc238be38e276cf3a7a07d8e1fa

SHA256
44e6e88d90078b9ec67f0a842686a4de2ecdc8cd3a405944ac5c7360c3b36d5b

SHA512
11a78ccb39244ddbf91e82fadb01caa2db40ad02993e294aa2b34ec7c708fb46c2c84c92bcf75bb08c0668a8efa23c5639d4985c9d2da343e7965d5a81f9c854

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
5e044e8c7b4ca58babca9311af8a41b3

SHA1
2519f08dc9418e4b660a14f363d70bc1845206ab

SHA256
a2ef97cd5fbe4e7c841a4fa1f520809d198edc4aaf278aa50f6afa697742da5c

SHA512
849dcbf67b8febd5722647386d4a5ca489ae5eccb977fc07a0cf55b0c96a217017d80e3a6cd1633637801ee7f266fe8c4efe3b5bee0d3c86c028d20e379e998f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579ff9.TMP

Filesize
1KB

MD5
c4ef09044d6b88292510e95912d79d86

SHA1
578c173c5e859b60ae75f6379a8cb8d54624cd1d

SHA256
b87dcb6e777b5c09d6008eee4337f4c4ed5ebdd592a62d7801e362734badfae9

SHA512
dadabc70f05a74ab2dbbeafa92e4b75f6986931cd2006568d594d3156fda6e1fb23b8061ac29c17f2e4a49bf5ae1d5a08c6d6e3e829f7936e63c2c899a86c25a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
11f0cd3b75d163deeb67181800c9ad2c

SHA1
42d79d5db79bdc14b5fe1bafa58a6cc73828746c

SHA256
de723c7e1c7174887467161e64aa550a1c899943454a63094427a53398a2fd97

SHA512
04c9d5b88d596e2ed423e54f7b8989a5593c38d1e487f22a7064831cc5b8f195eed76f730e6d28255b09662a7d84460722e71f2443bfa0025e7cbe64f3f5e243

Download Submit