9fd2f619ac59b3bd7842a330098f7f53dde7eb3f12f279acf4423fd2309f65e4

Analysis

max time kernel
157s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b853ec9491844d51ad7c982e6fdb31db.html
Size

432B
MD5

b853ec9491844d51ad7c982e6fdb31db
SHA1

232de41ac9933361dd0b746ad7525a1c34807477
SHA256

9fd2f619ac59b3bd7842a330098f7f53dde7eb3f12f279acf4423fd2309f65e4
SHA512

99bf0e371880ab7b0a22fb87d7d97dcbc9b5afc82b7878299eab88ca533768dad7e0f77cb340a953900ff90684f4a6b4e5648c1a5f9c8faeffe8ca92ae2f38f8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
1224	msedge.exe
1224	msedge.exe
2808	identity_helper.exe
2808	identity_helper.exe
6008	msedge.exe
6008	msedge.exe
6008	msedge.exe
6008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2852	1224	msedge.exe	87
PID 1224 wrote to memory of 2852	1224	msedge.exe	87
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 3584	1224	msedge.exe	88
PID 1224 wrote to memory of 4088	1224	msedge.exe	89
PID 1224 wrote to memory of 4088	1224	msedge.exe	89
PID 1224 wrote to memory of 2732	1224	msedge.exe	90
PID 1224 wrote to memory of 2732	1224	msedge.exe	90
PID 1224 wrote to memory of 2732	1224	msedge.exe	90
PID 1224 wrote to memory of 2732	1224	msedge.exe	90
PID 1224 wrote to memory of 2732	1224	msedge.exe	90
PID 1224 wrote to memory of 2732	1224	msedge.exe	90
PID 1224 wrote to memory of 2732	1224	msedge.exe	90
PID 1224 wrote to memory of 2732	1224	msedge.exe	90
PID 1224 wrote to memory of 2732	1224	msedge.exe	90
PID 1224 wrote to memory of 2732	1224	msedge.exe	90
PID 1224 wrote to memory of 2732	1224	msedge.exe	90
PID 1224 wrote to memory of 2732	1224	msedge.exe	90
PID 1224 wrote to memory of 2732	1224	msedge.exe	90
PID 1224 wrote to memory of 2732	1224	msedge.exe	90
PID 1224 wrote to memory of 2732	1224	msedge.exe	90
PID 1224 wrote to memory of 2732	1224	msedge.exe	90
PID 1224 wrote to memory of 2732	1224	msedge.exe	90
PID 1224 wrote to memory of 2732	1224	msedge.exe	90
PID 1224 wrote to memory of 2732	1224	msedge.exe	90
PID 1224 wrote to memory of 2732	1224	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b853ec9491844d51ad7c982e6fdb31db.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd557e46f8,0x7ffd557e4708,0x7ffd557e4718
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,4737085039022446262,14530868936437250223,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,4737085039022446262,14530868936437250223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,4737085039022446262,14530868936437250223,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4737085039022446262,14530868936437250223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4737085039022446262,14530868936437250223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4737085039022446262,14530868936437250223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4737085039022446262,14530868936437250223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4737085039022446262,14530868936437250223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4737085039022446262,14530868936437250223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4737085039022446262,14530868936437250223,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4737085039022446262,14530868936437250223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4737085039022446262,14530868936437250223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4737085039022446262,14530868936437250223,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4737085039022446262,14530868936437250223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4737085039022446262,14530868936437250223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4737085039022446262,14530868936437250223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4737085039022446262,14530868936437250223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4737085039022446262,14530868936437250223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,4737085039022446262,14530868936437250223,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3068 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
60194aad71dddd06f36c9ba5faa7130c

SHA1
616053a9ffc5f2b859f18a6b670fe60977f3ad63

SHA256
74ea7d3cf0cd1b08288b50e3991a24d2101d2a691a121a9de69cb17b341db251

SHA512
a6ac3fbfa8092281f2d91028434ba001c4a49e29646b2056d6730439ad88a11acb5ef06856410e0a38cd19e5148a767f3b9fa5c2f40d90b7b893439c04ad4529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ladrecaidroo.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
721B

MD5
19179ab69277662272977cdbaa6afe3d

SHA1
1187285836f6cd0974e7717282f25264a9d687d3

SHA256
fcd13af93150e77a431fc6ce72f9db2796d8a759e5a94f8627acc0669e54c256

SHA512
0615fa6902b0b4bbb0d5a2532b0a7b7627f32f9677351a0fa11f063370eb756ff42be96ee8e4cc234641a68c60e97993e5a8f650ae942443e4ddaee92d8f8477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dddfceab6fad2ff48bd6b3d73c26d5a5

SHA1
a1c6c464dba9b21aac0028052424107a590a7ff2

SHA256
e0c55bbca55b87a390f990976c7eda4ad2661fc4fc6b2522ab9bfe0f92d94e44

SHA512
78259d3718076232d5971ff73d3123361e9366f1fa096370dabe37e7c1a72d1c0018d2a0f3caf6e26cc9ac6b49070a2cb337a58e5743e47c3ca83c7b19a445e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e94cf575ec25dd92dc3dc6ee35629bb5

SHA1
c5a694dec0f8c882f8f7c664588dec8e46eb1881

SHA256
bc7d7ce236cd4bf9fae14601fc6c3983d3aa87412efeacea41f4884461c4a7e3

SHA512
7be0a4539fc288edd8b31d7ada5a3111a03438244929e3cb521b89742e492a8c883ba793846b828c9a3e7b0bf20b7512b52cbc99738152a421a0c19442769b05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
df635cd6a0345bd11dc29c6aa2604491

SHA1
1abd8e0a2eba47fe546d33a810dd1006cb66bf4a

SHA256
8291397f1a8340c568efdb7e7a6590e7824eae92d4e1942866768f58b3a68054

SHA512
aeb5739ca4c960b6b64a19e694894f3301f8825b79015a77af747e6d3db242b67c36191b57955d908aaaa850443b57687b81a06d79384f9a02131a3f1e440f46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8d584a85557fb7ca79dab15fa66f8bad

SHA1
e878a563f09f25559e8decd1d3f3330349151182

SHA256
6f2a9bed6fa8d4d66d6dd971ce9d6d7edc3855553cf95fd5b0085ad65d3a804f

SHA512
b74e50b7235b430046f926df56227d5b5609a5db66244771b1aaae52535c8953927765c6022b4f1216119027f5a563ec275bcbc86c428681f117ae1e32793990

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
f25a44bd76a595a573ae79712407833e

SHA1
d3dbe29dccea0910e520637ad73afddb74fc46c8

SHA256
344bc69d2831eaba8dbb87fe1808db80469946b37a0aa8312661881a9923e8f4

SHA512
8f0394177645d03c76dbc5e72c67b0eac49be3189a6ca45a519b042a6a8b8a65361ed2afd3e5170b4e110aff43115adf491dd0a1b71e30651a160fb06814bf5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe581e03.TMP

Filesize
48B

MD5
0314ffa343c3b4e45af57fc0b851e6b4

SHA1
439f19698c9fe8f8b49bfc41937cfce3ce13ee69

SHA256
83419cfa3fb57ae04830035f3d7a2f4d584d1ab25757316b48cbae70541b2697

SHA512
b847c9d71f660e6eca8087f1a0e651b1e8311cb42b81da570690e3467a90c18346a7a913c7e863129ac83f54b6804769da1763758c1518d808cb64f70382396a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
5fe80089be2c5a5294a6322ca29277a2

SHA1
340047fcbc8019262b2b0b37036003d7c36ace46

SHA256
1cf7d8762a5f1a638f231f4c1793e3ba7d84601e08d94b53f588e4f1b9b5e50d

SHA512
da16dc4707eb4361dc54423ea11bbc27803e3c42fc4818f01c703894349219424834a6f60762d13891ef020114b11b21f91f28f302d805643de029d581bdc397

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582b60.TMP

Filesize
539B

MD5
01643114b4d036ad5b2ef3dd0dde8118

SHA1
2d9b9264261b82f6111be53b529ea1ccb4eef33c

SHA256
d6e7a9b2dd79de6f1271e261d2baa822d69598cc45a3f3af21df60a4c627749b

SHA512
0779b5392863c29798e8a68eef6a214ebfef2a10d7733ada1d01116837e40cc0a3c4e8cdab9d70d27c49542f4a4da424778aef514a2ccc575c104062d58a551d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c028c05fb700109f091955e10ce4e8b8

SHA1
5be1b00452347abaa15e8073f5ea14710a3f78e3

SHA256
244c27278972abc986544fd01ba7f89ee88444b2dbbbe074fb4f7ffdca62a38b

SHA512
f55dc3585ab01ea0cb7c01968c78474c959b14d65f05460e393690d762f54c01a6d803adbbaa1044ed11628f6c5e3be22fb685fef05dd9890425f11c14f8a946

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
25398ba58b24aab3f0798b2e239b489d

SHA1
c13154a7810288b3ff9684138517bdae1fa6adc5

SHA256
ff8287f4689b399823153630e27d2bcf814256ea8164bcea3e5fe75caf11e1bc

SHA512
dc0517990c69da0a6aa81c945da20a2c0d9550a650d9f4987016dcbbc8c1337246c4abb7a98a7ad2b6e162611b41cbed1d18d831dcbc33b92a24c4ca8fd52335

Download Submit