4eff94fb0df4ce097b2218ef98b43a4967615046d6e4cfef297e678ec2a800e9

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bffa0840c6885131c28ab54fafeee1e1.html
Size

432B
MD5

bffa0840c6885131c28ab54fafeee1e1
SHA1

3208f4ed642f8c941113836bda3c7f3c7bb68462
SHA256

4eff94fb0df4ce097b2218ef98b43a4967615046d6e4cfef297e678ec2a800e9
SHA512

3cc6f33a2cf0ad6349c7e13a2bda9a8f211280fb889a5682c0081f8b4900077a00c92ab3874efe8c481389a2e558dfe72a21793281efeb8560c496e72c03f09d

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
2884	msedge.exe
2884	msedge.exe
3612	identity_helper.exe
3612	identity_helper.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 620	2884	msedge.exe	89
PID 2884 wrote to memory of 620	2884	msedge.exe	89
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 952	2884	msedge.exe	90
PID 2884 wrote to memory of 4640	2884	msedge.exe	91
PID 2884 wrote to memory of 4640	2884	msedge.exe	91
PID 2884 wrote to memory of 4404	2884	msedge.exe	92
PID 2884 wrote to memory of 4404	2884	msedge.exe	92
PID 2884 wrote to memory of 4404	2884	msedge.exe	92
PID 2884 wrote to memory of 4404	2884	msedge.exe	92
PID 2884 wrote to memory of 4404	2884	msedge.exe	92
PID 2884 wrote to memory of 4404	2884	msedge.exe	92
PID 2884 wrote to memory of 4404	2884	msedge.exe	92
PID 2884 wrote to memory of 4404	2884	msedge.exe	92
PID 2884 wrote to memory of 4404	2884	msedge.exe	92
PID 2884 wrote to memory of 4404	2884	msedge.exe	92
PID 2884 wrote to memory of 4404	2884	msedge.exe	92
PID 2884 wrote to memory of 4404	2884	msedge.exe	92
PID 2884 wrote to memory of 4404	2884	msedge.exe	92
PID 2884 wrote to memory of 4404	2884	msedge.exe	92
PID 2884 wrote to memory of 4404	2884	msedge.exe	92
PID 2884 wrote to memory of 4404	2884	msedge.exe	92
PID 2884 wrote to memory of 4404	2884	msedge.exe	92
PID 2884 wrote to memory of 4404	2884	msedge.exe	92
PID 2884 wrote to memory of 4404	2884	msedge.exe	92
PID 2884 wrote to memory of 4404	2884	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bffa0840c6885131c28ab54fafeee1e1.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff952db46f8,0x7ff952db4708,0x7ff952db4718
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17218806690454784924,6325890799529599033,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,17218806690454784924,6325890799529599033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,17218806690454784924,6325890799529599033,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17218806690454784924,6325890799529599033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17218806690454784924,6325890799529599033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17218806690454784924,6325890799529599033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17218806690454784924,6325890799529599033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17218806690454784924,6325890799529599033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,17218806690454784924,6325890799529599033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,17218806690454784924,6325890799529599033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17218806690454784924,6325890799529599033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17218806690454784924,6325890799529599033,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17218806690454784924,6325890799529599033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17218806690454784924,6325890799529599033,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17218806690454784924,6325890799529599033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17218806690454784924,6325890799529599033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17218806690454784924,6325890799529599033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17218806690454784924,6325890799529599033,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7740a919423ddc469647f8fdd981324d

SHA1
c1bc3f834507e4940a0b7594e34c4b83bbea7cda

SHA256
bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

SHA512
7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
e074d1556ab0ec5fe36e6852ac18c8f9

SHA1
22f914465b90badabfd7abf87676d2711d7707a7

SHA256
7cb7ef0af7798481582330027a448ccb01c40661196e2890cf6c5770702d9d29

SHA512
be5298f81b57211cf01da3a74705a402cc29ba9158343d745dcbff6f62d9a9d2d88fc23ef0d6bda75ff6eb8403ce91a10e13b95f4b3a9595aac71c759a073b34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b975e07112130894c4d7b0fbdead8254

SHA1
c66f7220a23278c98e45ca2281e8609ac2b7f2d9

SHA256
2f1b084629f147fdc4eb6dcbd1e9838517db405826b9bd5c30f1f0dfddf28c53

SHA512
d42bb3880e0b2e15f047d1046f59c0c22e231d487f723171c78afae919992189d56092cda50863b00b6ff3e7c352c32bd626481e0664681493082ff0701c6e87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
09334047a96fd0ca9a142ad1e15fdc5b

SHA1
aa2a76ae34d944fbddef467a5e4e80309a3587c9

SHA256
a9598f61ab3ea8a1fb1f0719331f8d4ff31845f98fca1521aa14965eae72b0ab

SHA512
fb7c7f0df3e1ff74cbe275239e08427cd6a9c699548fd7cf86c70d01d01e11379809e98d57bde51f7745c44bc9d3dea9295a5c945ab0de7a6f72118c2ce1cf7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8aa4ea1fad9f685028821f1a0fe63566

SHA1
651131d3ad108e692f3d3dd0706f3ddc94765c8b

SHA256
9b9e2b70bf0b334a0391cf35eb90165d217130c436c608e1cf7d8b73ffe1fe13

SHA512
f2a6a08b97bb7b3f381c233b96cb84543b2b326575733552da1e2b4188b22b9b925f6a00482cb827ca8156e7a864ab7faef786c14c294de7b329f3c3d5ff7bda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b80aaeedfd8310ca7e77db723a7c67e8

SHA1
7485e318c48626abd1a1779caebbad5324647860

SHA256
4c4e4e1b0a73c452a8419441a409e5efdc273e20dbea7125edca1603e2c56047

SHA512
cdfdf3361e8d244afbf7a26253a458209a0e738ac0705074510b72ed94a1928ed7c0f134ef934f838c992584e912099161a1d1884f60d0ad0f0ff690d46f8a92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ad2f03f77843c7bcc44651d3377bf0c6

SHA1
951961ebc910cb97b58a5fdd59fb5004ed99af45

SHA256
c4540b5011ce64ff7bf8fcced138a69c2e69b4939ece5124bd3f0634c3e9b5e8

SHA512
50d4034a4274e53245d303aee66ceb3f99d9856c66cbecc6777dae1b0ff2ae1930de60aca51d72a7577edc31edb4746b5b77878617f67e4428b51e407ae31dba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
d9694072b2995cc79d09671f9c9538f7

SHA1
17f2864e1ccfc8f35eb83bbf25cec5bfdb0bb2ad

SHA256
19d1fc51ccc830dfc13a734666867bfbc37bf5e19006de247666e9eb49f10d9a

SHA512
6a0d40973ff65b2cf37fa3951b4022048a4b90c5cfcb55805a11ca297f36b12a0e6d0b36df98956a1a2d9c1ad4c278b2b8835015eaaaf140ca70c8b77df5d231

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c0cf.TMP

Filesize
48B

MD5
e666fb41a9e31237aeee55fe04505a04

SHA1
4fb72670169a6b90648f1813b6633912c48b779a

SHA256
dfc95646f605cc477811795318b658605e3a63daa42021d27935d02268fd879c

SHA512
ec638b86e1408f10e019e0dd91663a77be54254cf7879c294e6c6d9bcd57955e3c998246212360746c4a7e68a2024461a1c1372f6481895eca76f5d5eb310f73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e1ed7842a07b8e3367f9ee06ecb174f4

SHA1
c9dc221a91ad2184e7b974b27d9ff463da47b30d

SHA256
873768f8c7207d2ae00032e4704ca51f2f8df73ab9118b025b10e94d7a8f8e24

SHA512
8996c117f12e907cd253ba7e6d47fd04e0d66f951da5df62e14be67951cb8792f1561b43e0e3827b7925b447a0d3362b0cb6aff890c2b2c2bb79470c1a5993da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1736c7f87fa048c56a4a1eac190f5e16

SHA1
2e24a6c98ba8fc1ab72503ff1d1226ec8bf9de85

SHA256
6150fe5ede0b2e21b3dbfb02fd3f3c058e0f0c9654990b6f4602b5647f25bae8

SHA512
89cfc284764417b69d02a413dbcbd43670c3643d3661ff0c04d14701abf71d5c731e99e2abfdb4f4e3a4ad4090524acb5e6311dd0efc5b36dbb4632f670f1005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5807cb.TMP

Filesize
1KB

MD5
bffb1218e8ce4292bd6cf02fbfdc96b1

SHA1
aa2cb4339588ac43855e2d4a8d4cda80c9a9e176

SHA256
0b8aa377aa9739e6c04d03da4ee7e9db7f4cc3c32a1302e7bf2a8ced9f8dbd78

SHA512
ff996b5dbdc88228385e0fa02651c33fac0392fbd58fac0f21173951c46ebd64313e06e8d66cd0ac6f2953e93c82c1cfdbd4b1427cb021590b1cb24f3e3c4b28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\af23f860-7a0e-4709-9c5c-9986ba62e52a.tmp

Filesize
7KB

MD5
fd8543d9d3514049ff953e8267ca9922

SHA1
ef240625ffad5017bd2ff181acda61c120a27b92

SHA256
63b10326aba2752eb97d60117e2e1a9c9b71d942b78225c08380fedd74f20764

SHA512
f3952f60641cb94c5ab113ae12b2aebea5c7c47279a5be2ef529cb34c239f9529a25f1591a98b551753339d8e94f1a923d93b4bdb79a93fcaa8e5b4c98afeb58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3b6cb60b9592c0a5d2b94d2fc60fe9e2

SHA1
68b53309ab7229fd5a39eb5b774f2d9ae27d6f33

SHA256
e9dcffcbc001bcb9a9b3f983a3a4a3eec4f939449d1cee408b7476026e723325

SHA512
dddf446a5bce0c77f0c23cb4c2379d45fd82dea1d6cb7c87a221cadc3953fa8bd433f3933d49d93fa55c3c2efaa6f0946a791d38c7be9406be436f2d2ff6494a

Download Submit