ca19ed6af0d889dfeb5ae0d8d5cce22a1a73f1d7e76868d474e57287becbf0b8

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2531c4b6e9934dca2b1304957fa1f1e.html
Size

432B
MD5

c2531c4b6e9934dca2b1304957fa1f1e
SHA1

15d44c27c22782e73ced283a3e17991e1389859c
SHA256

ca19ed6af0d889dfeb5ae0d8d5cce22a1a73f1d7e76868d474e57287becbf0b8
SHA512

bb2b80ea68c34811f1febf4f08b40322d86277dae30497caca33f26e58f0ba5943052ee82e86aa6feb6d89cc46fdfaa7a8969eff9e58f30c5a96df604c9a5f9b

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
216	msedge.exe
216	msedge.exe
5236	msedge.exe
5236	msedge.exe
4412	identity_helper.exe
4412	identity_helper.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5236 wrote to memory of 3532	5236	msedge.exe	89
PID 5236 wrote to memory of 3532	5236	msedge.exe	89
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 2396	5236	msedge.exe	90
PID 5236 wrote to memory of 216	5236	msedge.exe	91
PID 5236 wrote to memory of 216	5236	msedge.exe	91
PID 5236 wrote to memory of 4356	5236	msedge.exe	92
PID 5236 wrote to memory of 4356	5236	msedge.exe	92
PID 5236 wrote to memory of 4356	5236	msedge.exe	92
PID 5236 wrote to memory of 4356	5236	msedge.exe	92
PID 5236 wrote to memory of 4356	5236	msedge.exe	92
PID 5236 wrote to memory of 4356	5236	msedge.exe	92
PID 5236 wrote to memory of 4356	5236	msedge.exe	92
PID 5236 wrote to memory of 4356	5236	msedge.exe	92
PID 5236 wrote to memory of 4356	5236	msedge.exe	92
PID 5236 wrote to memory of 4356	5236	msedge.exe	92
PID 5236 wrote to memory of 4356	5236	msedge.exe	92
PID 5236 wrote to memory of 4356	5236	msedge.exe	92
PID 5236 wrote to memory of 4356	5236	msedge.exe	92
PID 5236 wrote to memory of 4356	5236	msedge.exe	92
PID 5236 wrote to memory of 4356	5236	msedge.exe	92
PID 5236 wrote to memory of 4356	5236	msedge.exe	92
PID 5236 wrote to memory of 4356	5236	msedge.exe	92
PID 5236 wrote to memory of 4356	5236	msedge.exe	92
PID 5236 wrote to memory of 4356	5236	msedge.exe	92
PID 5236 wrote to memory of 4356	5236	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c2531c4b6e9934dca2b1304957fa1f1e.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccda846f8,0x7ffccda84708,0x7ffccda84718
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15289483939083615848,14613810990627872433,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,15289483939083615848,14613810990627872433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,15289483939083615848,14613810990627872433,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15289483939083615848,14613810990627872433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15289483939083615848,14613810990627872433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15289483939083615848,14613810990627872433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15289483939083615848,14613810990627872433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15289483939083615848,14613810990627872433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,15289483939083615848,14613810990627872433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,15289483939083615848,14613810990627872433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15289483939083615848,14613810990627872433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15289483939083615848,14613810990627872433,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15289483939083615848,14613810990627872433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15289483939083615848,14613810990627872433,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15289483939083615848,14613810990627872433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15289483939083615848,14613810990627872433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15289483939083615848,14613810990627872433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2172 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15289483939083615848,14613810990627872433,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
187d8b49c873b64f64c357e5ce9bccfa

SHA1
2913d7b26e441f3aaa001c5e0455799e20edd38f

SHA256
d4b72854fea7271f660ef0d600332a701c9106497ed7b025a0c7be1f2e0a6ba1

SHA512
3691eac0f3e7afb6d619faa5e39fe7478f3b7c8ccd4589b424237c882d076b25ea65c35e38869f13809bba6eca6ccae1a7b44057c49c9a9c340f4c509a13481c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1a838180efd70ea2f01ff04fe7bcfc78

SHA1
84ba179a95daf3d21f9a56a7410c9fa3bb0e795c

SHA256
0b21925c9c524a8072ba65f66d5e2f73b00d16b84eaebbc909e6d22c9fc1a911

SHA512
82629cbe8f00f445b12598cf7885dee501bc43e63200e8a9b5fd40c695126ee185caac7f7c6fc558c8e21cf959c619bf65d040d5d197fa65233324598410ac41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
817b89041acffe0efbbeba953ef32cfc

SHA1
6d4901263dc018d6644b555828d46b6b25fb797c

SHA256
743fa33c59a04aa66d074ffc10a2562fd21e34b3f5ce8c6aad7cb17e47f9e7b2

SHA512
14c81c46df55a8ed0affc0521f9c2ad11c0c84f4a52dfd348617a37f6314fd7a05a13c5c41ba2fa8db7b94f072a13a3e7dc62c8e00ecfcdf998cb97f5aba8c74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
37799df3fe246ba0cd2552a5bc972186

SHA1
bb46756a7cd17d94c6d8ccaef1d45b8f97fc920b

SHA256
69abf7859ca7d516d4d3b08b44259877a842b4a0bfb4dca7842339fefe9c1b75

SHA512
970b83ecb89721cc612528931c0aff57a9e35a0d8027d39d687649ee64d8640fe0f47e8c50762413b505d8f4ace5635fea608ffc7a3bc245cc110dedf5898ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0f75462236ce5cd5a5dc525dcfcf8e75

SHA1
600d5e086203dbb44f81dc4b88371d414e334006

SHA256
7bd1f828f194e077efe06841427d919128a2d38a5ffd039ca04041ceafdada03

SHA512
61d662221e5ae41e02f8d63637b2fec458f26caa48850a4a02d63b29abb326d8d32a79e2ea36f0bd05aaad3ad76d992a60c39bf316d75e9938cd545b2b0f01fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
afcd4af9d9999ef0bd142df55001c6b8

SHA1
9539a18b5a099c7745631da3dd4935b19e721182

SHA256
d52bdf8fe02d5365da22c25e15a71b88d7b4c7cf8baa47fb82b96eacaeaf18dd

SHA512
2f338bb58a48f215dfa2997a33b0a226ce63a3b6495213d57650f7133e9488997ee39f2d470db5eac1ddf1e73f55ed2782e341802c57082f60eb7de8592933ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ddb76ebf171bffdc533726e085bb2d1b

SHA1
fabe2db7c591b6f100c259cd5ce8e038eac38de0

SHA256
eb5eee00d2bde88528509c641f85b705eb7eff1afee230cb0f20e2ac7d6e6b0b

SHA512
fe52e69b2766e85d39d6fea220eb7ae9ccf33f5226322565cac0f7c3f5ff4174eb5adab0638068b9b7948e5ebb56e4a5c739aba862186a99669c96767a927365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
718deaeabb793e118a282b4e01768756

SHA1
fde1df16c25db03879528cb34e0e261bf8ead1db

SHA256
270250b24f192b8df41381d063fc9b00b0c2aa1809087baf5fb5150e76670a92

SHA512
63e3f306331dacc554654e80d42990f1d260746e37af5549371015f26b08190ecbad42e040b1a59a12fc3bc82ef67e424595a04050a284c66d7ad12e67f6a0f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe579441.TMP

Filesize
48B

MD5
d25aca3484abbaf1c6d431df12dd768c

SHA1
1e27c3d05634fee277633921519c1a321d6207a9

SHA256
3339a78640fb860edd52a4677a4245e68f733385ca8a0909d4ae659eda8daee2

SHA512
95ffe53e7164e217a18ce7325783d213b716e5ec602f1acde70bdd044afc157d713bf40971311c36366c39f55162e10f5f404bae487403f2abd4616ad55fe55e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
79928d9dad0af6896d23d1793d9dce25

SHA1
dafeeebe74c39c7d9eb0c61a942c5daf7d6e39f6

SHA256
4ce1fab7a0cc1528eecd09aa57c8cca292711701e11e4200d89ab952d14768a9

SHA512
03035e456564a1272f137731864642a22ccc8b2787ca20a6a5a76cec271b1f89c3aea966cebbc8756fe6bebff9871ee3c3c6585078ea4f1162601b1147885330

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
033a87391c4f57a81e41ac983a22b5bc

SHA1
c62f0d0323e0341156faf44f2c21044b0cefc9fd

SHA256
b018008406db9f1fbf1c26e56282725ce6955397cb07dc0445c895f5b6318110

SHA512
e1aff46d6bbcc240eb9849f184517b8f914d48309b907b26e4ea3a6591ccf47829c1ee7a3728d2c47606533e0db63b69d8762ac7571ce3598205525effdf7c31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57db6c.TMP

Filesize
1KB

MD5
8333b73abd72f5860eb089fecdf7e72a

SHA1
50b6a28b26e30af010c27fe6ade92ba61fbe00cb

SHA256
71fb8b53928a38f70e5fab5ff9114b162d790cef7a9e32af3fb4227e4ed25ead

SHA512
a7456de8b1957db960e97f0082eea83ff52eb5386224e3a305aa2599b9903291fe7432a9987d7c95f54a4582bca1ecd14dda2fdd968900444ddaa37e8ffde02a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5aeacef5b73c764938d83fdb4b33e332

SHA1
07419fb9d2ccbde7360fa334e98a4202f900ea48

SHA256
0a816a42bfe1e17e7f915993576838f86c4d78ae412ce14041d60033e688f2b7

SHA512
3d122d17eb703d29d13d3c87ba7f08768e63047605793d67ce28695efab0607b5171379947a1238a8be5584823e5d7b38c6ab2bc94744f1fcf58edfe4d191972

Download Submit