999ee7e90c6f302414fd57868392baa6ddcab0ac2e9bbfcb2bfdd36a17fca5c6

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c64cce495b8e64f6b502039f0c48e48c.html
Size

430B
MD5

c64cce495b8e64f6b502039f0c48e48c
SHA1

b49bb83cc1c58145ca3806928ea325787bae6232
SHA256

999ee7e90c6f302414fd57868392baa6ddcab0ac2e9bbfcb2bfdd36a17fca5c6
SHA512

2b5e263300f0d21859bdf0ed10099ff03df385c6fec4bd0ea1b9a43b7d8496121e2f58cc0ea199a468a267488f2244ec44fcec808226415180e63c37e49519ba

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
2884	msedge.exe
2884	msedge.exe
816	identity_helper.exe
816	identity_helper.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 1096	2884	msedge.exe	85
PID 2884 wrote to memory of 1096	2884	msedge.exe	85
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 1856	2884	msedge.exe	86
PID 2884 wrote to memory of 5072	2884	msedge.exe	87
PID 2884 wrote to memory of 5072	2884	msedge.exe	87
PID 2884 wrote to memory of 1036	2884	msedge.exe	88
PID 2884 wrote to memory of 1036	2884	msedge.exe	88
PID 2884 wrote to memory of 1036	2884	msedge.exe	88
PID 2884 wrote to memory of 1036	2884	msedge.exe	88
PID 2884 wrote to memory of 1036	2884	msedge.exe	88
PID 2884 wrote to memory of 1036	2884	msedge.exe	88
PID 2884 wrote to memory of 1036	2884	msedge.exe	88
PID 2884 wrote to memory of 1036	2884	msedge.exe	88
PID 2884 wrote to memory of 1036	2884	msedge.exe	88
PID 2884 wrote to memory of 1036	2884	msedge.exe	88
PID 2884 wrote to memory of 1036	2884	msedge.exe	88
PID 2884 wrote to memory of 1036	2884	msedge.exe	88
PID 2884 wrote to memory of 1036	2884	msedge.exe	88
PID 2884 wrote to memory of 1036	2884	msedge.exe	88
PID 2884 wrote to memory of 1036	2884	msedge.exe	88
PID 2884 wrote to memory of 1036	2884	msedge.exe	88
PID 2884 wrote to memory of 1036	2884	msedge.exe	88
PID 2884 wrote to memory of 1036	2884	msedge.exe	88
PID 2884 wrote to memory of 1036	2884	msedge.exe	88
PID 2884 wrote to memory of 1036	2884	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c64cce495b8e64f6b502039f0c48e48c.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8232446f8,0x7ff823244708,0x7ff823244718
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2858305215716668814,11767951950148735583,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,2858305215716668814,11767951950148735583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,2858305215716668814,11767951950148735583,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2858305215716668814,11767951950148735583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2858305215716668814,11767951950148735583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2858305215716668814,11767951950148735583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2858305215716668814,11767951950148735583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2858305215716668814,11767951950148735583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,2858305215716668814,11767951950148735583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,2858305215716668814,11767951950148735583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2858305215716668814,11767951950148735583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4376 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2858305215716668814,11767951950148735583,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2858305215716668814,11767951950148735583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2858305215716668814,11767951950148735583,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2858305215716668814,11767951950148735583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2858305215716668814,11767951950148735583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2858305215716668814,11767951950148735583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2858305215716668814,11767951950148735583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2260 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2858305215716668814,11767951950148735583,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3044 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
552B

MD5
952d0111abc040a3ed97c37fc0e07c3c

SHA1
59f9609ec4f0fec063cc1ccc1113f17922595749

SHA256
b8e199892740356745b4b04094f3a4b03c4fb5dc963eea4f78f01abcc0c6b0e3

SHA512
8d56c3629f7155fc14ed91c8d320102042202f2c353b977242e0e204b0c56390e1d0beae72513091b15a7dfdb89c66e5a19dd1b5fb6459c0c934dbd0d5aec92f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
67b65d6dad48defdc32fae69e0739d3c

SHA1
8cb5ee6aaddad81dc13833257e0db5da99bcab7d

SHA256
50ae96de341e76e3ce07842d218d922f39bc3371b5306e40d3b279b281d8dd49

SHA512
35cac1def5d7e781f2f6c5f9cc57b5aca0270d40f91729e8309675a96a70ee842a860552eb0f64a0618a629c21f96057905dc0902a0b7ba777b7f5ed4ac5a6d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ovussaul.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_worldfreshjournal.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
35ef3e944e04d43b8745bbfe5cd82b24

SHA1
f2f9c4420c82d2b105d51db0f3a3334213de4615

SHA256
a6214ea022a4034712f2cd0c6cd798633831d5d52e55b5345d6964308382eeb5

SHA512
9087dab6af1a961c0fcf256c4745f109bb558b8a5e430d15f531d341613eb28aa4b91abc954e3da831b1ecf147567ea7de5bdf9bcf17c8ee53ddcdb8be51f6b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb407c6e987bf45c932978cd12e0035a

SHA1
4c78f1c805833d6a7343f3dfe095e9335f9da489

SHA256
76f6744be5a4285731b9b0f4fa65443b920e37ef9189419b08f690edc15c40d1

SHA512
c699287d8918c99ca8d09a76a03f2b33a5e6a9d13498bd38929e2a0ce1d0449132e8b8fea27f18d134f0866443c7aacfccf7338f5e42a8ce5b7694d26290104c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e4e0cbd8f815fe2557a5be124f87f361

SHA1
ced4da44892b0fa6dddf955aa537a5cbe2050b96

SHA256
8b40d629190b56fe41cecfaa9c168b8a037c62377430d23d6290b4acde6c7664

SHA512
121ca9b726f26586441451999de199935cf016aad3328a5e258206f28499a851d8b8a9bed5e29b99784fb47b861d2104f0a30b47b320d767aa5a3ca37effad35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b7aadf9ca9847514cb9d6394a428eee6

SHA1
b6ffe094ec83231554a0d39ad1d2fecb38fc8b4a

SHA256
c1c13ad77814381fb0d90c3e78c60316e7555eba03a906df2054a52bd87f5bd8

SHA512
dba62ee39d6eaa5b65a86fec9ecf9f24b1dd743234ca3e25c55e4f5b5aa09258c3957db37bf094a8b9c6f38c8b1cfc87668a78c850b78c4e62b81f121fdd3793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4fc54b37e6f5b14276f2de24cfbd580f

SHA1
0bb4dc24c02bbd3983207eafbeca579342a8ba7a

SHA256
be43f5bce4a6d691848a41433d18a35030119bfb67528eb90bb96e89b99c43ed

SHA512
ce1c42a6b74af39733fff1fcbcc3eedbd2543f2acc071f9581e665ae601baf0ba61d4b36c752c2602b19d1fa7f972975ee91f0e6305074fcd66f6daa59c7278a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
be54b383be5e8cc1519a8aeefb1cbf2a

SHA1
1052a6782b9b402bcfd12e2fb60eaf207f36fdfa

SHA256
1236521130f90270da17444f597a9015e53310aae87440252a010e487c7d614e

SHA512
d320f0eab2aee704f52bdc36093d1dedbf8c9f8fa77539500ce90aae11c57fa56a21dbcc8d50be1ac670080d9a57fba478615c5e4ac6018aefed502b27943f7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57a604.TMP

Filesize
48B

MD5
648e690cb72289629d768995d464c57f

SHA1
442839815c2598c65f2ee4fff4f74db03a66030d

SHA256
36976b65ec8362926edc71d450e40085c7a272e226b84b30333b48dd31797a75

SHA512
e101a579f38bee13ba3f6c839671ac1b889237f28c373de4a3301323facfae1495b7d2040909ab55d1f990d969cec8a622e562762e8a459bf17092d98409b56c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d376628088528974ba015e644deff7ba

SHA1
7d46c85796af5dea4c51c7ecedd4e022df47a4f1

SHA256
5a5b7167d59423639ad5b2e43b9abe395086cfced030d29d57e4dcf390b33391

SHA512
35659094c44f2e9aad1ab4af4ea5b4f5e9d2f45157e2de1efc476bf23008d2f91391827f263bdedcbeed54d23cf7299cf43f7749430326702bf5e381c1455fce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
033d9a64efe988243084bde69ce3db7a

SHA1
bda8e56c1e3acf7cb7efd3beb2cdb0aa14cf69db

SHA256
410dc883f888428ed4cb72c422a20c712f862182d01f3372fd6a953ffdc3c842

SHA512
79def30b11d3cbdb71b9b35c63f0eb89cc11fdce1e4d0db74c5e8690b888d5abda0f3e91a8dd1a275a0c8a3e7749eeb2bb3c46a2e2e7be48b6bbf37644e56193

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3124e7272034b91e150398f1e7815803

SHA1
04ec12c8f3b4fe0247f61fd125623f1dd3b85fe4

SHA256
18b3f23726feb2a313d205a55a7f258c69fb78f5b1782f5f8742b1e2bf7805b2

SHA512
52c76cd0e066832b2629ce2b1f748e4201db350cf011cb53107236d9e5a9cd7160f30249b34c5274c04662aa37fb9d0dcbfd19da12ec4ce05cc4690b15a141c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57aba1.TMP

Filesize
1KB

MD5
e8ae58a019b0d6729c4b599eb6a19670

SHA1
809952f4582d5dbcfeb69887f3da20cd95348cad

SHA256
19520f5279e26b9c3508753fac4487368730e1a18294a6be39aa01ea2e9f2772

SHA512
00eac6f25c3850e125ce1b1b5c5b012c595bde0c57ca03b5154c79f3f691f77da861f28ab3a9891b1ba77a4b61d2b39e8284feb8f755e10efbe1cba03755bb4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3a5bd44cc80966cca9afeff080c1de93

SHA1
73781b7bf0641acee1d7dbbc27e35a4b39b8f82f

SHA256
b421d147c6ca3c1f96f425a07b5923b926cec5b1874acf1432b77eb4c0a982e9

SHA512
227df6218a95b5fbc11401b4b2d3d86be929f2f8dfd4d8c044e6ae49ae543264c6a811faeda5f133936c3a8cce614e6ad0f22b2439f36625602a6c0404f07be3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
68c83900a9c6dc63446cd2e074a46a3f

SHA1
6b9554cfa58d09651613e345255e1438d146cbb0

SHA256
73e17c7f3dc65e61b7933e4bea9998828a093bcc1fa3e23973b1d6dfb877bae2

SHA512
e9fda877b93237c4cce8c8ba0ce131e1e103b9cc9d71117891e5720941284a28bca68a619d3c6d11ffc315d0f42f31c2c4b5db4f50647c667e1cb7fd687d5fd9

Download Submit