2fae8b3c168fabf97203571ba02594b65d9293dcabd74fff15113c3f5d86f22c

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 21:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e01f24fe134022ded0138a480c487db7.html
Size

321KB
MD5

e01f24fe134022ded0138a480c487db7
SHA1

f01769b04587294aabb78e80f401a0327eefe99d
SHA256

2fae8b3c168fabf97203571ba02594b65d9293dcabd74fff15113c3f5d86f22c
SHA512

8a27dfc165e6874fef3bd58252a31c4b90d9a4fbf6f69c1e4768f5c9701d78afedbfcb337146daf6d85095cbd929ecd8d5df38f8f6a333ecd374cc4ab1b5da51
SSDEEP

3072:3eO3QVG7yyiedx1ul5LpQ3DMreiEUv7djlhO:Gl5LC3DMqie

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe
1388	msedge.exe
1388	msedge.exe
4404	identity_helper.exe
4404	identity_helper.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe
5852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 2336	1388	msedge.exe	86
PID 1388 wrote to memory of 2336	1388	msedge.exe	86
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 3328	1388	msedge.exe	88
PID 1388 wrote to memory of 2028	1388	msedge.exe	89
PID 1388 wrote to memory of 2028	1388	msedge.exe	89
PID 1388 wrote to memory of 1408	1388	msedge.exe	90
PID 1388 wrote to memory of 1408	1388	msedge.exe	90
PID 1388 wrote to memory of 1408	1388	msedge.exe	90
PID 1388 wrote to memory of 1408	1388	msedge.exe	90
PID 1388 wrote to memory of 1408	1388	msedge.exe	90
PID 1388 wrote to memory of 1408	1388	msedge.exe	90
PID 1388 wrote to memory of 1408	1388	msedge.exe	90
PID 1388 wrote to memory of 1408	1388	msedge.exe	90
PID 1388 wrote to memory of 1408	1388	msedge.exe	90
PID 1388 wrote to memory of 1408	1388	msedge.exe	90
PID 1388 wrote to memory of 1408	1388	msedge.exe	90
PID 1388 wrote to memory of 1408	1388	msedge.exe	90
PID 1388 wrote to memory of 1408	1388	msedge.exe	90
PID 1388 wrote to memory of 1408	1388	msedge.exe	90
PID 1388 wrote to memory of 1408	1388	msedge.exe	90
PID 1388 wrote to memory of 1408	1388	msedge.exe	90
PID 1388 wrote to memory of 1408	1388	msedge.exe	90
PID 1388 wrote to memory of 1408	1388	msedge.exe	90
PID 1388 wrote to memory of 1408	1388	msedge.exe	90
PID 1388 wrote to memory of 1408	1388	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e01f24fe134022ded0138a480c487db7.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3f2146f8,0x7ffa3f214708,0x7ffa3f214718
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,6026237159965033806,1719226863792011658,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,6026237159965033806,1719226863792011658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,6026237159965033806,1719226863792011658,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6026237159965033806,1719226863792011658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6026237159965033806,1719226863792011658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6026237159965033806,1719226863792011658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6026237159965033806,1719226863792011658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,6026237159965033806,1719226863792011658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,6026237159965033806,1719226863792011658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6026237159965033806,1719226863792011658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6026237159965033806,1719226863792011658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6026237159965033806,1719226863792011658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6026237159965033806,1719226863792011658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6026237159965033806,1719226863792011658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6026237159965033806,1719226863792011658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6026237159965033806,1719226863792011658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6026237159965033806,1719226863792011658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,6026237159965033806,1719226863792011658,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5376 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6026237159965033806,1719226863792011658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6026237159965033806,1719226863792011658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
61KB

MD5
468446a7240461af44b59ebb2047c231

SHA1
47b7c525dc91bece99df0c414960b9490b986ba8

SHA256
ae1a0126552472d1e1347ceb8027ed725db3b93fcbc0b39745a92412cc1641a6

SHA512
ac8cdf824112a3d25248e58f05495b458038d9388ba7e46e1ea8f6933cae23f044f4e532b74b13f52812bfaf602ca12ec152e44ce95266abe7cd6bd66b4a70b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
71KB

MD5
da52e38c98b0f2047abeb07609608ab5

SHA1
da1210caff36df73e49a0c271ff7d573c2d20d02

SHA256
726a2ef49785eaecce64e98fcb3490c40db06d6a205455784f3267a5b4b7c34b

SHA512
35adf36acd8e1c65f040663d7a064f642a6db5e0b7978241db8a9b4eb52b8ae71cef4e7bb1b4a0d85e4af1f7240d6d52e5a07f512e5e90504e063e51376b5f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
24KB

MD5
cc94d4fa68f17da5858901c7db3533e9

SHA1
3252640d678c42e8b464c65260988d476f1c9dcd

SHA256
50ecb0790090fe7c31ceb58c8498233ca4330daaac6a94c0f893cbd5f162e422

SHA512
0be86b27a93bdccb1a7b0c5f87342c803a0f0ae510e2d0335febff2f33c13362693450fd5597d5b2f586aa7d1239fe52b8092d65ce948f6708d8835f756d4fc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
77KB

MD5
1ce04f045b7972f03dc0d6fd09635058

SHA1
31e5cdebc0e3253b2918e810989fe1dd81558de7

SHA256
c463e256be051c615925acc271d771c657b1bbf5493223569abc591e8ac64621

SHA512
543fcb0db841964c71434d70fe33f853ea6ac47835d155eab4a2c5ef1b1d9ebcce5311f1753b958d32effc8f9f30970665d0791d50e629fd860c5716acdf9892

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
32KB

MD5
dbee3f5f9488ec9b33fe0aa8ebf4249a

SHA1
44397eda2fb466c15373bb70e250647aac4fcd20

SHA256
7f5b3756e79b7881b352667b33e9b2086f6a8f6c072eb610dba2523d50950cb1

SHA512
3775198fbdc5a64d2dd4da7617ba37daa20fea9e2672cb70f8eb0c1b47746842018af3e3f8afc241f0c383a07fca07516e8c4a15b520a4a3d722bbb21b1cc344

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
20KB

MD5
2241efaf8a5d6561e64fa7e97dd66e78

SHA1
7b1f677f739c119f878cf3a31e02c2af7504bb54

SHA256
e1e55887f81363ce752f53f8c92a155fe041292b48148134018a0476cfd8f204

SHA512
78137eb3866b771554b70ce90df1354cba5990602018ca677fef64959188fb40a4c23edcb8faac9367db57d0a30cea61a52cabeec10114a1321e9488a8543178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
44KB

MD5
26a55dcc6250e84042b29959f5e50334

SHA1
fc02ef852f17b4f9ff54e7c677145809cc205759

SHA256
d374d2ac88b65c3b78fdb96d2c6398493dbee61549b39c3880a584d2bb1be825

SHA512
33db6af42c615f586b412bbfbe0b92126f91c4b80f9259ef94aeea103498cb53396e28c0e9b1c10bde0802915f8c8877c596f07a5c5c61f4a90cb1df06f67c4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
7fbdb49518fedb29faf9c2209ccb9730

SHA1
a8a76b87f7458a333c1163c7e0f1f3e349c49a3c

SHA256
87e3457f4e3821536f695c2c11d306cc97cf3c01840f1d803a8a8eb1d9ab8db3

SHA512
9f5796e646f8c4371a0fa5278d14c4ff441d6fb3a99bd893ee6e58fb9a017d798c90b437212a553e51eb8c0ea5c31a73d61d4af86eef36f8ac5398547f5f96dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
6567d632341d2f6c19e3b000d765bbdb

SHA1
a60b1596ea1b1399c6ef6fa92642a0ccdeb01bfe

SHA256
b430cce0baed53cfd24b2e6502000817438fe329ca9dedc7268aa844b894f238

SHA512
6392289ac4e4ab9338ae1011f612134cd4dfdc4b9c884842059ffb38976ea296d9987fa97299e82713a8ce92196de9e253e8579b5df8e37a97f6a2098f1dd6d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
c20a322cc416c22a87fbbe5b18d4e7da

SHA1
f0484c58eff2f8958537434341f2ee89406d758d

SHA256
4f3846b050048851618da6e4baec6db4f2fb400e4e116bb9b82096271d67882a

SHA512
d037ba66b3f7b843c8a1f279b36e1172808a9c0d537b8dcadfa33805fe7a6d08fd7243c75a249b213f2fb7185b87f6d26c60e583e08d8f89c95c3c37182a7cdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a825fd6d4d4730848f1a5a7f7904c1fd

SHA1
e3fc5cf350b396b0232b429aceee71087fa51541

SHA256
4e752480ffb886b42d22c3375dd8331883ff367f7ca9a2ba332a3f7958743607

SHA512
29b606b19d98900eb81110463b2171337edca923789943a9fb447ebf3f85d24c00ed534214ae6b1cd57cb15a22670c807c1bf47650ef9579cc9e767866dab31e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
17709e32210b8697c9296e23c5a8be8c

SHA1
5242115f26ecc269bff686f5fd06025bb17e34a3

SHA256
8eea34c5a21bcb8ae00ad4212f7db26d3b49c1f673f547c094f0715aea343f53

SHA512
108c9a05ca871ed2ce934b86129be677700bc3a64474d999a10d06f0375979e60fead0514e358eaf0049340eb441b817e461f7396a7a78988ca168b3f5223d04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
67841283c1f688ad9695523e98594502

SHA1
6c496c5604dfbc8958ad2665d60db77acf063356

SHA256
ccd331408edc72583017274534a69717ec39d6ac6aee846cb180ded20066ba9a

SHA512
ab1a04496060e09cf69b622d084555c33d8e8eb06f019518c93478dc9a45205073f085199bbbaba1d4a22f08b1ddf568ff72a0826912cfbcb130ae8bb354adf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa225d579523e74d3bfcf959e5ad6302

SHA1
d90ba35abe6e65549d1af0cb69bb576751782f9c

SHA256
b48ea35b352a657561d95fa5dd3654b3553e2a2a49744c542789b28025a758cd

SHA512
ed140dfd61938b756046769b5b782244c0cbdc01239eeb2c750f83c42f3104e1a4480de6d51f6122218e49f6f49a62693177c0d862905a17067dc00c83c956b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e0677f137362a0d224db1679ebb485ab

SHA1
f909f26f73b0211e6615d3e4f7822eb783353a44

SHA256
6d1ba1151149d1736adb5a561bf70229f21790961c8a40cc5914645c39c1c14f

SHA512
22095ffcabe7b9fe1355cc7a2a66991cd96776a30fb2292f74f5bb3c8c97ba0807b0a717d08fc56eefeafe6a5015d2675c5d7a125c9c79add6535365e4886405

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
596cab199af283e8adcc22aeb80857e8

SHA1
fbeeb0d9f1108d56b552b758cd0d01f0d672165a

SHA256
ab417ab5b668594b33d748256349de0f0cc41dedd35529536ca6baba7908982a

SHA512
b254d2af546d7d9f2a811c7fdc9ed6dfa1d23d408ee4d57255a435012a36c04fc01ffb905b1dac66c663c956733c86f708c2302cff59c4f2143b79805def38ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
eec24b1ed42854c837df39c12019f5e4

SHA1
d17cd70ce087490482e39eb005b83f4e22f1b084

SHA256
0243f74812f046e4a6d391a98e45912badf4b19badc90754baa65d273e7a6d3d

SHA512
07a86b944a7d628d16a6ef5640790184d225f66e4b9240249a7c77fd70b01e359382aebbb1ddc5f644942f02ca9806b46ca83fd9de59ccba7c6b7baf5804a321

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
c2125c5af519c55c433fe3855c7cd378

SHA1
6b000171652df84ee28f8228cd81e989634adcae

SHA256
56dfc842f0be21dee72daac31fd8121f25f19ccc9a1a0544152d649816381245

SHA512
da11118c28aa094af98645af9e5a90290ec079c02e5fb430f99f1924eabb912967d88253a16683931553212bcc63a4d980ac60b04a62087e967ccd6324072c78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5877cb.TMP

Filesize
371B

MD5
dc4fbcc0dec54eac5a19450c681bb682

SHA1
74b929a37c7c5f90fa8eb2ff879cafd3af874155

SHA256
537a797b5003ebfb587aa2dd67f05171734fb8fa3f25c2abf37d873a87782c94

SHA512
9c47b8414706bb5855ea82d540b6a793eda4769f6b0d5c8314a5f621ab26d24b995ce32486c381fc35b3466386fa0555e4798507d57b1f30f34d15e22a7f2e35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
631d26789d9fdbec341855ab232ce0e7

SHA1
27472a43045fb60f1e16eb6fe9722ddf2d4ba8fe

SHA256
2cd5f25c1c35133f4c7d395a9c797e2c80d5fba75a6d1ee06d51a7582962c376

SHA512
db91d93595e5f85bbd20519610c7a28fb748b0da26365690d185c13698ecb3198c813a0a40c7757d713e2883feb4ae55b5508115d5ae5c7a1d9570946ab7641c

Download Submit