hxxp://WWE[.]com

Resubmissions

09/05/2024, 20:01

240509-yr1essbh3s 1

07/05/2024, 18:16

240507-wwt3gahd3t 1

Analysis

max time kernel
2521s
max time network
2527s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://WWE.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
2836	msedge.exe
2836	msedge.exe
4256	identity_helper.exe
4256	identity_helper.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 408	2836	msedge.exe	83
PID 2836 wrote to memory of 408	2836	msedge.exe	83
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 2072	2836	msedge.exe	84
PID 2836 wrote to memory of 3480	2836	msedge.exe	85
PID 2836 wrote to memory of 3480	2836	msedge.exe	85
PID 2836 wrote to memory of 4648	2836	msedge.exe	86
PID 2836 wrote to memory of 4648	2836	msedge.exe	86
PID 2836 wrote to memory of 4648	2836	msedge.exe	86
PID 2836 wrote to memory of 4648	2836	msedge.exe	86
PID 2836 wrote to memory of 4648	2836	msedge.exe	86
PID 2836 wrote to memory of 4648	2836	msedge.exe	86
PID 2836 wrote to memory of 4648	2836	msedge.exe	86
PID 2836 wrote to memory of 4648	2836	msedge.exe	86
PID 2836 wrote to memory of 4648	2836	msedge.exe	86
PID 2836 wrote to memory of 4648	2836	msedge.exe	86
PID 2836 wrote to memory of 4648	2836	msedge.exe	86
PID 2836 wrote to memory of 4648	2836	msedge.exe	86
PID 2836 wrote to memory of 4648	2836	msedge.exe	86
PID 2836 wrote to memory of 4648	2836	msedge.exe	86
PID 2836 wrote to memory of 4648	2836	msedge.exe	86
PID 2836 wrote to memory of 4648	2836	msedge.exe	86
PID 2836 wrote to memory of 4648	2836	msedge.exe	86
PID 2836 wrote to memory of 4648	2836	msedge.exe	86
PID 2836 wrote to memory of 4648	2836	msedge.exe	86
PID 2836 wrote to memory of 4648	2836	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://WWE.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc801b46f8,0x7ffc801b4708,0x7ffc801b4718
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4862068740795889078,2004594459623113135,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,4862068740795889078,2004594459623113135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,4862068740795889078,2004594459623113135,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4862068740795889078,2004594459623113135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4862068740795889078,2004594459623113135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4862068740795889078,2004594459623113135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4862068740795889078,2004594459623113135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4862068740795889078,2004594459623113135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4862068740795889078,2004594459623113135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4862068740795889078,2004594459623113135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4862068740795889078,2004594459623113135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4862068740795889078,2004594459623113135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4862068740795889078,2004594459623113135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4862068740795889078,2004594459623113135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4862068740795889078,2004594459623113135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4862068740795889078,2004594459623113135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4862068740795889078,2004594459623113135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4862068740795889078,2004594459623113135,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3860

C:\Windows\system32\sethc.exe
sethc.exe 211
1⤵
PID:5560
- C:\Windows\system32\EaseOfAccessDialog.exe
  "C:\Windows\system32\EaseOfAccessDialog.exe" 211
  2⤵
  PID:5608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
169101dc9e9cba14a4273ea54f6cf5cf

SHA1
256c2d2be8420d02127bf6b0c3de71829d25f746

SHA256
3830f2fe5b93d755ae8f4e1df7f99df319adc461d988df3f78872a4a1a8c5b6f

SHA512
514c7dfb57b520631061a86622caaf52e885821238dc37bf0511afdb5ca19c4a6e5a6c773934830106dc80f7a0d2dea752d54482c1c2cefd5df22a5f030e98af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2e96098f73c32e4202800f4307281142

SHA1
b58a6f32ba13bedcc76977d0037f46d493681087

SHA256
3da93a868c412990c26a8c714b0418d70ff8f8f932e2d3ec881c5c6df9d75ae0

SHA512
0b58218b54e7949f617f76b00f8158c423d71217c6e4693e74f8b53a03baed4e8d94a303951229a8c538968d6e70ae53a552395a4e875e536fefe75cbc3f9221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
1b73830efe58b1306f3d3c42963401cb

SHA1
eb81fc8e72ec82fb9cf5ec7b86a31352a2746a80

SHA256
47edac57598bb2f34ff90d36f0b1e7c85a0cd1f39fb60b118e1d1de92fbffeb1

SHA512
e8784ef4563fcc33269b7989ad88ed68138f8870e4288bc1dd4d15ad475f3f5e2371e6dc80054c5f5e31ebfdfeeeb373215699449233244e083efc975f7f13ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
e3a71555e5667fd09b9848d3d3f5b38a

SHA1
a5f49c7259026d1aeba48175b50cc79acffca139

SHA256
da399cd438cf3925a6b131d67a10a5568aeb3e801062305c32f92d08f09df88b

SHA512
dcdc2f3f3f845545e2c0585c81e864ceae0fa468545c1b34f1ffdf101516d0f7264858b42e9ff7ed2e6db69f0ee7438d1a13247882741974e1925f3dab75e291

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
54dd960e2cd0f030dab3a372e0f13b4b

SHA1
2a77f47c071c1f562266364632a77a9175b7a692

SHA256
dddafc739d83dac192e1d1c469c7eeebcb9eaf3045664b9222ac02a114bf80a2

SHA512
dd7f5b41e4db4492218e85c4be99bea6b779c7aa798e8a4d38de43950f5b8753971c238c367c9a0fcf66f6cd8213e8996d552920fcce8e46184c14151e4ad21f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f7bf1b766bf3514fc747834e0572a6c8

SHA1
ced5bc581a1509da88907e474dbe1196374db275

SHA256
9639ecb5dbbda9a331b935f687683770189b616bf6ae69535b5387a3bd7902ca

SHA512
fed87c80075d6ae1f70b4db8c16d0fa30fafea7ed3dc8b605e48a8ea4bd7741bb00f8cf3b79491489728fd75a1b2a1268e72d9d3d4efac1e4905dabda518c3eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
25639c0b331c93bb65fe43c46df10252

SHA1
6aa002b50f4f87a0f1f7a0a4498070c972ea3446

SHA256
9a5bc34704abb7af3c6dee17ebe36475a53261c2d245500b199cd4cc0a861493

SHA512
686c1a27d57d38bef3d762dab6560193fbfc3e539528c791b54569744ea3788423275ee157d2d48a953b4abfde044d9ed3d0a58790822fb7131f2315399c0648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
48b5d0d46ffab7791a63be7f06f8c510

SHA1
96cd161da87b1c5bb02c941bbf351c79cbdfdcdf

SHA256
26ac1250580202855c09726a3044449d7df1138fddb8fcf6c9190a3286f41351

SHA512
47929eb4c6395d45e5a92e292db9c9a4ed5c8544ec688c4052ac0abc3dbb024b99b691b46a1aabb347558e272f054cca0359fcace1d5cef840dd2b55563e31f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
39d87195f4f9a1d46a1a8705dc60ccb8

SHA1
d823bbd2cbe1e6f209f32f35765414f05f32703c

SHA256
e161c553eb8f8b451f48384b2465c080d30b3ab0d05ef84a7f78b131502d9e4f

SHA512
c9593a2c238b959cef1486c881e2d55db7e6e8a32b219b9a6b906848b2da786ea064b03ff611956ff4c344b0a5803e7b7aff687be32d89945cf55e6204fb0abf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aa6f00d8a6df3e08dea66f68007c1084

SHA1
f5d826ed67c4c9778441d196e80f136a8031d3b5

SHA256
4312977a18cd6b3523a6a378633dfa94fdfc037a699fe4669e052d4a9458a6c7

SHA512
287d46ac06119db4d75ba3b4cc4259550e90ec4f648c9cf313c009ac8a139a0e03c9046e591ec496e819e4385573bfca4e7bf4f8c35606a0fcc6bd17a9fc6ed7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578fcc.TMP

Filesize
1KB

MD5
05b044660241fdf24958d001e379fb75

SHA1
4c32e8033cac00cd22fc6760ee3f1aa4abeeb69b

SHA256
5cce643873946b88daac65baee3e3b666a60bd3d232bd32d8047f021006e9c42

SHA512
039a7df981a11cabb347a02ccc676ac29424a308dae58ee667795f6994767514bcbc1e823e8e1a9e08e59241b2249fbe6c0a4055b4b7325a290c1af9e08e778b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e650f4bad9023599d23bcb98e9d43ec1

SHA1
3c6793ca69332a09c348729f2f068eacfe69e1aa

SHA256
e5045639bd2e6309d13493c78836710aaff2b9405ab00c87c51a980d03b9dfb8

SHA512
be8dbf5166aeca4df82a4cdb1dbdd80f4af6bf0370fa45e67b977443ef4a472a0edcb3ec7a35c21dd82812c59393765db24af25f5e95b25210a9d6557a54f1a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
784b4e6fb02f3d97c8e216858dec2d87

SHA1
11e66156488ed367a36dd0ce4adfd72ae0eeca37

SHA256
1cbf1a8e0719dbc0f00d73ccf8962867b59c438ddbb8dcea305ffeb6584a5ee1

SHA512
586b4dbb517e3e690785352e99011b716ed788d34e04adfc15aabee19931c740972bc20eba4daedbbb3af8ac9b93537bb3234a76a11463de363292c17547ecc9

Download Submit