31431d45a3ace9fc4e3958e4be593949b0f82239f1ad39ff3e7d700c9091d0eb

Analysis

max time kernel
1083s
max time network
1121s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
20-05-2024 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tbe.html
Size

11KB
MD5

ee042bb07e4335d3d0bfac3416e5b708
SHA1

67e2a96062eb4f98240933333bda188bc6e68559
SHA256

31431d45a3ace9fc4e3958e4be593949b0f82239f1ad39ff3e7d700c9091d0eb
SHA512

3886c687e5209ca3fbd25b920f3ac72f7b1a4684a81c470dcb8d6b1afcabf0629d09d58a09db1d819b9097c3bd6d094b1c5e3dc4d4f003216c3f3d71cb01fe64
SSDEEP

192:Ki3k5SziiRr8B1lu39cpfzve0yThrrTSCw:/k5SziiR41luNcpfzve0OhrrTSt

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	discord.com
18	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2457560273-69882387-977367775-1000\{A057D3A1-95A0-4FB2-811E-438311029C01}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
3716	msedge.exe
3716	msedge.exe
4980	identity_helper.exe
4980	identity_helper.exe
4692	msedge.exe
4692	msedge.exe
2408	msedge.exe
2408	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2764	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2764	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 2232	3716	msedge.exe	77
PID 3716 wrote to memory of 2232	3716	msedge.exe	77
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4624	3716	msedge.exe	78
PID 3716 wrote to memory of 4848	3716	msedge.exe	79
PID 3716 wrote to memory of 4848	3716	msedge.exe	79
PID 3716 wrote to memory of 4288	3716	msedge.exe	80
PID 3716 wrote to memory of 4288	3716	msedge.exe	80
PID 3716 wrote to memory of 4288	3716	msedge.exe	80
PID 3716 wrote to memory of 4288	3716	msedge.exe	80
PID 3716 wrote to memory of 4288	3716	msedge.exe	80
PID 3716 wrote to memory of 4288	3716	msedge.exe	80
PID 3716 wrote to memory of 4288	3716	msedge.exe	80
PID 3716 wrote to memory of 4288	3716	msedge.exe	80
PID 3716 wrote to memory of 4288	3716	msedge.exe	80
PID 3716 wrote to memory of 4288	3716	msedge.exe	80
PID 3716 wrote to memory of 4288	3716	msedge.exe	80
PID 3716 wrote to memory of 4288	3716	msedge.exe	80
PID 3716 wrote to memory of 4288	3716	msedge.exe	80
PID 3716 wrote to memory of 4288	3716	msedge.exe	80
PID 3716 wrote to memory of 4288	3716	msedge.exe	80
PID 3716 wrote to memory of 4288	3716	msedge.exe	80
PID 3716 wrote to memory of 4288	3716	msedge.exe	80
PID 3716 wrote to memory of 4288	3716	msedge.exe	80
PID 3716 wrote to memory of 4288	3716	msedge.exe	80
PID 3716 wrote to memory of 4288	3716	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\tbe.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd156c3cb8,0x7ffd156c3cc8,0x7ffd156c3cd8
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1844,5541506406347647034,7589564565141026517,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1844,5541506406347647034,7589564565141026517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1844,5541506406347647034,7589564565141026517,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,5541506406347647034,7589564565141026517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,5541506406347647034,7589564565141026517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1844,5541506406347647034,7589564565141026517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1844,5541506406347647034,7589564565141026517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,5541506406347647034,7589564565141026517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,5541506406347647034,7589564565141026517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,5541506406347647034,7589564565141026517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,5541506406347647034,7589564565141026517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,5541506406347647034,7589564565141026517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,5541506406347647034,7589564565141026517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1844,5541506406347647034,7589564565141026517,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4624 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1844,5541506406347647034,7589564565141026517,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,5541506406347647034,7589564565141026517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1844,5541506406347647034,7589564565141026517,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1660 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4860

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0d84d1490aa9f725b68407eab8f0030e

SHA1
83964574467b7422e160af34ef024d1821d6d1c3

SHA256
40c09bb0248add089873d1117aadefb46c1b4e23241ba4621f707312de9c829e

SHA512
f84552335ff96b5b4841ec26e222c24af79b6d0271d27ad05a9dfcee254a7b9e9019e7fac0def1245a74754fae81f7126499bf1001615073284052aaa949fa00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0c705388d79c00418e5c1751159353e3

SHA1
aaeafebce5483626ef82813d286511c1f353f861

SHA256
697bd270be634688c48210bee7c5111d7897fd71a6af0bbb2141cefd2f8e4a4d

SHA512
c1614e79650ab9822c4e175ba528ea4efadc7a6313204e4e69b4a9bd06327fb92f56fba95f2595885b1604ca8d8f6b282ab542988995c674d89901da2bc4186f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\05d56e56-5b42-4aab-9795-ebdd75cd74bc.tmp

Filesize
5KB

MD5
67de191b3a07355082c89e630f9c9baf

SHA1
b3f545ef23062d4d92c773c639709e62905c1563

SHA256
8d3c9d8ef1a2681ab65ca853272f7393b6b46c7bf2ffbddc8ee6ddc218ad98d5

SHA512
dc27a4c4e399c9cdcbf3baa56862ca1355cd42c4a0b0d1a1a28bdcacc135e72db55979db362a1210d92f3d9017b6273fb1ec01cff2cd740dd63036eb24f4d20c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
5bb338a0b5e57fdbdebd2716a2ed1378

SHA1
ae9a0ee0738374ccfc2fd1122d319695300039d9

SHA256
88d18680537c7402861339d65da98b82f14d8322a07565f11f6d9e187fb2d00d

SHA512
4f381405fe68419c9e81cbff94cb77a8cf8874e43be2c04b0156ec4c6ae2fe9433997c68bb1ad29d7259c0de2a152aec57944bdf359d6c861bb5a278ef2227fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
5189c87b8a955ccb8b3e636f635a12d6

SHA1
db2356d1447074c0aee14c3771eac891022542bb

SHA256
3c6d2cd4cd281887ece6a3ccc805846c6d52d5f58432c669715e840b2a6f1e19

SHA512
3b03825462a13f900e29393b111f84b639691c856994c9e51b90ef9b83dfbbf7a49e7fe5b998cf5b5b54d09b9ebe1442032191be266688bcf51f21094ce9c1a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
907B

MD5
a0bfb3f8d741b590fb35465fe0618b68

SHA1
875217eb5f1231a4a3544578396d7aeaaccb67cd

SHA256
cb04655cd9922a982e60d4365ca99a27b02ccd442b3575fb1fe1c2238792a69a

SHA512
59ba49483c112afaf4f87759fa97569fb33df27ff094d997bb0520652f506f4aa8e8de350226e04f4c381ec932f6dde081367a00424050b2129c0b7dee8a2e9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
907B

MD5
dd8d1825f7935eaa5f04d3327338d66f

SHA1
d2e16d14de150eed0ab59ad2a3fa4457743841da

SHA256
596302e40b4c7547d1785a0124d5770ffb2f42abe78162361b07788dff923176

SHA512
54b44735049938a7ae81903c25d433a1b18458f4b50eab4760fa2afa64c01b5519a0e25da59f359d19624d1bdb368b1cd704b3de9057860d0dccd04bba0c0538

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
907B

MD5
d5a8fad430d67b4026e594c5b8def871

SHA1
772a29c8f518310d060b22320e1f9cdac7dd5264

SHA256
76fe4eb2dce355355a9a158cec65d9a1c5ff4d71b5f1595b5e8c0e05182ea376

SHA512
ebeb18d74a0d5b14ae46155382212549fc80b227decbfd1dd941e8013fd0c9a9399f6dedafcc0fbdc01700c5448e0a6e1dc8277134f23f721358f8f304bfb7e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
907B

MD5
693914ebcdea553a13f5798d4b729200

SHA1
d626dfd931d2a605713fafaf97d561d0855df09e

SHA256
5530d1f57fea1915c5c048d0c7ab5e2f3842ae7c0800b04034eaa9f8875fb8bc

SHA512
36918cb4e65dd6d989382e75d12efb2606f39870aa438e6a9425b3d1fa9e9daefb5f418968c37ff94890c6b2f41ad549d3451716ce6e146f3f90029be60e4d01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
907B

MD5
747285a29b06f0a9570db16d4d8d41bc

SHA1
9e742874999f51b611fc22d771920612cc85db30

SHA256
083f7071a17a19a97f8a03718c9a90c4aa7a1a4dafc0cbbbe31752d0dd3f565b

SHA512
ee4c695a591b555746fb62b2d9d4b9d52a0510e6b009f58d86064402e71c921db17c35eb591cdf597ba9a3c87ecde2bd08a0f9fe7b124f8a47022e9d472aafd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
907B

MD5
524577082e2be5e0f405303ad3eb7d8a

SHA1
b4f06af9f025677c5c1f766064f1941b4b9e6bb0

SHA256
67128a079c4cc04ab07ad034ea9ae8b0eb07e81da17b8196ab62b4f73b8dc8e1

SHA512
15d4b4d1f24cbbb4bb7ad26d4365a131352ec43b81e3645bcfe92ebb8924f9a2d871ba30c5922b30b2a7cfeb084d7151a376a50bbdfd994bcf6f8bbd50c67556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6ad5bb7feb2167f86e96ecb2ba49943b

SHA1
450dde0d2821310701f3dca4eca3050a7f562800

SHA256
8ce076ce091ae69b09d13eb008f83bb8453af8f94aa824b1ec0c425402be7b43

SHA512
1c0bd7b6f287cd97d7f6f29fe1000c139b52583a0944068d528ea14447677fbb20595ce7205e5ce5d253090df75a330a2abd6eed41d4bff6550c287f52eefe88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3e9cff0eaf2ff7c196644e75431f09b6

SHA1
99995894fb891d446faa72f0860fa9152e08523f

SHA256
660821dcdb49d723b83016435c503021f6c3792aecaed2912143a742abc28af7

SHA512
659d6431586c81458e7472b949f95b00a9eb5571c7bc688ea6137e827294c1dae417ecb3710e4aa9329d8e4c3acadf2e1bf90f514fa4ff848fede5b1d752a20e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
87c79ddd37c973001d8d388304b458e5

SHA1
b605d5b0d83900d1fbd0bd7c4bd4944e8a3fdfa9

SHA256
069755f0b0264d145b6506648b56b3622156ac8afa227ce3ad9e60374ef3b436

SHA512
3f5ccc92ada23ce06bf77c7fb2f3c9720d8a33e74a08f3b59150027cd8f160158a63b015136e3bb8541984cfa496e5c09589287c4f9e6d2ae76025afa61fe2ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
84b766c539a9b7e7c551b188ace291ff

SHA1
f5ec5ac38cca73d8eb4432144cf0980c6798f046

SHA256
9afb36b7b3b167402c962e2c7d28fbb7fad98fddb7d68c1baf6192288ccc26d9

SHA512
3bef52d1c9c7ea805eff26aea9392e93138741dbc42df4da5f644da6534c4121d105d1056b89b965861799a534cc80a3ce4f6063b5962e10a222c447b1532f89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
13ed80eefb0b7a1bc2913c75845ccf81

SHA1
311beafd563caa9f0d5f7caac8133864ed7b4849

SHA256
63dbc53da8d64820ce0a61a19f05247f5b44def3638b79b15eceb19568bf05aa

SHA512
1e0031b4ac91da73e0585ce0ce8245723ce80957888917c4365f3701deb9c7a6aace57cb13f0e65ce68e8ebf626d61a3c485ad66d022379edc408e8035f2f9c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a9ae472c818ecc21224118ffbd6ed1ad

SHA1
bfce3c353bed9ae1df905e8c3b3d513e756e1e4c

SHA256
62bf2339b8755ca080225ab779d5a0a55883dd14721d2cbedf7de8d676e998ab

SHA512
3373fb43027bfd4c28eb673af520907dd24c121fd17c87d13ec58565094e576f7d0275353996c5e15d1143504099ac222c259ba2356f0a802224478ca8d23dea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
db1567db388a0455b1f741c6c6bb2af4

SHA1
aa737966741745f74a586cd779421d5888f982c6

SHA256
34bfd366bec58581083a2c6860480afc61a2856c07aaf39673c9b0fbebd10789

SHA512
357281723303492e39e4336ff67e134aab0971ead5047b3940955c3aad90e3117b848a3b3352f3ff1dd2e58ac0b875398f56e594c273f6f8ad8c5781900fb7ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
71ce8c93e225240c05a83edcc8644437

SHA1
850ce6e5bb87321e0223fe821675e419c6be98bc

SHA256
c88fa3b9b5c7ff7408d9acbecea7c2210965966a66d65dbbc2a2b2260a0fcbe4

SHA512
6a70ae1d23ae224e255e1e66128f805055459be54ce450b4f66d377ecb7e2676c89bf9dd672d6ccb9b77624e2a490605b4753126c7e2d856d2ad925c6831d5ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
594d0198e1b7a3724b3e4f5ab8e2185e

SHA1
7dcb89572f9ea4313c98690a92f14500af314352

SHA256
ee3479fdc77e78503a282fec03190b4b57fb43443ca2bdc38f67fe94f370de2a

SHA512
7da96d2211f6302de2ce553f6ca3ffbaa3f549d36cf2704e5a290ed11d864db29075089ef73c9e3e66662617ef3d1eb8f795c51aa63d6c23d60199c62de3c2cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5853b9.TMP

Filesize
370B

MD5
bc3aacc95761b103d95cb08db34ee60d

SHA1
909388b7aed965f8b342d0877ef091bad2872090

SHA256
d6b55c894827d8802abd8e3ca8c320cb5d3cc797e3fa7cc2f6c7858c5fda5c59

SHA512
ca87d422e7196552b67169fb5eebd8b900c1ecd72c061a582e21c85ead21a1c526cb1b9b3edc408441aad507c267a225805c21a7d1f4d87936e79983e936f5b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
704d2b1f61d064921ecf74ad99f36866

SHA1
a978965796d22dd8cfe49ae6cf8511c0a28127ab

SHA256
f7ea69c46c14fcf1bfab1a581873c8374c719239da2c13b6d8ca028c7e389d5d

SHA512
1c44e18e76fc135b14867a68cb932ed6df4412947ab151937b8b21691cc68be968b8fed7d060ce52d74914dad75bf8e95fe285d8edb07ab50759ed96cdf7b7f8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit