b2dd6d0a1401d10b979c7636fb824ce275b588deb294564fc684d692d7690932

Resubmissions

Analysis

max time kernel
210s
max time network
211s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
05/06/2024, 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

videos.html
Size

530KB
MD5

5caa063ec88ff02816fb04a4eb1abb12
SHA1

8b3ca0aa456559c8e583972f176dd82681f01721
SHA256

b2dd6d0a1401d10b979c7636fb824ce275b588deb294564fc684d692d7690932
SHA512

22583b9efc774058693cff6b2e4335fb7141865cdf4942aa4cfeee889979c77c527167b693fed4eb78d111b4f0fd9cfbd9d68d6bfca21e894534dfc9e6e2cfd3
SSDEEP

6144:kmp5/K5/05/x5/c5/l5/P5/55/e5/k5/ux9M5G6jxv:kS5y5M555U595X5B525M5Wexv

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1672260578-815027929-964132517-1000\{B363D940-7B6B-46B7-BF80-7E93E96F7754}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe
3040	msedge.exe
3040	msedge.exe
344	msedge.exe
344	msedge.exe
4184	msedge.exe
4184	msedge.exe
1104	identity_helper.exe
1104	identity_helper.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 1264	3040	msedge.exe	77
PID 3040 wrote to memory of 1264	3040	msedge.exe	77
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 2144	3040	msedge.exe	78
PID 3040 wrote to memory of 4016	3040	msedge.exe	79
PID 3040 wrote to memory of 4016	3040	msedge.exe	79
PID 3040 wrote to memory of 3208	3040	msedge.exe	80
PID 3040 wrote to memory of 3208	3040	msedge.exe	80
PID 3040 wrote to memory of 3208	3040	msedge.exe	80
PID 3040 wrote to memory of 3208	3040	msedge.exe	80
PID 3040 wrote to memory of 3208	3040	msedge.exe	80
PID 3040 wrote to memory of 3208	3040	msedge.exe	80
PID 3040 wrote to memory of 3208	3040	msedge.exe	80
PID 3040 wrote to memory of 3208	3040	msedge.exe	80
PID 3040 wrote to memory of 3208	3040	msedge.exe	80
PID 3040 wrote to memory of 3208	3040	msedge.exe	80
PID 3040 wrote to memory of 3208	3040	msedge.exe	80
PID 3040 wrote to memory of 3208	3040	msedge.exe	80
PID 3040 wrote to memory of 3208	3040	msedge.exe	80
PID 3040 wrote to memory of 3208	3040	msedge.exe	80
PID 3040 wrote to memory of 3208	3040	msedge.exe	80
PID 3040 wrote to memory of 3208	3040	msedge.exe	80
PID 3040 wrote to memory of 3208	3040	msedge.exe	80
PID 3040 wrote to memory of 3208	3040	msedge.exe	80
PID 3040 wrote to memory of 3208	3040	msedge.exe	80
PID 3040 wrote to memory of 3208	3040	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\videos.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd244c3cb8,0x7ffd244c3cc8,0x7ffd244c3cd8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1808 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1796 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1816,6471916212974183493,2727920439435984304,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6664 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2264

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x0000000000000410
1⤵
PID:3688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d56e8f308a28ac4183257a7950ab5c89

SHA1
044969c58cef041a073c2d132fa66ccc1ee553fe

SHA256
0bc24451c65457abc1e4e340be2f8faceae6b6ec7768a21d44bcd14636543bae

SHA512
fd5798559f4025ec3408f5550b8671d394b1ec83b85fdac8c005b0cc3e183272bdd07db15a156a572c9c5e5798badf235dc10aae62a052efa8dd9dfdbdca8189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f2eb94e31cadfb6eb07e6bbe61ef7ae

SHA1
3f42b0d5a90408689e7f7941f8db72a67d5a2eab

SHA256
d222c8e3b19cda2657629a486faf32962e016fc66561ce0d17010afdb283c9de

SHA512
9f7f84149885b851e0bf7173c540e466a2b2eb9907d8b608f60360933328cc75d9d1b63640ea4ecc1e64ecc5dd7ee74d82903f96a8b4418ca56296641a8c0703

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
63KB

MD5
5d0e354e98734f75eee79829eb7b9039

SHA1
86ffc126d8b7473568a4bb04d49021959a892b3a

SHA256
1cf8ae1c13406a2b4fc81dae6e30f6ea6a8a72566222d2ffe9e85b7e3676b97e

SHA512
4475f576a2cdaac1ebdec9e0a94f3098e2bc84b9a2a1da004c67e73597dd61acfbb88c94d0d39a655732c77565b7cc06880c78a97307cb3aac5abf16dd14ec79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
69KB

MD5
c0b23ab60efb763d27f9f92b50b6728f

SHA1
259f669d1089469b1485ab4c07942c8f32431267

SHA256
c066161623da6821af1d38fb2fc8b5026e89caf02416be88d9543d1a0d337f1f

SHA512
0a43c9a501a2b462b19abca689815b4a8ddab19b1abef51072f86686fe6c20f555b9d4edc62cc41d3dff6f364269507a75da6d43ec11eec129d28a44857bb717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
42KB

MD5
cd0fb8fe3cc7b37a4b9fb30939eac95d

SHA1
00e711ef02aff4c3430d8624a10f10cd2032bed5

SHA256
0dff8827b203a70c7467480272b269e5c6c6af41973d9359153d93c3a68c4b6e

SHA512
f5b7e66636f9944a2b0ee61935836d9e94107e7832abe5b780b952157555733910618804093e39c2d72d96b78b0f792d74b2a9cbebd434d6cc8b32d92da7e1a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
1.2MB

MD5
f2c3793859662dd058fb0eaf9943cf41

SHA1
11fb301cfeb538aa40e5be4e22edf24f6180e777

SHA256
37bb4faaba4a3dfc78eae7d3053fbc3aafede11eb62dc712d640e7e8a4b88082

SHA512
003bd4927a4bc558b1570e6ad952b8e82d72f8cf0159600c520afccebcc283721d741fbe15894da91bdd6e80ff8ff3bfcb3cfe0bb8af948bafa51abb03dfda3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
67KB

MD5
d2d55f8057f8b03c94a81f3839b348b9

SHA1
37c399584539734ff679e3c66309498c8b2dd4d9

SHA256
6e273f3491917d37f4dbb6c3f4d3f862cada25c20a36b245ea7c6bd860fb400c

SHA512
7bcdbb9e8d005a532ec12485a9c4b777ddec4aee66333757cdae3f84811099a574e719d45eb4487072d0162fa4654349dd73705a8d1913834535b1a3e2247dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
41KB

MD5
cd0fe6eb96563ca41535140ef28ebb28

SHA1
e459c87b22eb8cb6bc44b4a23d8c66489d00e30e

SHA256
8ce4590e6b3cae65a45b8b30a4288e906a81c65ec0389dfa2af67cd0a3543e5b

SHA512
293cac9d0956c44023bfabaeb782cbda0f6f4fbd57272aa6eb5855589aa65cd7cb4d052694d4eb04f7c69410e130f0e5256b6aed9bdeb2da77b3b31e4ac0c756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000059

Filesize
110KB

MD5
2810d60497ba81a265c1e5d252837cf4

SHA1
e59dbfab0a1e30243a93858065e693bdb8e45b93

SHA256
b1227269deed6a54f07e4e1cfec05a3e3d388d1ab9e6b0b1a7de022941d8216a

SHA512
c262a911f166c843ae674d355707772d544412087dc86a0ee62ee78e847f46aef302e3aeb3c72c0e1a41a23206cfc44977d033454025525c30b45c4135979a86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005f

Filesize
16KB

MD5
dbd83ed61eef16ac5c21f0ea060e9013

SHA1
aa5ae603a82d0aee2baf7a9b9684372e8f82546d

SHA256
744930789a8a2d1483111fae6c20cedae4307d05bb58a81a2406cf7e2c2d7a8a

SHA512
e6cbcfe5af76d1ac8369418f74a851a669f471ae5c7f69c4565202794b5f07616c7bd2d177d05bf14552f6f5d676a50c1a9a2eb7870c35868aa046a9d63bbdcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000060

Filesize
83KB

MD5
9a7779a49d0aca4586c0ae5171929aeb

SHA1
6febff75e9fdd37146de11ae9390cdeb5497c985

SHA256
75ccf4d89f150d68f0d031b20d8fe879cf3cdeed634899a6c428d1b71d3e0f95

SHA512
4066e9eded1cce0ca22037d830ffd4e0a0c24be7be619e98c31d5ac87f6c86867064831f5c953d204511e86a6cbd7e316edaad27351934ed57a95702c2d28a98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000061

Filesize
194KB

MD5
10d0977b31207738e2fdc48ce4e23944

SHA1
e1c6a1b002034c875cbd67ea4a9aa84c110a00f2

SHA256
7e0fb824af590581a19388bda580b83b8448424b548630fa672b7c4ecd755e11

SHA512
032a20dc92eccbdd157e411490717d914152eb2f4603f4f3b04922a6a16c9eb48008a9dadbb0ab4f8ff467f436b5f34f0aa5efa062a873d82d2178fc4aa2f949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\411734bd50152099_0

Filesize
5KB

MD5
929d54b52336c1243bcf6d0bc3c6c45c

SHA1
ea70fabab014487d9881bc5270c4357e68778d7a

SHA256
de70b2f7f4e28104398a40c1e58705f18b91b90a326ce71fa318e891a4c904fa

SHA512
0b898e5c463bd5cb13f8a0757b19c63aa31a0c9c88825b4afc17f39d07a3ca09aa7f37b9aaf25f16cbe35a8719960ed7b3e87f1311dba3d65dd2319ef49e6d6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
88f084982dd69e504ebb7c20990c764b

SHA1
cb46c8b3287bdad2a67a826483e22d085ccc1e4b

SHA256
bf7e7320af38f435b6d41d38475b74156b5bcd7c9680de8d5584eef6ad8f37a9

SHA512
6ca4e6759776d8e96bf75614b3aa8c7764aff96c10aeee124b3ed7981e1835649b9756e58ffe1257c6f09805bfa55de24c98a4ae11cc4feb0a060897ac61915b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b053d18200e7583c07b41be525eace97

SHA1
9658334d9c3b7ad4b4443fcd362bffeb6a4c5432

SHA256
248d08cb49963d7d97804efc41cc01b545335c2db452058f9da4f15e6a772693

SHA512
42542ab0d31b9c5c2e20f435161e0f59fe351eb79c4b9a7c62d7ee19c163bf11d7b5ab40d81364d4fa8887af98bb566cb9841841fc02e54c5edfe5c796a1a73a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
92661d1d412724542b239b77cc34bb99

SHA1
c1e983cdae93a5dd9bd318dc8f0879625f95743e

SHA256
d87f8f973718d64f7cfd21c3a1c7107a73101663cedf20d82bfec18283914217

SHA512
12947e6d00649998853d755cf78839dbd33100feab4ba259f371856f9e81b8a64b291cf2f4e376902aa4974efdecf87594dad6279b0e95612cf4cabe6beda83c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
e7993066bb8d294b93a2af3d003060d7

SHA1
365d680d974aef099d07023e011343df5a48c951

SHA256
e4d9abcacbb4053d9f3b459bc4ae78c0502d142744a2ebe3060aa9f0d9e3119c

SHA512
afb315b983232b50ae45f40ba07e6180dec9e0ac9e51e2caae0db69a512b9bca9eb784d278f6197e9b6376451741f9b5c173c6b5978da783d8cc55957788f9f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
917268009442ca2894fd3c41162c8ff1

SHA1
f76ff104df1cbc539654d634e440a7109e22bb65

SHA256
f6c392a55102dffcedd27a4317ac0c9c020e2f0ef511bd55f5986513835a07b8

SHA512
94eb9c971382945b90940208af5a4c5c79f82600152e3ca01e1aab255f986f298101686452211237185ef3b4516b88216958a39e05b457218284333d2f823570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
919899357eef8dc4f0fa4d2d196bc81a

SHA1
6061eea3dfcf526cb2133284329ebc7b2a9f809c

SHA256
1eb5efa36ed7909104ede519e2434ae10a907f3da53945c94e91da692135ab25

SHA512
6dbd555c0e581c025817fb05e2110a3dcc6057c4107841dcec8719d4114cd9d72e0e04ddd6a41b8f677f961bbbf83ef44b99f142e6b33778e8e1e60f0eae0246

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
52725a7237d025172c727e0bd83d02dc

SHA1
890ad35ca6048a9c86501670dde4868449dbfd2f

SHA256
8468a50130bb01f619ab35efc04fc9af999c91edfebc36225cae8430758fb0a8

SHA512
98bb9459d273d57fbaf4c1c904a23c456087c8339efec43ee8fe45a5ef0c887513b7777ce351975341732b60b8c5eeb6d591fcb85e806fa1aac34b448fe6c68d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
296c5d5ebb21207f502d86ec43a49ba4

SHA1
935cf53dd59010b029c7d0ebf2aaad292b6a0563

SHA256
bbe5a9e9e9c4650aa62c38aebaa8ab06c1e6b097514d746d76f795bd8f869d8b

SHA512
d00decd0db9e37ace24489745e0feef7e39e909eadd69882fec219bf4781ad9b15f1ea8b1ed05df89162ee509ae7e58c9f0f4353ac7f00c32eaab51b8f842f6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c4d24acf1af9c4afd6e0d964e7e3f0b2

SHA1
1aeef7811f265dac57e0247e296e40ea40a7c7c6

SHA256
7d5d8e2f375bec54750debddbf9f28c20d869f9fea3412b9bce55946efcd3e74

SHA512
88e6a770bc3bf4e64be198870be0a921a81b27894193def13ee57809959acab201f05350cba384640cf420204e5e13060f982cc48f3f1795d95109375d4d6d77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cce5d6e1e271bcfe9ebc71821a4408b6

SHA1
a5a180319d92511fa526714fb463114a1e3cd51d

SHA256
fe055527d7469bea4e32e6759e1acf2dc2517236a7c9d67fb576630dea8b75ad

SHA512
94ccb826d8e588d2e324f95c9a9994d7818ba406aed172fe51a13205d09ab1aa4fb9a0d557147c48305437c07f11b94fb5b36e5e7f33814d8aa675442f3c65ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
45b3e3d3b79007a5b4e210c0551cf9d3

SHA1
d859f0485d8360006e426b38d5107a43adff90b2

SHA256
b464ce9ccb3172d6973fd820ceab132b3d6d2609bce29fa8e1f0190eea9854e0

SHA512
c43df37b3c65466b5c5388cb3eda2b5285ddc78144874ccd1ca4759eb52ba1d4d0a96da21623e7c627d4278381701d6d4549b723c5d88a1ce4e3f597cd02984a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fcb75819d9d55f30954d1f90c9ce2044

SHA1
a238e0b3816063e7301147d8d6871f9a48dd2381

SHA256
654e90879e236c2aae856acd3b6965718f5f105d6296768e1b7fb00eac9f320c

SHA512
8c161afed3b9c37fde44bb860e25f773f90d34056ef006998db1a0253400e89ee49696b306d3f42cac368b403de25fd8010504ae12717b1849af01dde1b7e90d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7adf276cd6ce5866048f273f09f59650

SHA1
14aa387f2bc908dd961cf0c77d92b9176252df6f

SHA256
a485118b728f489abe0a3975185cf4dced6df80313860ad756c9ed3e4b2888b2

SHA512
ae0c4d59f18d9b2169172f8c7415762b222a5176e9424a4c6bc4ad1dcf6749483e7dc2597f858ddcbadfcb75456b4384ae3c1c7c364c10fb4b50ed76f3dbee8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\eb7c68d5-552c-45a4-921a-62544e38bea9\index-dir\the-real-index

Filesize
96B

MD5
db38d5092daf7dadcd00f5f22247721e

SHA1
64bedf19176883bc05f19ae6391b5b6d63b87aad

SHA256
e8f223ba1be7a46bc7dcf5b56b2260c979a650577a37a0c5a1b4f77a22c708a1

SHA512
e5e5f8a23a64c74804cc6725bbe3e1416ad40840c2a145a50267a2e9d6d6bf53c9b47367ed2f0fb297b7c49717bd326fcd61cbc868ab75f7f405959da8d8d407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\eb7c68d5-552c-45a4-921a-62544e38bea9\index-dir\the-real-index~RFe581ac6.TMP

Filesize
48B

MD5
4d7bcf1e26b379772b3b3d9f03b1d88a

SHA1
a471a9d729fe3309c73521747d8852b7d2182324

SHA256
a534f87746c75c123b8541905ab73e268b25de59e7dbe6fb2f6cec09d4346b34

SHA512
d9a9f0c9752801b33217b1470b2092378e8f024adbca4abd90451c7e94e687080ea90de96180a85892c5c146b792bf7f7c0442206ed2a5b785aa0d40c7e3de0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
73B

MD5
325f5472b7b3702314dae23fc8ce5b24

SHA1
6490641c2e7afd2847d85a4e0b64a3e93eb03819

SHA256
6f53a77b2a856b810a770676ca7fca4d96938ccdeb2470f1cf0a8a9883131710

SHA512
2c978e9067dbd5bd5c14ae6eeaf5aedf5fb862f3e798262f0b899447876c6e3f4b61b2a028b5c90a6b1779d6b2d1610d0b68440f695c7467d759a2df896405e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
130B

MD5
1c998b72cd43129e35ad432ce855d8aa

SHA1
446cae069419b0b36a72ed191e6b28acc406ddd4

SHA256
b2d4952f01676b9063db0f853c9fba522573602ce2179ff3c2a73439ca201520

SHA512
31d1e615d74cffda009104591297108b27e3c97d00df2e27329e8a3f0a461f1fc84d2100752aa2f6dd1140d452fe4a5619b9dd8eb71d12f711f914881b6c7ec4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
66B

MD5
bee06037790ea4d04ef67d6aa63d2651

SHA1
61620ee00a772cb41c8161f7378e20b491c4375e

SHA256
45e02cb87e4d7a50b00cf742345fbcb5b54b5d97bf8ea25b64c4cde8abce63fa

SHA512
38a4bee5cc6963d710bc282da36536f53ed79d0877651d72b6d30da3269c8bc99c42f9bcb554671835407e9941489100fb94573c58db56db1eaec04c36fbb422

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
67B

MD5
5b056165937a28956c3a26071eea8fbf

SHA1
2e7ddcd223284f904d71221884c924f42d4f87ba

SHA256
ab83b618adf99473a24f9426dcb6439e9e9fc5f276e1af559b8c7babf8dc8b00

SHA512
0d2e700738f1a5e597da1e55977e921cea209b90aa4a1ee800282cc77463c4fd6a2f74f24a6786e34773e296802672c2a2818fc634fcda555b5eb3dfc2bfabe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e8427de050e5b5d83bad94772be8755d

SHA1
5d68b4f2f283a44d666104644194088449f98477

SHA256
67e14416cee0ed4e1f62c037379cb1dbaca1fb3cbb223dddbb9ef6a6983a70ed

SHA512
25ddd48f40d815a4c7628e5e7f525b9ea12dd73c67856f27cfcbe4cfe131980d2ba360153c40599b31a11527a7662a32cfcce766e0aba760554e8aaf9a13b5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8a669ea997de0dea20be801ac426bf59

SHA1
874996354b4c6eb9d14b587664d265bc2b540ea9

SHA256
cfe1c9c881d27b734d69baba66756fb86ce166da4d81362cae2a1fc8a91ed94c

SHA512
b9106c924cd4e2b321ff6c117dffaba27fd3d46c6c5dd5c0858821f228c527b88baa9dd3dcfb029823d4d0a107f7879914187e45fb916a0ce2a33d5038c9e563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
066c77e1798e0da7d271d2b5892c5691

SHA1
e6f12bf01a02aa78fd7e944884ffa2fddaf98b5e

SHA256
d0d9af520630f2d06dc73bf3b82f3487da6488cf4c1beb4ea8d3a3eec11d68e0

SHA512
d51dae3ce9b95aaa3fcec2cb971a5b2e975b0ebbf48ec336d311706696e0ade7b0d5fd6a55d635b9643588bcceda89058bc6ccb1c3ff0311c45d74ad369828ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
84893beca30d46b5b3c4c8dcdc0dc7eb

SHA1
81da245c917d0f50c3a7da9579d456c5a2ee4223

SHA256
2d68fa313fd0d44eb624bd95e6b369ab9681c7a4b334504d49f0e088b932625c

SHA512
20026dc27093a7e6e6755b455dd3134b9e2599068bda6800cadac02c678cb833059b4ec76f2c72323aa326f013bb9fed8940dcc4267b4e099b5a6fab6cd47315

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c0b318ddd4a762fd07088babd45f9015

SHA1
42c96f0eb38d3ebfd1dd8ff635e8b3820421bd81

SHA256
f4595e6d52f8f4ec2f3de14c1ea88b059c5f7768fb9c1b162ac1a39fc156fb67

SHA512
e652a5bd15f748760e4b16c15ddffab0f589681ece3dfa8457b659bbfa076a8869ff41cdfa08c4fcf3663c69307a4a9c8ac1caa56665705db622376b9ddd50f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5963bacd42e65a13b4d96892c6ea270d

SHA1
f792c1166cd9beba51a5a1fae27f97a318f37fca

SHA256
cdcee69b6654c84823846f485532c0d97b4665c75d216d9c4c1358bd8ae8a803

SHA512
a0b356e67ffdace43fd62bf790c2a4bad216a8261f0cd34a3e7afce9a50e796e7cc472f54e625b08906a827ac36cb58c7298060eb8fbde4ac9dad0ded60066b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
16847af403bae043c9b355b1d15074b2

SHA1
a84b9fd7e733f1c8a61dd6ccda43dd667159c8d9

SHA256
a888394a073444e89042033bf14fa6ddd3693585594c5350824980184d2d5bb0

SHA512
04e4c13f65a43e18f7967c8d7c13c14be4df2f91024e6b008a2883e15006b491ed5d6c527924620bc78e32642387ea28bcd9edb4c89030f20e6cc265b5345372

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ee77bdc6bb12756795341cdf76f18b13

SHA1
f45da108d619a17887051031a93ed276c5493bc3

SHA256
4585e0508f89207a05a94ce5e81fb21e77b3aa02a2228e1b4ea45c63429a5d3c

SHA512
8164cac1cfb42338856f7121c35efda72743042099ce1c792ad9a8bf7d4df4ac5da1b1fdb656d14358348c680f0d56c18cc030dea1910b1b46f2f5b1fa1bb38d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6042943bbed5d83cf21004426b29d83b

SHA1
87f58943d5918b89450b18146e0a081922488875

SHA256
d3d119dda647483b62048e79acdd268319e27230db3405a6a62a2399af452822

SHA512
d424202e8aad78938d16cc35f611b14ec11a628cf9157b0e2c3b7633bf67ab474ebee98c19c6fe953dddce36c3ab0c7bcd96b3b7d145d5fc25f891e121218add

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d1d7b0409a89af93eafe8c0e30d5b17a

SHA1
60d5b938f1f7ae3af0cf8641b0f0c58d04df463b

SHA256
54b89546e6272423a56de3d94c6dbe1894417b32616db247bb06b3bcbfeda283

SHA512
3174ce1e1d9f3144c669b598ad63a92274d1d3a56760c2591df3a25272a98dc480abdc90bc9fcb08b0c8dcb16004ff40247d9c2437374b35426e46edda338fa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ec44.TMP

Filesize
705B

MD5
c82fad493df975b161f6e3d13b80c3ad

SHA1
096541d83b57d84912177c0e86b1f864f483786f

SHA256
2e8687bdb886a17de7c7cacbfd22eb1e17c939480ef1e76ee07d69d36f0a7256

SHA512
201c84f6f5e2c0a4891d376f69501f10e11a46b7576f30757240f6ce53e4098e121ca2aac65090e19b7b79fd6c2a2e0eb22e049e167bf130ce7726dcfe91f1b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a20868cfd20ec2cbfb205758a888e5b4

SHA1
77a89bd8a769d29a151da63cd22d6334f2244e65

SHA256
9c3d99bbe11b84334767215489bd34bbc44350eeb76141806d8af6fc8a8525c6

SHA512
cabd405eb65efaf776261f89b71d2465f0c353fff4a54f71dda10d42fd5b32019cec48de34ae0409c1148914dacfc5f914e22b05854d668a2bcd3d7de2b9b167

Download Submit