hxxp://onlyreeve[.]com/

Analysis

max time kernel
54s
max time network
56s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
18/08/2024, 00:52

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://onlyreeve.com/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "64"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
692	msedge.exe
692	msedge.exe
2016	msedge.exe
2016	msedge.exe
4780	msedge.exe
4780	msedge.exe
1792	identity_helper.exe
1792	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2744	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 4148	2016	msedge.exe	81
PID 2016 wrote to memory of 4148	2016	msedge.exe	81
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 5012	2016	msedge.exe	83
PID 2016 wrote to memory of 692	2016	msedge.exe	84
PID 2016 wrote to memory of 692	2016	msedge.exe	84
PID 2016 wrote to memory of 3936	2016	msedge.exe	85
PID 2016 wrote to memory of 3936	2016	msedge.exe	85
PID 2016 wrote to memory of 3936	2016	msedge.exe	85
PID 2016 wrote to memory of 3936	2016	msedge.exe	85
PID 2016 wrote to memory of 3936	2016	msedge.exe	85
PID 2016 wrote to memory of 3936	2016	msedge.exe	85
PID 2016 wrote to memory of 3936	2016	msedge.exe	85
PID 2016 wrote to memory of 3936	2016	msedge.exe	85
PID 2016 wrote to memory of 3936	2016	msedge.exe	85
PID 2016 wrote to memory of 3936	2016	msedge.exe	85
PID 2016 wrote to memory of 3936	2016	msedge.exe	85
PID 2016 wrote to memory of 3936	2016	msedge.exe	85
PID 2016 wrote to memory of 3936	2016	msedge.exe	85
PID 2016 wrote to memory of 3936	2016	msedge.exe	85
PID 2016 wrote to memory of 3936	2016	msedge.exe	85
PID 2016 wrote to memory of 3936	2016	msedge.exe	85
PID 2016 wrote to memory of 3936	2016	msedge.exe	85
PID 2016 wrote to memory of 3936	2016	msedge.exe	85
PID 2016 wrote to memory of 3936	2016	msedge.exe	85
PID 2016 wrote to memory of 3936	2016	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://onlyreeve.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe565b3cb8,0x7ffe565b3cc8,0x7ffe565b3cd8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,13490074993850311210,10420985401765677693,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,13490074993850311210,10420985401765677693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,13490074993850311210,10420985401765677693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13490074993850311210,10420985401765677693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13490074993850311210,10420985401765677693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,13490074993850311210,10420985401765677693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13490074993850311210,10420985401765677693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,13490074993850311210,10420985401765677693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13490074993850311210,10420985401765677693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13490074993850311210,10420985401765677693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13490074993850311210,10420985401765677693,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13490074993850311210,10420985401765677693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13490074993850311210,10420985401765677693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13490074993850311210,10420985401765677693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13490074993850311210,10420985401765677693,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13490074993850311210,10420985401765677693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13490074993850311210,10420985401765677693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13490074993850311210,10420985401765677693,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
  2⤵
  PID:968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1092

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a30855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2ee16858e751901224340cabb25e5704

SHA1
24e0d2d301f282fb8e492e9df0b36603b28477b2

SHA256
e9784fcff01f83f4925f23e3a24bce63314ea503c2091f7309c014895fead33c

SHA512
bd9994c2fb4bf097ce7ffea412a2bed97e3af386108ab6aab0df9472a92d4bd94489bb9c36750a92f9818fa3ea6d1756497f5364611e6ebd36de4cd14e9a0fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea667b2dedf919487c556b97119cf88a

SHA1
0ee7b1da90be47cc31406f4dba755fd083a29762

SHA256
9e7e47ebf490ba409eab3be0314fa695bf28f4764f4875c7568a54337f2df70f

SHA512
832391afcac34fc6c949dee8120f2a5f83ca68c159ff707751d844b085c7496930f0c8fd8313fd8f10a5f5725138be651953934aa79b087ba3c6dd22eaa49c72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
54KB

MD5
1d032b7b937687d49f48150e1b1de9d3

SHA1
644e0a206d3a996b2220066104d4f21cf6703d37

SHA256
34aac4f0f41429e12923749cb71e37b640e217d1626540add886f389e13641ff

SHA512
88cc053dab9fc596d3045d310240b7f4a4cf136fa2df5151cc467026606383fe81b1b3c02f34f688708d59409e8e6213795ab83630970da17cc51d4a7b7a8195

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
33KB

MD5
54285d7f26ed4bc84ba79113426dcecb

SHA1
17dc89efec5df34a280459ffc0e27cb8467045ab

SHA256
b0754afe500a24201f740ed9c023d64483ca9183fa6361d759bb329462d25344

SHA512
88afabcad8dbb0f49cdea27c64783ec98ece295f139d50029d524950a5b40a7971f033529f7b60e5acdef5f0576bdcf107fa733bf439cc76693b654ebdd9a8df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\47ba125ea990180a_0

Filesize
331KB

MD5
3a3c4f006a6baae752e15d0a39cb137a

SHA1
c139128d4914ac7c2c63bd646fe41c62348598b9

SHA256
4af06599108d816efa3b6436523a1d450fad6ba04045181a798e99b4f0884b77

SHA512
bf1637766a8f39badf9eb5187b14b610df4fe0a4f301b53b25109e82552c00f56ff4331b0cc2a718e80c4105a3ac7f1e89e673a1480f5a5add2daa5e3be10a86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ea9b8918ad020319_0

Filesize
289B

MD5
9dd06c646480a3c87a1cf6072ba71878

SHA1
a89e7aa3d6608441c9ca57f4a4c1027487a14676

SHA256
4ed26592d333fbe6f5f0ff1e8faf937faf62bc8d891bede139edcd4e402a5889

SHA512
610615ee9d98a83547d07c0b8576496c3433330f9cb51b58cb6a8acb9819bf6aeef00a6cec6f85a2b0c4e04f764feb30102d86f421f09e8abd2d0399b38f1536

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
d77b22b3537d5cb74c4ec34dffa220fb

SHA1
3fb296edc20a742a8b8444b4dde5456856beb624

SHA256
ab3b2757a612a0baf1dd520ce273b29cfa8954dbb3742cb463f054ff849cf1c3

SHA512
20c7d8f7bb974da12015d7b989ae297d36a1563d687f9a9e6cf82422078765a1dde0ca462d731c6ba0cdac7e906eb5d5a5a9003ce79a482e10bf55e4df7423c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f543fb2c6ea61f9d1376ac29e2bea477

SHA1
5cbd30ba3b96829f7683aa5823d36ed25cf15cca

SHA256
3410cbeeac27d88867549de79ba9d01a508b052c584e36f5f55d0c86e777b47f

SHA512
967eac3ed45f9ccad564ccdc529bf48fc0b51aa3b1ade59a6ce6b8a95869eff1a933992afcf3d22b6e0480c99823a0dd29d479aa7bcb15740b1d26c94209da8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dddb943db13675d6c9019f86b1182221

SHA1
026d7b3b4c370de3c270860966e856f492c64be6

SHA256
95b9343424eb450b3a55524ab10485100ff4fd603fd9356bbb3064d611f9266a

SHA512
3d4e908423deb220fa62cfa650ad7c6683df07b7308f94522394e77a082a9c47cf5bb02f593458c6f07174b676cdfeca7f61531478026738febdb0d1d6350613

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ac0fca6475b93b774f64c58110ff511b

SHA1
532ef78a10431a05484a9fca76f079b4d132d8ce

SHA256
e24d1cf0034435e992603263b7c0e0fd4b400970e6253513c8e79b103ee36254

SHA512
acb64e89ee8d66b8155263798008e764a656e6455cfe5e2ae801a3fd77281fc27c76005371cfbb71d4fab0b949990a78570a01bffa41f6ed4a8e609de083a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
133eabc2fdaf28ea66b2f4b2ae6d9e05

SHA1
41ad18ef6e9be406020f3f9c2790ebd5c83f9200

SHA256
424f6bed281240e13136dc19daf3cdcfc57d9c38658d6659d536bde84a02c1f8

SHA512
de723a1356c6d25c30683bf03ff2c3b3414e0294055a7e0995790c63cd1be3efec632af1e1c2f6a157f9bda8b87148ac8c99d4e590e5c7f77c0a2216cea3bc0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3ef204030881397c277906f49aae00b3

SHA1
fb69b9ada7a27151242520244646d4c593d3c2cc

SHA256
8fada3eac4c3bb908518533e19939925496576a61b87d7abee606d07bc45cec1

SHA512
a063bfcb7ea73969d06da61cee14ece35ca58b3204d53488463b49bc00091a4e3fbb39294f1af5f91a5861671428f472f743c25f033f9fe8e44c3ee6e7938fab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9091aeef44ae96780fc817e7295801a6

SHA1
9b1a2530ae3f5aaa71403d16c68f3d2b612f2bf1

SHA256
8a90c6eb3c82bc298380e0ac96eeacad2fea1b142c6f4000020be12ba6d31445

SHA512
801ae61ca9f12da6cb5a3c283cd6b6be243cd4a02b692e354794367b9893c9e0a8eb9d2cd5a1ab918adbe66a93d582c108c1dfa79a1e4a8716e4544069b3815f

Download Submit