hxxp://click[.]campaign[.]ittrainingsonline[.]com/?qs=f59eaefc2a82a7ef3a76d80e88c04aa7b5976b0970e0e6a830da527f166b36c95f84a21e1355cc41d6397009945831a58ac3c891f982b91f4dcbc493d85e6d86

Analysis

max time kernel
142s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://click.campaign.ittrainingsonline.com/?qs=f59eaefc2a82a7ef3a76d80e88c04aa7b5976b0970e0e6a830da527f166b36c95f84a21e1355cc41d6397009945831a58ac3c891f982b91f4dcbc493d85e6d86

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
4620	msedge.exe
4620	msedge.exe
3632	identity_helper.exe
3632	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 1464	4620	msedge.exe	84
PID 4620 wrote to memory of 1464	4620	msedge.exe	84
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	85
PID 4620 wrote to memory of 1868	4620	msedge.exe	86
PID 4620 wrote to memory of 1868	4620	msedge.exe	86
PID 4620 wrote to memory of 3004	4620	msedge.exe	87
PID 4620 wrote to memory of 3004	4620	msedge.exe	87
PID 4620 wrote to memory of 3004	4620	msedge.exe	87
PID 4620 wrote to memory of 3004	4620	msedge.exe	87
PID 4620 wrote to memory of 3004	4620	msedge.exe	87
PID 4620 wrote to memory of 3004	4620	msedge.exe	87
PID 4620 wrote to memory of 3004	4620	msedge.exe	87
PID 4620 wrote to memory of 3004	4620	msedge.exe	87
PID 4620 wrote to memory of 3004	4620	msedge.exe	87
PID 4620 wrote to memory of 3004	4620	msedge.exe	87
PID 4620 wrote to memory of 3004	4620	msedge.exe	87
PID 4620 wrote to memory of 3004	4620	msedge.exe	87
PID 4620 wrote to memory of 3004	4620	msedge.exe	87
PID 4620 wrote to memory of 3004	4620	msedge.exe	87
PID 4620 wrote to memory of 3004	4620	msedge.exe	87
PID 4620 wrote to memory of 3004	4620	msedge.exe	87
PID 4620 wrote to memory of 3004	4620	msedge.exe	87
PID 4620 wrote to memory of 3004	4620	msedge.exe	87
PID 4620 wrote to memory of 3004	4620	msedge.exe	87
PID 4620 wrote to memory of 3004	4620	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://click.campaign.ittrainingsonline.com/?qs=f59eaefc2a82a7ef3a76d80e88c04aa7b5976b0970e0e6a830da527f166b36c95f84a21e1355cc41d6397009945831a58ac3c891f982b91f4dcbc493d85e6d86
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff515b46f8,0x7fff515b4708,0x7fff515b4718
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12141190657495910704,14228442042326800985,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,12141190657495910704,14228442042326800985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,12141190657495910704,14228442042326800985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12141190657495910704,14228442042326800985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12141190657495910704,14228442042326800985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12141190657495910704,14228442042326800985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12141190657495910704,14228442042326800985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12141190657495910704,14228442042326800985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12141190657495910704,14228442042326800985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12141190657495910704,14228442042326800985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12141190657495910704,14228442042326800985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12141190657495910704,14228442042326800985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
24KB

MD5
0e1e83317a4a2034f5f2b0fd189d7b4a

SHA1
bac34c7944425b3ef5a5d1ab55db30b3a96053b2

SHA256
a642bbb749590430e1ed259512a28f51f506c3cb5097726af6247ede06adc1d5

SHA512
0d22e547b7cd8de93412b699e48b8d6c7fc85768623044811113430ea17dfc5136650e768408d4d1e928ecfb56929a4b81ac9aff6510278dd45874579bb8aef7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
160KB

MD5
d2787bae04b6295f2c5600a41e2f9bdb

SHA1
2ca2bbd9e8f597520df61a909c63d4aa008ac5cf

SHA256
7412666a542ce0f7498fc71d86f7e907889930bcf444472981e17645f826085a

SHA512
6abd7a0ee291317af677975b1b516fde8ba73031a4dadf744935f527f5da1c7ee9334a1772b4f6816d61517acff6822f2f10894414d99300d9d49675c030748d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
86KB

MD5
b9edef9f04da10a7135fc84c246a7da2

SHA1
ab5752a12ab84b65bb3b4273fb81c8901f89cc6e

SHA256
acb7649c29fc1c515c1911daacba564d3a4adfd695fda55d9149c0d4b71b2642

SHA512
250c574526a9cca6b664bf9e69a0e237ff72c1e2ea8be527c7f57796b37dad5002c5e10a88a8f3743742cf34d04b289bc0d5e6f637161c189d22623ca6a68b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
106KB

MD5
2c0008467bd547fc289eabfd88e23a68

SHA1
1eb2956c4695411c1b7b16d4bae84bcc8af4619b

SHA256
8c55b8594b592d8d46e354cbb59750ef1e916811cfa733e413ebb2d8ef1d3ad2

SHA512
31910821bd7f9e0a438ce63bfbf99ac16f880320805ecf58f37265813dae5429651fbbb81b17f15483ceb4116a51910927bd5fb484677c4a43f9ebfc3ec14000

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
143KB

MD5
f284725183d74dac6443e9ba9e445a36

SHA1
f1ba6f221546209c970d71797706afcd01645956

SHA256
593ecdbd8486537fefaec4e7b70ddaae01000958a7b9048dc40b6b88a4f8506b

SHA512
fd3968aa82fa6d0fe14fdd962e7c64a27d9a67b27397195358ae376d2b20474c567b18f686c1318c15fb879d7738cb0c1937768288a5724a345f6c8aae90ed64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
46KB

MD5
ff676551a049647fe7af2a92f4bcdcf1

SHA1
7b597b526941dab86d1c8d180706773805a6d058

SHA256
ed4f747c420ba66f5286982a82350aad0fa37d9b6597ba843a9581728546d63e

SHA512
523103f64e6284fe88cb1b9e83ff0af340ceed729233d85f257bebef6d5972073bd10765dc9a4d2aa0ada829930ebd49504ca556a7f32e6a3947ce17cc2b23c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
52de5b71a614f5b7be35aa51fdbbcde9

SHA1
c799dbfccd40a64e6fe1383d9fde67a55fa2a788

SHA256
5ab6aa586fff181714aa3252276b88b7c0de0afc24fa65aa59b6c2039f8a6da6

SHA512
6f117cb76fae511c0a2ddbc60ec3720309e23fd9f7f7084243eff9c21dc62f47b940d1a6227548136a390106f995c5c094acfa70aa538c7580d5462786b4f206

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
c7cea62435ed2cf32d2332908db9a029

SHA1
69a5d6e05799580ea2a3a398622695b6df8ac410

SHA256
d865f31cebeb835b5874877ea85b5cbcc5971b13648aafc5109931e45aa2801a

SHA512
5b31396697f55809b58b54586ef429deb18b7b038e4f6af0a56ea142fa2b282852aa2731db00185bd2f6a72527bb5d6f982ca389072f72311816297c92ecd2bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
2d47c91b55f2cad430bdbb509a3d001f

SHA1
233aa14d1d62ee70b70bbb2cec50ddec3dd1b5eb

SHA256
7efacfdd2940eb084fbfcc643cbc2d2ee61522ac0fc8947458f48cdd4639e93d

SHA512
7e9847744e67c1d3fef655846eb05f0bfbf826b8c2b1b66b42c531d69aa2fbf41e6909238973d5dc77c67579dac59a12b84c1c93c75542335f5399932e1d4436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
844B

MD5
50b2967642c2f35ca39e9c8feee53b39

SHA1
3c4f09d8503e3b471babe56bcc5b67502d09053b

SHA256
80b0ac8d4028521a73f03fcd8ba287b0dac91d437599b0e4bce21c3df1346f9c

SHA512
e64f6c98f10aa510dcd8d9365b67029298b7d46ac243719ce763831bf13b6c9753034eb0e0e0ae9834250f336a082a5eab36e5056914f31d59e2f66aba6c3ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3678e94d4c84f7a19c8086358b6fa75d

SHA1
6e4331ae97519cdd11c5ec61c14ce77706e75167

SHA256
d606928f92adaa0417d98b2d693e3408e060892f624e918979a3f2cc0391ae0c

SHA512
2fa67a24478c27b4209583ff14e4843eb2450483b14463e6df947cf277dde6a550dd3065691bcd7f6792565fa485c060f0ecdf76b8081a04947e05fdf3a65e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
00f9e07c49c02564540db2b992634322

SHA1
b7210b7310f5e2cd5c74ad27dd9f1e10543de9d9

SHA256
b0894f50371256b3d812e8a75c71d4c143ec0a6dc5e71d960ba576ab8048713a

SHA512
f980da71126bb1ec6a5ebd82494dd1a4900b236e36f6a9e9e1e55b4f15c34b50c2bf39539e9057ac21d1b8d49d7fbc2365f8d204a68c7c6e0bf73f1060d5ff77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
aa98f35ea6fc7c26deafb4d74c5ee97c

SHA1
ad9225c59a073244b9fca3db4d70657e722edf5c

SHA256
3e0728155b0b728e1f1225f8d6ea8f0382bb41608df78a1e174295a5c0ae6fbc

SHA512
a2e8ac93d62020044e1ee25420df8ead7594d193e3de06ba6980c2abdc32d8a099d40fcac660365b8552ab6bf07ba2156eb5d2acce32ce83aaa564150b10a38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d9b94079782c756be59342e6a9325348

SHA1
74dbaf63bd1394c87e0d1dbb9cfc42cca713ddba

SHA256
e8622a3a09ac5fe6ac6dc3571d408f34df9a1dfbc6c9f7d3084440b25561a6a4

SHA512
814346ff0b40aa171777a329a711b442798b2109789e36ee3fafb3488016002912ff18e5d056875163eb24645b9e29cb3e5cd5cfbc10f8bda56f6c1e01031a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d4aa39277f15b264dca7514d02dbcd4d

SHA1
2a256b4aebfc500bd3436e7f61743d54a0ae1ca8

SHA256
8b75219d310d51d879e17a096a155b9484bd029ea96002511b46c986ceb01684

SHA512
16a1f37793e79182c09fc60631fa7d13e25b6e315b2b5f68bd72e7c64bdf43e5acaf0af5d49efc47a00dbfcaae6a753c35e9ce74b4fe1a01d40359a7c5df8dc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dde6030eccf7a2e83feb87b89b4fc68f

SHA1
33a8037401a8a81914353e8f7c85294aba3bd405

SHA256
1a39fe8e9b77c5e19cb6aa89df5f55b1489f1698c3591fba7a89417ee12dc74b

SHA512
125b6b17391d0dd21e6fe0ef48691119524c5650bc2fa7e9a3b190d1445af6beb25783177f3ae4fe3b192a680eafe0eb478e2595b0ce9e7caf1e0240f51dfab6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6400ed84d4bb871285145e707e9b72a5

SHA1
3cd183ea58ebf4869670cfcf00b3c7d8aa37e83c

SHA256
adb76b665e01a48e3004763b132a9c31624c9af77dd4c229b2dade79b788f286

SHA512
19352b34b5f851d56bd966fd68fddef0a0fe226d3acb832e4664867ca99937113e2983a3bb06d695c9747bdd5535d023f9b3499da4070c4c40124b5a773247be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
7ac771d5a32ce188c73a9eb4fb970c54

SHA1
5f14518206913b1053e6cafdc8d6040d09b4a456

SHA256
f6c5bde0b0693f7dab57c6acece5c958ab275c153185551c0dfc733c05523ac1

SHA512
16103bf19029a0eb4825e33e8e94b648d6848ab96dde89102f81d55576f2c0f04f64011c3311efb376358237711aa7f74f38e1d41eda56cc4f2e195cbc9e10e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
e905abf575045079669aa5e9b016dbe9

SHA1
5ead33eefda8b7d86a5c90ad8d2a349a8814ccf4

SHA256
1d97428763262222ba28c1b9c53634cf732bd9f09ab6c062826c8a6f3228ebd6

SHA512
451ab7b0b71a6846dcfeb9e005cb366812e7bcc020f195eb26d3b190ae8d8dbd9e14a735e6694c90921c3172e65bb60b65b2d2cf32bb81d0e35fe80f6c53bce1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
368B

MD5
4454cbf796cd5223a9881277d27da0c0

SHA1
1bfbb8f3d34039c326de47821059e66a8072965a

SHA256
028c99c2c66a2d18190c509abb2bbb32d07cecac1edc62c2444369553071aa85

SHA512
fb865623cb4e38342b1375b0d7faafcfd709d34f9066ce454037d21c6492857e9298d9a7b550c26ed26324746cef65d652d64cd638c210b41b9731adf6f01d5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
21173b4006e434e5edfb80618ba1dca9

SHA1
686839be53bf06414accde1f111b4f9bb87ad1c9

SHA256
7ccb685aa250e22b1b7d8dd693be475c117bcce5c671870fda3c12ea135006a2

SHA512
e6d3ff19939da751f09fbb42bd472a6f5ad650912622894e70ff503b160d8333bbcabafcde3de2a43ba4b58e251314b0f4f7b5803105b16637383aa21c1602d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58217d.TMP

Filesize
370B

MD5
13caf750ea66a515c6d49b870915ccb4

SHA1
9b8d01c2aa799718f0150db77e83c722e5b739c5

SHA256
b70f85606517e38b85dae30f0dec3726963f82d5255b6ee2c71ad97a5e24a00c

SHA512
6b636d996817790b141c7f11825615f83cb668bf5875681f6644f573a094389bbeb2f8aa8e7389bc360de68caed0711638b04ac23d0a612a23bf416d5b68c1ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
35209681429e9b77179a928598591cdc

SHA1
df42d0baafff3c52b90ec860e76c602a9347bbde

SHA256
7d7d7718ec32ba728094018f58919e294d218647489e69914fd048edfaff1bcd

SHA512
87733d3d58eae3443494433aaa23ad481689322e57cb1cffb89995be3c2383fd80c8d0d7f0e99d067941ef4e04a842fe2e98e0ae7e62dd3ea3a3ce5617b04afe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f13bc48ba794cf2ef402346c75398421

SHA1
a41fd897cf8ec4b2db8bfd5b8c0bcd6329db7fbc

SHA256
05a6a96a802ff8470a81441bd9c9545dd076d350c0ea1b4665efb7cea2e7c243

SHA512
03a7b90eb99e661a1fbfb1111f85ac0c7b2e0ab6632106c5887b543ab589d765120b03f9aaaa3b4d24647e3868cfc3215af375f608e2882313b9db704fda8a4f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit