2a0de0678026de7ceec7136264793d455886aeaa433abfcff9c948131c2d2019

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

t6sg0AZJ.html
Size

2KB
MD5

cd78fee42bf06b0d2dfb07d4a0821049
SHA1

cc316f5eab088251af7d5b27f81ddc679e02f366
SHA256

2a0de0678026de7ceec7136264793d455886aeaa433abfcff9c948131c2d2019
SHA512

0ab3a75eb682c225ef612de63dd06b7b98cbc30c284b798a1aa52a77b861b343d5f874ba2770b5d2b9f411fd5ae6d65f97fbf11cf3c4b9a75315e6303ed6d624

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe
2280	msedge.exe
2280	msedge.exe
5004	identity_helper.exe
5004	identity_helper.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1200	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1200	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 1520	2280	msedge.exe	84
PID 2280 wrote to memory of 1520	2280	msedge.exe	84
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 4148	2280	msedge.exe	85
PID 2280 wrote to memory of 2292	2280	msedge.exe	86
PID 2280 wrote to memory of 2292	2280	msedge.exe	86
PID 2280 wrote to memory of 2948	2280	msedge.exe	87
PID 2280 wrote to memory of 2948	2280	msedge.exe	87
PID 2280 wrote to memory of 2948	2280	msedge.exe	87
PID 2280 wrote to memory of 2948	2280	msedge.exe	87
PID 2280 wrote to memory of 2948	2280	msedge.exe	87
PID 2280 wrote to memory of 2948	2280	msedge.exe	87
PID 2280 wrote to memory of 2948	2280	msedge.exe	87
PID 2280 wrote to memory of 2948	2280	msedge.exe	87
PID 2280 wrote to memory of 2948	2280	msedge.exe	87
PID 2280 wrote to memory of 2948	2280	msedge.exe	87
PID 2280 wrote to memory of 2948	2280	msedge.exe	87
PID 2280 wrote to memory of 2948	2280	msedge.exe	87
PID 2280 wrote to memory of 2948	2280	msedge.exe	87
PID 2280 wrote to memory of 2948	2280	msedge.exe	87
PID 2280 wrote to memory of 2948	2280	msedge.exe	87
PID 2280 wrote to memory of 2948	2280	msedge.exe	87
PID 2280 wrote to memory of 2948	2280	msedge.exe	87
PID 2280 wrote to memory of 2948	2280	msedge.exe	87
PID 2280 wrote to memory of 2948	2280	msedge.exe	87
PID 2280 wrote to memory of 2948	2280	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\t6sg0AZJ.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7d1746f8,0x7fff7d174708,0x7fff7d174718
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,4774452029261896644,12073535318093563663,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,4774452029261896644,12073535318093563663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,4774452029261896644,12073535318093563663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4774452029261896644,12073535318093563663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4774452029261896644,12073535318093563663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,4774452029261896644,12073535318093563663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,4774452029261896644,12073535318093563663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4774452029261896644,12073535318093563663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4774452029261896644,12073535318093563663,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4774452029261896644,12073535318093563663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4774452029261896644,12073535318093563663,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,4774452029261896644,12073535318093563663,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4774452029261896644,12073535318093563663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4774452029261896644,12073535318093563663,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4774452029261896644,12073535318093563663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4774452029261896644,12073535318093563663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4774452029261896644,12073535318093563663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4774452029261896644,12073535318093563663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2088,4774452029261896644,12073535318093563663,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2088,4774452029261896644,12073535318093563663,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,4774452029261896644,12073535318093563663,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3984 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2600

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc 0x490
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
228368275b8f546f5b5b276f99d08ae8

SHA1
ad7b42a1343f1f296837fa1beb477b2c35144991

SHA256
f5c608bd47cf3490eb8bf4abb8a0eda339fa1f2dac778224b67346843f5dc978

SHA512
9ef43c223d7b64d93d4e5e7ef4cd8778bd4f196bd99b4488bf6eea41802f6ec4d85f7741c188d1a9c19940956e4cc1d4f6380b6830865d05114b172a4d42537f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
416ae1cdf58201145fa3e6b55282e5cd

SHA1
dfb6501ef37ad07d2c77c668086363ada9f70e18

SHA256
ba2f00a03d4b00dd3496dad3e0a6bfac45c9fc2e524da2ed42e062d1fa42d67f

SHA512
2cf54b3115bbe227cdd8322f1ef505417f772953863819ebcc67d75e3b7e67475537b9b688dbdaa6b6db7c6466d31a3d6e1b1aaf8cb83b67461199f6b67ab764

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a743a31a5cc756f6735322762ed00177

SHA1
ec912cc59166806c3b090cafdcec214c8517a665

SHA256
20d7c9b9b14304f51b82f01ae6a11ec927df0f7a838a96abfc1ec533324a754d

SHA512
653688ad508d143074e30b3563fe9b7bce9d6f4d522fd3f2d25ef3626164354cc8df597571ceaa7068f9797d3829a4d99b6b33bf9709c1cd41832e69a82060a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b913291c03b13b182ceb760181a825a4

SHA1
177acd74c2e13224fb7cf2e7309512ed129e01e8

SHA256
3c595a8edba7e8b24685a7ca71a6f52b9db37501f70e02b158e8e95180407ab2

SHA512
b7577da5b27501d13a8d96ebc8eaa28774c24dcc9e6e6fa556ae77ab853b9e0940c3959cc5029adfa90ae956353e7c11ef498980547f423d9daed598a4d1918b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
394a786efa7a25d5bb59856bf7e51dd1

SHA1
c6fc9ac947bf73d3afdf7d46976b84648d11b234

SHA256
6bdd9a794ebfda465999da994cf7136c852a628494caeb5971abeb6d684662fa

SHA512
e44438a6d86abdc97b3f4290d59f387945ca98ee276cc0661e38884f8bb3f83ec62e5bbd8388bfbd36613f8902852b3ccfc2b3ff4e4de1c4dd65d4ac362d8e51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5386aae8f67a15d4baf8cf27bdd9de83

SHA1
cada119a592ee377423b0a0dbc39026eb939fc56

SHA256
de931b4d3ecec619b06c4854b909ac3df25d80e2ccc3b5edd911e63c3b275192

SHA512
cd0a885d392a0ff7e488f87cde532d8568d916a16498ccd56c9f2b26ab7914a203d25ea31f64bc3ab71a0d1f85a239dd976fcdc1ca6e8896537d4a1fa8c6f449

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2050af8df46b3e4e78c1c30ae58af4e7

SHA1
7794b5ce9a5e279b6ec6e3dddfc9dab583d06808

SHA256
9c628e09576e0967dde929b189756d231375d660455140559d4f5df4b5a2b1c1

SHA512
6b27c3688c3fc61f4f215c5787606fa09ff7d84541fc8b48925dd0502afcfe89116848290f5b4fd6716ab1f9bf5e99b5b0896601a454cbd5039883af6de82d8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e99d7bc0-bae5-4a54-b0e6-b12f2b39bc44\index-dir\the-real-index

Filesize
2KB

MD5
c2aa60884e2bde9f6b645629247f0942

SHA1
fa1ef800e437a2fce614d13fa91f55839cdd72dc

SHA256
630271993a8fc426995e0121c01f7ec29cfb38db4192780d77067de89c342d73

SHA512
9cf475f877ff0b4d84b44e26ca42280bbc53f55a6297340f9ac5c23016f51670e008c00d60b58908ae09af7bfe6e5aa9fbf6708e47f26484f9133482174b5cac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e99d7bc0-bae5-4a54-b0e6-b12f2b39bc44\index-dir\the-real-index~RFe58e133.TMP

Filesize
48B

MD5
5a17e3652db1780b9252ea4ddbe14d13

SHA1
db1009a3d002616b10ba524c1396adefa614778e

SHA256
4fe2c0d3bab645190eced60a57bd8b93a047bf63d4f6be4f3942dd81c783b431

SHA512
3d89c31b73050b8d13a8d28ae444d89dc71d9e3fe01ffe1139ecae1036f009eca428e72366ed20a88644953f39ed302238c1b4363181344636969af309dbba6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\eb40f10b-9a5d-4e84-8d49-4babbda194ad\index-dir\the-real-index

Filesize
624B

MD5
d6e14ac19aa2ec38c54fa8541c78a87d

SHA1
a7ca317494c7747bb197e3b3c609c5db45e05c69

SHA256
3746e601a56b3c950150caddaed60b051ba19af29719cd0db293668230e19d43

SHA512
c5758fd8a45b930bc2fafd14e19070d9f1a75ea58e213b5f882e8c3977f9c9dbbdc9b7bf1816aa1c1c5dcaf9458a08107d81336d577a4645434c177cf778e902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\eb40f10b-9a5d-4e84-8d49-4babbda194ad\index-dir\the-real-index~RFe58e50c.TMP

Filesize
48B

MD5
08df4358a74b284cfc627e22166e1d57

SHA1
1b4c2b15952364001948aa92a25d6317037cf24c

SHA256
13bc7b51c92a55e551a64a77abd03d5024b077f884750e20f66dac5878205f59

SHA512
bb2b800686fa0603627aa6f5cdad7e3dcf8cc5976639cf3c296feacaab9fc827d485f0e6345d8c84793c5483e9500e98bea84bb356fc75f9657e9abd4d75261d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
38445a157e7cff3c33be29e32d844e8e

SHA1
30137ecdb5cf6c75ef321209b1a80367dd6f08a9

SHA256
17b338fa3a80769c197033b767571ea0ba809761f978af0f5640f11db9e6af0b

SHA512
3813716b0a855b0f3f4dc49b8755d6ee69dcf28afeb7ed9244137af64a7f7020e1202bf42fdbd3157880c213409b8df73cc4ecbf92ccb06114c26561b7d7ae5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
44cee11cf8ab35762312e85fcd83350e

SHA1
9c19fc930a7d0928eae59817cdd688f0167f87d0

SHA256
6fae5478e9513ab9704b0d1d7915b6c9a80ac93a54049ba2100de3312d9496a5

SHA512
a6d94fd0d24b85a7e6442166c02dd6e254ebea8d897345f23b5d930e1c78f2ab6d9206b8b1cc662600baa2a49e6cc74b06714e0161b80abb92c9f912b8f3b525

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
155B

MD5
93faba571a1b87112b61eddbe9fbcd34

SHA1
9ab8fd1051aad7c94b7dfb91111aab2b7120a969

SHA256
fb4e87994597bb0c3ae5ac00d161cee1df89b3eb96675ea1465ebd54fa394295

SHA512
174246299e71d8fb252bdbb2cd58751bfe671d993f6b7a12fdc15a8398469c80e0579da64e6d36f0012f4a1a8cb9b38e31c39d9c5d0870b0a3006e620fb59acf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
64f44bfb238ec612bd5e3a6176028a1e

SHA1
a05cc094a75c3369ce4cdecec210f25bc06dd895

SHA256
a0caec7f4f67d94c855ca68eab2a6cd9188316904ac3faed09bd244dffb7f1c4

SHA512
5fc5f84be18a876ae6033323c99aa8fbb9490a40d3edd36ce993f93e0ab2f5612e4d1c8cc21ddb521d096368a29938e970c99173aca1688642767bb7b7da32ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
914a005893befea48956234b156e4d4c

SHA1
45d3cebf9f79c166c4abe3fca5d6012e981cfebf

SHA256
47c66867587e18991c411200ee9b50bbb6fce3106adf93ef311f01edb6b9ceae

SHA512
f1a179b575cae09420875258b339ebe3146d7987206545159801b63189826f9c0a82ae205f617736b8a670107a7f25702bab70a6cc2b68d3e4ef32fbd0c136e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
b2eefaf36be3386e7be6d267601d4f22

SHA1
894fd7cca9069414501de1cd09e47f5e880abeb3

SHA256
7c0f5947b504a1f5b95a39df054d201733d9de8fb6720f5ac5c6882d474b91b0

SHA512
97f19e85ad5521a6c7151bdf48f8512b972b4ed372e32722f2648e3c4deb60ca1786e2e0be2f3b11af12cd33c4c45f4fc5eb1d203400759aead5178a13c18895

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58dd5b.TMP

Filesize
48B

MD5
b41c2042f8913635941276b135042008

SHA1
d51315facbe43aac3dcbc4d668999663121ae487

SHA256
d2e2f1b619a97e50474dcd77dd09aea4233ce5b9976498d9801c545cb1c7f04e

SHA512
e752d0772bde67bbcdf078f8d36bed83abf7de66eee1c8fd236c1c524b73e24b6263981285962c9040ebc5c1c5f28308bdb3e8c4fbcec045942703fbf5c329c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5721c3436d9a6c720e133545652c0adb

SHA1
722caabc299e258efb66c203aedb7fd88259e379

SHA256
5f1acd29731d780567f3411f0a225a72b086456b5fc33239a9ce025f44a26889

SHA512
2eea0d994531ef3dca30f97133b1b3b8c6b8b864e3f176fd019d6c017952b5e852f6367946f6b29b7810554de9f88214c0e69332d9e7fa2082e07e62ca1d3dda

Download Submit