hxxp://market[.]godaddysites[.]com

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2024, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://market.godaddysites.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
4412	msedge.exe
4412	msedge.exe
1548	identity_helper.exe
1548	identity_helper.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 4764	4412	msedge.exe	83
PID 4412 wrote to memory of 4764	4412	msedge.exe	83
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2536	4412	msedge.exe	84
PID 4412 wrote to memory of 2788	4412	msedge.exe	85
PID 4412 wrote to memory of 2788	4412	msedge.exe	85
PID 4412 wrote to memory of 2524	4412	msedge.exe	86
PID 4412 wrote to memory of 2524	4412	msedge.exe	86
PID 4412 wrote to memory of 2524	4412	msedge.exe	86
PID 4412 wrote to memory of 2524	4412	msedge.exe	86
PID 4412 wrote to memory of 2524	4412	msedge.exe	86
PID 4412 wrote to memory of 2524	4412	msedge.exe	86
PID 4412 wrote to memory of 2524	4412	msedge.exe	86
PID 4412 wrote to memory of 2524	4412	msedge.exe	86
PID 4412 wrote to memory of 2524	4412	msedge.exe	86
PID 4412 wrote to memory of 2524	4412	msedge.exe	86
PID 4412 wrote to memory of 2524	4412	msedge.exe	86
PID 4412 wrote to memory of 2524	4412	msedge.exe	86
PID 4412 wrote to memory of 2524	4412	msedge.exe	86
PID 4412 wrote to memory of 2524	4412	msedge.exe	86
PID 4412 wrote to memory of 2524	4412	msedge.exe	86
PID 4412 wrote to memory of 2524	4412	msedge.exe	86
PID 4412 wrote to memory of 2524	4412	msedge.exe	86
PID 4412 wrote to memory of 2524	4412	msedge.exe	86
PID 4412 wrote to memory of 2524	4412	msedge.exe	86
PID 4412 wrote to memory of 2524	4412	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://market.godaddysites.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe4,0x100,0x104,0xd8,0x108,0x7ffdb12246f8,0x7ffdb1224708,0x7ffdb1224718
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,11429818865805562194,2417514612502676025,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,11429818865805562194,2417514612502676025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,11429818865805562194,2417514612502676025,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11429818865805562194,2417514612502676025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11429818865805562194,2417514612502676025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11429818865805562194,2417514612502676025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11429818865805562194,2417514612502676025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,11429818865805562194,2417514612502676025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,11429818865805562194,2417514612502676025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11429818865805562194,2417514612502676025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11429818865805562194,2417514612502676025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11429818865805562194,2417514612502676025,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11429818865805562194,2417514612502676025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11429818865805562194,2417514612502676025,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2192,11429818865805562194,2417514612502676025,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11429818865805562194,2417514612502676025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11429818865805562194,2417514612502676025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11429818865805562194,2417514612502676025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,11429818865805562194,2417514612502676025,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
211KB

MD5
e7226392c938e4e604d2175eb9f43ca1

SHA1
2098293f39aa0bcdd62e718f9212d9062fa283ab

SHA256
d46ec08b6c29c4ca56cecbf73149cc66ebd902197590fe28cd65dad52a08c4e1

SHA512
63a4b99101c790d40a813db9e0d5fde21a64ccaf60a6009ead027920dbbdb52cc262af829e5c4140f3702a559c7ac46efa89622d76d45b4b49a9ce01625ef145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
974758138e636755b70bbd8f0ee9ae57

SHA1
3705db1d3dcaf7e584777dd7318c2eeb45d1f87b

SHA256
ea25ab9a9f7c8308bcb88d13e9cce2c5f0177bbc95683635ec10de62b61abca4

SHA512
3c07e1de410fb81dd92ffa34c644784e06cdde6b6e77e69d23213a68378b24b791c4fbaa8f2068ed136668c57584b85a6be1428ce7853fee28e55b99ad4d34f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_market.godaddysites.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
096dc3b1e616b79b53af4acfd5bf1eb5

SHA1
9e72529499e4e868b028f7be81c0ce64b652c1a2

SHA256
9c67812332d2113d92cf69f05d4c04227455fa4db9db8bc4f6b6b63b385d85db

SHA512
818c05f30ac9739849f5fc8f768a98fa4aa584596add65118b8926c40addb597beed70e45c0cd0cf56b4b308b8189d9e0a168f245bf57fd1166157a89290221e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6c4ab78b05d9088b108055f8e5cd9c54

SHA1
92336de8165b843a1eea392b2431eaa6863ef118

SHA256
bdae367f437731d2a8db471783d8420fba3045b92fc15f39ea54d8d403e453bf

SHA512
8086d1ad4e087009b43b53dc2a8cc05dc62215d0787b6e02c6ff288740058856246073f644ff6d777a8fcf36d4ed685aa280936a0112ec93cacd9ac8b78fbf2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c1dee01480f78565376a0c33fec413d8

SHA1
fa315ee919e7ee3d8b27a7d73822e0d38d4c1286

SHA256
7c262a60a77665c3b814d9e7ddf61367b551e9453d7f5ddcbbb7262bc8b4f5b8

SHA512
82a749858dba44b580e503cbd62b622f7877b5c44aff1909d792e42b45c8f7543cf61aa1273a08d001e57c417bf3b65638bb537288a9ebfeb8d63878f7c4aafe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6feff328efbe85e8bca996d4ee66a285

SHA1
3e5b821095fc33374909df12c3c091b628430067

SHA256
fa490f68e8e6339ea6384daa41375bfcc439f5421db8ed03189e792c8ea6d75d

SHA512
b6ce23d8c3d687f519c745ae935880036a3d9e7619aff56bdf4f433f90ffb14f0af106eb3655c42d366ac58842d296e0aefc476953a33e42de89e10c6c524ff2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
aff5250cdb9a3fa2c44bb969b79ebd44

SHA1
e290c8131d8052e4d2181ce24f04ee21542e5329

SHA256
4cca9f652c1e964dc30b3f22f2a224eb71caad4b1f61458bbcae289c8d231664

SHA512
f983550c93a87638bcc2bdcfa6132c0a1c11fea6f18bc62bcc76e09df60794649abbdc50c57562e48f6ff4d0c03bd2a9bed3312d55a0227393e3d4e57ffb1b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cab510e198f9c19c756fa59868eadefba3cb3f4\73bd5826-ff94-4946-98ff-d021e6bd7243\index-dir\the-real-index

Filesize
72B

MD5
b66f0b6771d5ed7ec1ce79e744645528

SHA1
1451777b9e5f25990e80074577ee785f59502a59

SHA256
680f92fed28486a646408f258cf6909fd9c2385f44bf9f04523c414ddd1c683e

SHA512
ee0ddd247af6271c835b9352daaedd2ccb6146c582814ea00d494530e5a7b1d1ce46902fa018d1a55f3e61c985bf4579093d44692eda9a48a2761961f0f7ff2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cab510e198f9c19c756fa59868eadefba3cb3f4\73bd5826-ff94-4946-98ff-d021e6bd7243\index-dir\the-real-index~RFe580d1a.TMP

Filesize
48B

MD5
632e92f7ab7eb6fc3b309275d5154269

SHA1
7004db7d13439bf99864fa689caad23cd6f43f71

SHA256
2017bba451ff22d3caf82114d9adc0d6677432ef3f79414dad939245ade03830

SHA512
073440919a80048131f36ea8691b40930b2591c3570f150f615dbc9196c4d94f0af6fb25f666053a47f0820a94cd8527ec0c84c3ecccba9375e28e0d43054828

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cab510e198f9c19c756fa59868eadefba3cb3f4\e5d5e2f5-2fac-452c-bd95-4f26f4ba9a1e\index-dir\the-real-index

Filesize
96B

MD5
b738851e2b5e9b29901f6a364f243b28

SHA1
9807fa7756ac5b4f244182bd42dd6b1d849390f0

SHA256
e14272bf77eee6a3e3cd38a282b02f7fcdaec6257769546ac110dd2ea5813ed9

SHA512
4d387c789b270331679ae405d073437d839d91aef0ae5cfe77d03ffbc7e9f9b5951076e30f4bad3c44c1dabd4e67e639a7db0753fe82100e77664410c1fcca99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cab510e198f9c19c756fa59868eadefba3cb3f4\e5d5e2f5-2fac-452c-bd95-4f26f4ba9a1e\index-dir\the-real-index

Filesize
288B

MD5
fcd6f66687a8fefadffd4e5d53e85a8a

SHA1
611fd99c703f29513f0ba2b3becaede86ff220fb

SHA256
9adb053d13282df145626873c610d9076ba4ed0780f72a448496cb66fa14cb57

SHA512
5d7c82c0bb341884054f0ae7aa7499ddefdfe76475b8b9732cb5f5243ce62bd5aa00d37fe4ed2c07278320b0b527c9b43d4043fc77d78c92471e2be6f299f4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cab510e198f9c19c756fa59868eadefba3cb3f4\e5d5e2f5-2fac-452c-bd95-4f26f4ba9a1e\index-dir\the-real-index~RFe580ec0.TMP

Filesize
48B

MD5
42100f53ee2a664a24a927bcc49e2395

SHA1
02f0aa6d60450734a8bc9979e18e60f6c19ac941

SHA256
f36a1d7658885b00d711b350feb636df8c8492d1fb1aca4d40ca751dfce79ac9

SHA512
6897744a0fdfd9ce6b99f6165acc482417973234c0a6b36c2e93575ce5cf26785db75e46faccde2ef5b70d372c48f8a8b5515ceb52556f0829273548c6726eb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cab510e198f9c19c756fa59868eadefba3cb3f4\e65eb76d-7d49-4c3d-a9ad-0630f5fec3aa\index-dir\the-real-index

Filesize
72B

MD5
59ad38cf474f1e06acb8436b1d6683a5

SHA1
12a4eefe6825320503ba563a9eb55a18b335fa7e

SHA256
a3dc0e2e7d684c6ba4177a046aee8fe62858ef89ee7a0040ac203d9d40d89f99

SHA512
39a9af171aeb9fc891240df14db7d40b06e90a61eb4be4762b6532999677958a4d0ea5772703cd1dc9e590b0377ab5c31864c919e03de14e0400cd05cf6ca8cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cab510e198f9c19c756fa59868eadefba3cb3f4\e65eb76d-7d49-4c3d-a9ad-0630f5fec3aa\index-dir\the-real-index

Filesize
96B

MD5
259f50dd42d357a9bb118fcec642818c

SHA1
49530e27d82f321b2b4047c4d4f2aed73fa212dd

SHA256
5151b0d1bb1b5b6d5c1f6ba46ada78053930be94babd45057fcf262e631709b3

SHA512
ddec4664e552161ce2faf0c570ab669e78bb14a6d43fbcc1e352e569268873f29b69c3eaca6b6c10369742072bbc474c8d4ed3272e97c046f554e98580743664

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cab510e198f9c19c756fa59868eadefba3cb3f4\e65eb76d-7d49-4c3d-a9ad-0630f5fec3aa\index-dir\the-real-index~RFe581066.TMP

Filesize
48B

MD5
77bf49739e7d14586b54479bb2de7943

SHA1
48242ab22bd3bd30bcbdb7171f1b2eb91592698b

SHA256
c4741352490be56f23fff247bd3cd3f01aa0b22245165814368bedd59899066e

SHA512
f993c53e89bb92c80a157b03db22657604b37690b86d12cbddb7223496866be6834fc345681ac5a537c5c2c90a8f0e5f77e53f7c187d20dcc37a281d36ce1e57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cab510e198f9c19c756fa59868eadefba3cb3f4\index.txt

Filesize
141B

MD5
16cafbeb9ba5e5a0148f595476ba7e96

SHA1
9603fecc07927c8feb1876c4e2739097099cfc0c

SHA256
e3a540ee7f85b515f0d1a56091a0ae23c8bbd45d18a2472e0c876c47f59f7480

SHA512
6d34fb888c06c95a99aa80a1ddaba90e99596c93a1ee5576206ac82d49e53f6091acd8f73f464a66dfa91529ee9984c0f39b15cbad5d270ad91243dc9778ef43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cab510e198f9c19c756fa59868eadefba3cb3f4\index.txt

Filesize
203B

MD5
807bce3a6dcd17102950af4587207da7

SHA1
1b10d858b5220ef5e34fdd1dd967cb1d939dd924

SHA256
ef7bead0e958cd801c2a01244296a108dbb7d66aa36ef4b8882e5d384afd53e7

SHA512
3afffa30ac7cb53d58c25510b3702dd23600e8273625e22d566f47b02b7397cd7e559dce972d617fbc9bc20bad38ad576e1a51e0ed1849c5f5e2fdb85311fe27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cab510e198f9c19c756fa59868eadefba3cb3f4\index.txt

Filesize
269B

MD5
661055a002f8c2ca339d81369dca1194

SHA1
cf0bed48d0166b7b2bee0ea1779ac51e60ccc7d8

SHA256
0b3c741e4e3545bee3465b52b7b1e2e598db4d2a7c7b20cfe03cbc85b744cd8f

SHA512
27b982a9b63ac3d4adff12a358e334a845cb0bce0d295357a305a638aebfb283f690a51f7e7dd5f563be790476d5afe0bea0ad51a8f9da99d0a8d0c73cb9577f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cab510e198f9c19c756fa59868eadefba3cb3f4\index.txt

Filesize
264B

MD5
26f9054f71a74a40c4ace4e06052f0a7

SHA1
3de2492d6fe04302d210801e390c5d88d525d773

SHA256
af3c0dc45b0d6164bf217256dab7589f8992ba4359af5c563839b36ae570f296

SHA512
081cc5ce0dabba8d9dde8fdd551e92f55f14f9b22fa4f915347c2de6a728286d040ac0ac795edb0bd8eba0e572517d1758f7b671cb4d796ddb7b79336425e8b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cab510e198f9c19c756fa59868eadefba3cb3f4\index.txt

Filesize
264B

MD5
0b4932233f61d08b1b969070f9943c21

SHA1
6acdb4e19bc6dca198ff3d99cdb56b1d46c6527c

SHA256
014e4340fefd11e62c1b0d2dbb79321155102c688b06cdb886e4c5cfbc378777

SHA512
fd2a96610565ccc317a4668e92eb2031c156f29b3b334415e768b1576cabd9e54f114ee2d268525795a23ab0cb7045cd853ea02a51e914ee21bfc083b64834e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
8011e8a2ecf7f63e3a985077bd92be3c

SHA1
61f31ee05a6014389ac318f235bcbc4995080e8a

SHA256
fdc7fb16a285af9e27f043b27eec832740f43736b8bee5111226354f6ed5cd95

SHA512
62c2c89a35e8ad2d69ba2b14830b5cbd954ae239cd4a5fb5c2fae6ee81441c7158fc27514c33c809df16cc41503092b440267ea3c09dd1a101c78f913ebcaa04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe580cec.TMP

Filesize
48B

MD5
5edfbcb1ecccc788652e29e67dc27982

SHA1
b82a82c4c225a11616ace4d1d345eaf12fe4fdf3

SHA256
202b55d9befb4e88870e059e4a81a82e54785b8e8e832ef1460cbbc46ea11f80

SHA512
ff075cb5e4deca884ede141194dcca476d6f06473f70f6ce8cdda06e9abdaec1c8681fbc9309aab3236c4ae2cf7be6a9f1ac1e916554d69616f9f9de49cbdb64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dcab30e8fd77a01d650bd83cef5500c6

SHA1
3a1af368931f05437fc0ba0f3ab16475de759311

SHA256
86f69618ee826ce7388a67b9ac8c0b16e92119c8b55833657950ebb25a65a0a1

SHA512
d4e7648ed801ce15022bf3a3d3d2450773a9490756d6692a3b5fe57431b0158bcb4fdf85bf7e991ea1dc24165d8783fa239d95de26c6e4bd921e3e532c1171ea

Download Submit