58ca7c242dcc0b9d0b3d42c00bb1e41636d5a03eadfab9e25122909dbff4516b

Analysis

max time kernel
289s
max time network
298s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
09-09-2024 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

email-html-2.html
Size

3KB
MD5

0cf7cf6ff36f6c3ab669fa4f28a5c987
SHA1

378c31e69d0a1ea785ff3b696bcf7b7e9197653a
SHA256

837993b6dfc991ff225ef58140daa6e86bcdbc8956eea643673abafee86e30a3
SHA512

01b5f43cb8d0c1de86185f018426bb3e0524900ac64372920650790c87a56f4ab06c418df77ae8b17e8b7b09c77a56d7ec58477f96aba82eac07be2b6f1c5fc5

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
232	msedge.exe
232	msedge.exe
420	msedge.exe
420	msedge.exe
2884	identity_helper.exe
2884	identity_helper.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 576	232	msedge.exe	80
PID 232 wrote to memory of 576	232	msedge.exe	80
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 3376	232	msedge.exe	81
PID 232 wrote to memory of 1004	232	msedge.exe	82
PID 232 wrote to memory of 1004	232	msedge.exe	82
PID 232 wrote to memory of 864	232	msedge.exe	83
PID 232 wrote to memory of 864	232	msedge.exe	83
PID 232 wrote to memory of 864	232	msedge.exe	83
PID 232 wrote to memory of 864	232	msedge.exe	83
PID 232 wrote to memory of 864	232	msedge.exe	83
PID 232 wrote to memory of 864	232	msedge.exe	83
PID 232 wrote to memory of 864	232	msedge.exe	83
PID 232 wrote to memory of 864	232	msedge.exe	83
PID 232 wrote to memory of 864	232	msedge.exe	83
PID 232 wrote to memory of 864	232	msedge.exe	83
PID 232 wrote to memory of 864	232	msedge.exe	83
PID 232 wrote to memory of 864	232	msedge.exe	83
PID 232 wrote to memory of 864	232	msedge.exe	83
PID 232 wrote to memory of 864	232	msedge.exe	83
PID 232 wrote to memory of 864	232	msedge.exe	83
PID 232 wrote to memory of 864	232	msedge.exe	83
PID 232 wrote to memory of 864	232	msedge.exe	83
PID 232 wrote to memory of 864	232	msedge.exe	83
PID 232 wrote to memory of 864	232	msedge.exe	83
PID 232 wrote to memory of 864	232	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa1b2d3cb8,0x7ffa1b2d3cc8,0x7ffa1b2d3cd8
  2⤵
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1784,14254035673306822952,7588481232147819913,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1784,14254035673306822952,7588481232147819913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1784,14254035673306822952,7588481232147819913,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,14254035673306822952,7588481232147819913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,14254035673306822952,7588481232147819913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1784,14254035673306822952,7588481232147819913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1784,14254035673306822952,7588481232147819913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,14254035673306822952,7588481232147819913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,14254035673306822952,7588481232147819913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,14254035673306822952,7588481232147819913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,14254035673306822952,7588481232147819913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,14254035673306822952,7588481232147819913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1752 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1784,14254035673306822952,7588481232147819913,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,14254035673306822952,7588481232147819913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,14254035673306822952,7588481232147819913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2112 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,14254035673306822952,7588481232147819913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,14254035673306822952,7588481232147819913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2756 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,14254035673306822952,7588481232147819913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:2864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
302c3de891ef3a75b81a269db4e1cf22

SHA1
5401eb5166da78256771e8e0281ca2d1f471c76f

SHA256
1d1640e5755779c90676290853d2e3ca948f57cf5fb1df4b786e277a97757f58

SHA512
da18e7d40376fd13255f3f67a004c3a7f408466bd7ce92e36a4d0c20441279fe4b1b6e0874ab74c494663fb97bd7992b5e7c264b3fc434c1e981326595263d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9efc5ba989271670c86d3d3dd581b39

SHA1
3ad714bcf6bac85e368b8ba379540698d038084f

SHA256
c2e16990b0f6f23efdcecd99044993a4c2b8ba87bd542dd8f6256d69e24b93b3

SHA512
c1bc0dc70ab827b54feb64ad069d21e1c3c28d57d126b08314a9670437881d77dba02b5cca57ef0f2aa7f8e7d4d163fbd2c6f246ea2d51ce201d61a89015e8b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9c92e933-5e4e-4dc5-882f-1c4d9e51e0b1.tmp

Filesize
203B

MD5
cd3bd438b7179dd85d37f099d5601469

SHA1
877b8bf75fe3724a35fe5113626047b614cf0a95

SHA256
a2517491ed76f4559cf69923eb0d39c61147a82dc12b9cf77b678ac7e0640ec2

SHA512
4515f666271f628157b0ba79909fdddc57be2ac7bec5d97956960b92ec99db991150674864ae0b865a085300fd5993a9ea64d775652aa2a4d90c348db6a50508

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
962be41c5f4023e4182f4329e1506609

SHA1
b6b00e7b5ee2ebaa4acc080d9268555b6f87cc9c

SHA256
8b7665717336a9c42be5116152ad5a76c084a9ebea0e7fc5870a19cd39b60712

SHA512
3bc52bea291d1cf50257ed7b2b47cc8727841d979363ee54af9ddb7c643efc230c4127c7c4b545b9255b50fe53ce1aff65005299888473ad6a27ae03a489b0b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4b747bbcf9874f72ad2728a8f9905301

SHA1
60f8333c085c2a9daa3b19de189f232a7dad805f

SHA256
304e5f5eab45fa1cfa444594d9106eda1d9bfbc93a9267c2313a735a9cea1024

SHA512
48c9b445529508dbb914794c75cfcdda119c931428193dc3890efa4165f37e9b81f6567bd0bdb08eb4afcc0517bbaa7f18bd156fabc54ed7d529cf0e038267fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2ea1957e6e35adfb749ee7f6fcc828e1

SHA1
53a9d5a2541e856c78cf58bf722b38832efafb88

SHA256
3e5f68a477a10468fe60faac79fbcba5c20a7de86f5f6f438d4fbcd8e4c84cbd

SHA512
b13482e54e7b90c937185c5d72e9b10816867a647904171ac80a4b7db0f23aab5de7dd12dc616232fd0f8cf6e79d74495450f0e2bb0029d10406bf8b772d780f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
96B

MD5
d112f3d6775893df8f048bb9accaafb0

SHA1
1c4841275d06ad45e7e26e2013bfcc17cc143039

SHA256
f2b646569d096bcef7978e901d4de2176b6e8714a73ed21679264f27f06e5541

SHA512
dc7a79bd8e012c36f5a2c975a2bc7e20521749a23577a04b861ea542f95efcba00242672fd1873b8ec6d9c043e62e357a96be9f686577dd199f43f214e1dd878

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
329B

MD5
13c6f38ee554a5760154bb7906ef8588

SHA1
b79efa7c955bc2d8df04d6b653adcab093ba598e

SHA256
7af3c5a5708aaa87c5016e78b52509713bf59683b5618524354bc69b6d38c9a2

SHA512
f8efbdb01dbb8035285b12c44f6cf097d0b83f8c2d27c2f8ae43280549b773eb53a7a473455d734feb15b4c7da77ae43e1668eef2821de2e24b6f79b6ee174b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
78ef85bc0686dc4ee6313bd7b43e9c11

SHA1
0986f6b281a43d715a08c757b46333f0119f98ec

SHA256
5930ae6358d4329029ecf1c01ac4152c83289cc410a324c5967d8793bcbd8b2c

SHA512
dd103e629aaa3e1a7a38e2661161ef80006a3b80f040b0e27bf0cbb173c6c01e3fd042d6d37c0621038ebff4144939a9a86de2593eca6adf16a638f3ca2f8fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
329B

MD5
7051b939131fcc0188993cca294ae8cd

SHA1
aab2df4a23c071d9bdeb55d47496a788e70ba259

SHA256
3d4e1d4dcc9a8bb4d1e3428adbcd06ba7333633b07315596f6af2888c4ac1f85

SHA512
15a5e29fb553e0d2e9fd58dcb8393e93fca9fb9a9c686f10be4d8b015a88b6d47d7c6b2e00964fade9aca519a78b72d09afad5f17d57092db24ca85b12df6838

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
329B

MD5
a8b9dabf58ac96192247f905991d2110

SHA1
3d6a0dc313758384b0feb624bd88c770653986ca

SHA256
c7f6a48648f74e9bad4d3f25176d5ea320e8d9be4d603bb5d73447fdf40b7677

SHA512
a76f460b30905fd89495e3471131cfbaa7458fc9b5621a5606fe82c48ea867566ad8bd5a0df51ed9c828998530992a5694f3e87f89fe31b8e40f6acd75806ed6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
772B

MD5
35acf251e5667e3f8a5aeeae3fbb2cb0

SHA1
0c1e981a02dccc07319c81f01e1ecbd09bf7d8be

SHA256
a3ceca5081cec4c27df25b347fad0b2958dc93f13479b318ae3edef74ac12b8d

SHA512
6d2b0ebe261cb32246e4c6eeab1e1aef296878a3576001b8b7e189851f4f0d009072019e40989bb2efb7cea93256576498ea4610af610c958676695751d0ad17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1968f33a78f5b03e60f897565d46cb2c

SHA1
e0942c823a6bd77c86b8d9adddb4d656ac99d76b

SHA256
e1bec768e0650b9c9e25fad967f79dd4adf2afb8b8c8ad837774eeca512c0478

SHA512
a0f49ca2e103b22bdf8d23ee219b3981f8fb939fb69b610e3c461f00c7f50b5549271390e1e1677e8cba19028e8d14b7ed346385893f76b1b00fb190340d0486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b618313fb7aa3f3b892998efde803420

SHA1
730b87077cfecf4a12834877abf5b96de6a18b37

SHA256
9127a9c50e1aead030fdf67ef98dc8b94a82c910f824e0810f1b4892f1912000

SHA512
aad9633b4220b53338aaaddd74a4067de28fdfe46a59577ffbe6d3c31cfd90275481d4e0d52bae25a4ccbcc62a038539d59f667fc584f4f3cb03797324d94ccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cfa26d81b45176bdf7f1cd239a501a63

SHA1
ed5c1b230958d3cb3d9f6fb95857f3c2af85e228

SHA256
a36ff04b0b794f0c1c6c0835fafecb7d7a8987195353954f64cacae25848e269

SHA512
20650ef9606ae777fe0069c64a78fb7fc03c225fe7da8e10ddcd487dbd5b704e651b826b3c590c83a23e3b3d131244866bd19ed354b6d26ee5e510ccd7d8df86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
47d8182428394da66ac2fb5186c81725

SHA1
40911084abe9710c33296bd02e1757c4338b7b3e

SHA256
a6a90563f4fbdb44324f8ed8f251147f0125cdf24f25c05c2dc8b1dea440e79b

SHA512
a31d70f85c2f4409709d0d32744d59288087c2ab226ba607f4435b71b9cf867105b10381e82880dcd85a55dca720397a59d994066d8ec07db87604be93c5babc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
34c404c63c64497b7d6968339c9b42b3

SHA1
a3d5faf78b80aa0ede14345f0c410f61e6ec3013

SHA256
31f4566df25bd5d8e7ea8126741a5c6ec00fde1b323ae34f108d866b1b5809b0

SHA512
6996e251e0bccefbc8edd7d440f73ca926fda58c2c820ef27644b87352a89026363b907ca3448a95459c7e2bc156e73e9656c568372e4ed3b1ffb3bfaf3466b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
7df283a475253f219d04b72da228f23f

SHA1
555ba5d78e352e9aed72b717210e2558c8e8ca9a

SHA256
15f3a2ce47904ceeac64da8b0d892d1c5bb31e53a9e62b0054fccdfc135741bc

SHA512
0d3c7f1ed6a5766d7b10d1db39e7b25d64ecc68264f1bfc30998e8a2a7920b094028a8f433bf15648b39f82048cbde3c159cba573bb37fd6a869b0006070bdc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
3c825bb92863e33320c1c2f34453f85a

SHA1
2cb4c6f40774120a1a1cef88dc033bde161628d9

SHA256
b4c8ef0eb1f2a4f8eaca34402fc33acc7adcb08439c89af64a963f65a1f0fa01

SHA512
3489ce04b202eaa2ea99b632436099456adfefe07c1f13be81668e3c24a5c3f2599f6d4a7d164d37b71ce9e042fb4a7986c76a3080be5f10acd9e65858a10fd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
a418d88ee70942d8b6af8695e5899e91

SHA1
170f75979b43b086548b587b0923b12a9593c122

SHA256
ed6be8a901e4497a07b92b128225cc6a577d1b97bff26cac0d13e746c7ae35e3

SHA512
2029779e0c7480191f49515a874a032bede6015f53adaad50709431517615c846c1957d247020c793586069a759ba7b02e362ec8c9f8a74d50f86ba090037704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
368B

MD5
fc722bfbedc94f4ef51bfe9651fb4767

SHA1
9b3e058d24ebff99286f7500196bdff216eb2409

SHA256
69d9de6ba985409ffa0ff59ba7820d8beb14d1e802b851f294d25c352b9e7f01

SHA512
7014723af3a2c745b5af6f2fda8a6629d6dc825ea26bdce7a32d8a69ea3c4248ba1b31add4ff39e02005c488eeafe4909f18e37eafdabf5ffe64fbe4867873c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
4a04428626afa79844c00cbbdbc5ba15

SHA1
71c65b9112680a3a98d1e85cf7c4f03966ef8a62

SHA256
819cc1764d9c43e94ab8626b1ca02b71fe02adb739dd3ad3d928781ac77958be

SHA512
032a3c811634fb9ea8d9c37b43d8dc12a7308dfad42a79ccaa68509fb2ab3b295fa1a3ba198ad25385b274a56a80b9b35745cdd276dc78a9e650092bf4cbfa08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
9a525de3ea170375ee4e4621dae70127

SHA1
382fd2ea2d9245780a76b724fa411eaefcb7b529

SHA256
ae49118d399f4e320f22f9e7f0d859e39a17e220cf4c570997bd8a818ff11af6

SHA512
beacbba4fb9d32bdfb1a58174f38dc3700d2ecdb4d1cddfb793b35a9545e91ffec84964f91a39867836df8a5c52ec396bf77dc305820b8bd2af931b2231a4a2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
9da96bfa7e6a144777517937e5eac912

SHA1
9422a46b47fe747a7076cac6135cd9a5f32772fb

SHA256
8990fdcc01878ec6d4d3ec483462837fbe40991b2cac34ca9eda57f0d7d990e1

SHA512
c3547a010ed8851079c30deec664f3818c41800ea0f55d492b89f2cb01c5e13750ebcf4981cbca4c41bd54661ac4e2086daddd67d19c362d54e50fd3d4ea9174

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
368B

MD5
832e801a2ab3f907056c0ad583766a3b

SHA1
d0532ca4738743e5911b17b5fbd943a5038c460f

SHA256
8f30ee9b0d966e95027ebb9e50c7ef671bdd247f5f06cf1214f18a75f2febe88

SHA512
8987587e9793eeea7cfb7c2a8308b3468cad60ffc26d18e22c596693c6fd34bd97f35e1b2b200c42df25251a65d0c4071bb24660b065bdc81d68299fb6c9bddf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a3ec.TMP

Filesize
203B

MD5
533b6955fd8eaef1274b3d9be16525d1

SHA1
f1f9309bd0a0d148930caf65c03733d09a6cfbe9

SHA256
ce7b5594fec957af82a1505597b154976d0ad65e42f16ad16316446898c6f117

SHA512
ddf95af5fce5bc73ff13add4eba456b097acd68b9c51d9f7e074289d833fcb8d76e7ab2b7d3ccbf6c256cc44aa6b2d8eb55de158e9110c213cefd0b210417294

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ea57ce31b6d39cdfc647d83e220a0acc

SHA1
f67de70ec370ce159355612c32af7d390bf00ae7

SHA256
6f69db9e65ce493005d3aba2944380ffb9ad823c1ce89df605ccabe0ad50399b

SHA512
cd5037428c97e5fb0226019bbbfc5e02175f16718e974d99ad16ff9c67b2b85580449b5c2b345d0160cdd236afac337ce5ce505103209fbe171ccf8142faf7de

Download Submit