hxxps://wsw[.]youdaomiv[.]top

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 15:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://wsw.youdaomiv.top

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2252	msedge.exe
2252	msedge.exe
4456	identity_helper.exe
4456	identity_helper.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 4528	2252	msedge.exe	83
PID 2252 wrote to memory of 4528	2252	msedge.exe	83
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2624	2252	msedge.exe	84
PID 2252 wrote to memory of 2432	2252	msedge.exe	85
PID 2252 wrote to memory of 2432	2252	msedge.exe	85
PID 2252 wrote to memory of 1328	2252	msedge.exe	86
PID 2252 wrote to memory of 1328	2252	msedge.exe	86
PID 2252 wrote to memory of 1328	2252	msedge.exe	86
PID 2252 wrote to memory of 1328	2252	msedge.exe	86
PID 2252 wrote to memory of 1328	2252	msedge.exe	86
PID 2252 wrote to memory of 1328	2252	msedge.exe	86
PID 2252 wrote to memory of 1328	2252	msedge.exe	86
PID 2252 wrote to memory of 1328	2252	msedge.exe	86
PID 2252 wrote to memory of 1328	2252	msedge.exe	86
PID 2252 wrote to memory of 1328	2252	msedge.exe	86
PID 2252 wrote to memory of 1328	2252	msedge.exe	86
PID 2252 wrote to memory of 1328	2252	msedge.exe	86
PID 2252 wrote to memory of 1328	2252	msedge.exe	86
PID 2252 wrote to memory of 1328	2252	msedge.exe	86
PID 2252 wrote to memory of 1328	2252	msedge.exe	86
PID 2252 wrote to memory of 1328	2252	msedge.exe	86
PID 2252 wrote to memory of 1328	2252	msedge.exe	86
PID 2252 wrote to memory of 1328	2252	msedge.exe	86
PID 2252 wrote to memory of 1328	2252	msedge.exe	86
PID 2252 wrote to memory of 1328	2252	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://wsw.youdaomiv.top
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff779246f8,0x7fff77924708,0x7fff77924718
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,6394777348460335399,12374414724858058019,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,6394777348460335399,12374414724858058019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,6394777348460335399,12374414724858058019,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6394777348460335399,12374414724858058019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6394777348460335399,12374414724858058019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,6394777348460335399,12374414724858058019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3220 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,6394777348460335399,12374414724858058019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6394777348460335399,12374414724858058019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6394777348460335399,12374414724858058019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6394777348460335399,12374414724858058019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6394777348460335399,12374414724858058019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6394777348460335399,12374414724858058019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,6394777348460335399,12374414724858058019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,6394777348460335399,12374414724858058019,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7424 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
253KB

MD5
b4e252717fa4ff04ee4cf82dbbf84ee9

SHA1
233b1ad3cbb767f5698444da808d6c803c99bfbd

SHA256
e5fc799ec8b95cd6f4beb590a3e698c781e381b26a3fe7e15f1b7ba9597b7cdf

SHA512
fc245c339ecfb232f12ea35a3adf87eb53a0d7b01303428bf55a3c307ad2adbc389af8f1eaa6f91945744ad0e0e0e4d9b6934b861727d092452e05963394a62b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\527e4c6fecb8835d_0

Filesize
201B

MD5
73cc5cad6f11b9fa431e2e17ce11b63c

SHA1
71c9b51b12a22153034f343645da35673fde0778

SHA256
987db41c8bfa34f60893034c48797dead7ca7fc2c68dd1b9986517b9a9aab0ef

SHA512
eb00999f152477f3f38f8859bf4c614d13636bd560cc8e84f8072bdea000817eee0e0570f5a5c2e6260eea93b7c4c7315d7babdf1ce4f43e35e174d1f3e7ee9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\588ad1d721dab13f_0

Filesize
248B

MD5
4d464be88daeafc86ecd92fe5a123f8e

SHA1
739a839b669580a60510c9f840899c0284d40266

SHA256
e825214b6732d71e745c738b73f55fff64454042932e60a07d86508e4a1b83be

SHA512
c5a28d92374c361da5fba6f7519184907d0af6f1db43786b36ccaca274e0363ab78bfa16492065d40bb096bd536caa2337a3c1cf8e593422f3ca743801210dc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8534380d3d582d62_0

Filesize
222B

MD5
9a5e3eb42348b37aca47a5c49eeebfc4

SHA1
a68fbcb21892477c932b68e99beecc407380a06a

SHA256
9817803cb23c42e9123b7addb885b18a080d2141d6c8b5d497a4d8dc2f2167c6

SHA512
8f07bb318b36eb1f66fc555cd08619034d4d625f1136f0537cd97e22f929eca4df840db6429a1b0cb15491f7fb2fd038f9b9e09d0afdee6e9c8f45d57768642b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bece4f776bfd7475_0

Filesize
204B

MD5
6627301e089ef8f7d1c02bd052bfe6a7

SHA1
18f503d7e31464f9b7fdb4ff5548967e730bcbe8

SHA256
926da1e3e7420a454dc40e37a996fe9516ea78c5b77e8e4bda9c13bf80a21efb

SHA512
980bbfe0f3da2e345d3483e5bec34351e1589585ebff7ecbf3dc1126499b629185991640ee465945b62a3b1b133cd7c895fb14d1477dd2120fc7030730b26bcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
02a74e55d696efa3af1cece5e3fcfd2a

SHA1
4431a94f3f3bb74a35bab8598b048fa2a53d791b

SHA256
dc634186773f7d619b62024d28502766c5d8e0d935f21e2a3884f346c153804e

SHA512
80e5fc33e52a6b635ce9d1de01b9c9ec52f57ed3bbb2a96a1ffb34b2968f8687549c00252ef389854471be048965f9cc67a3c9c99074080307e3f32db4b1849a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
58922573422d7848f964e0d215daa830

SHA1
9a7a92a84f9dea82040a9c06760d56c0b5785039

SHA256
32dce8d8bafea2dfb3af48cfe3fd69f4d4c3463d512eda43dfc7d9915d3c6bf3

SHA512
7199e5af9411638c3a29fa51a128f3ce248234255405613aa3c8704a6a199fcd15efe7d6a541d736c42f38b4b11951850dc19d5400ea628d6ca371f265413159

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
552B

MD5
e5dcd643a3d779e727f52d4c86cec911

SHA1
6ba54d76b7b3e100e592e85ac0caed1f554e9fc9

SHA256
ad62df7d8e57de3743489b2236c114ac91fa74edef10a31f2b0cc2fd594cdb36

SHA512
9fc9055e5f4aba0d33d958525291e6b4302693bfbc2c5cdd0ef0a4962d96abdad5b67aadb1d9a1ba37ab3c6b102922b5288d501816060028cb57cd0ceb134a1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
39f347ca3bc10c0cc3ab125eb4f5cbb4

SHA1
1b3ec43c61f2f834ea16b44d9191810fac265a78

SHA256
4ff0b33490f7b9c6339cc17c555598afe90ad9a48eef38991ede6a055b343219

SHA512
35a3cad4310947ec8eeb2aa4d5c49cb9d405815b4f0219165788d48f4d28c255f9bb6b8d917d832408eff52c3bce34eb77dabddcadbe63f3f8c650f43e5c1986

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5a35ca4442e0c79de3de796900727eb0

SHA1
99db74beb9dd5e91fb465471b567bd46bd5c1fb2

SHA256
19762f800d3610bd066f37ff2bc11d2937d9a092d491ec927fe3923dbcb05b5f

SHA512
f2d524989deb2bf691c16d9f068f90d6966ca1fd5d76bbe348f752f6a464bbb9a9b73b192ef4385d71d66e11dfff2f29ed3ac8af7269785c7a5ccb43a9d0cd4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e9e5da8b97584f01deef99ac08746d34

SHA1
4c8cad4d3555011f4d5f508c20a769650b634a3c

SHA256
fdf69839d975f1d947f39d55dcd1a75faf4a571b7ee6b88b03062654c8a6936c

SHA512
7420656c01bb4aaf94a37b586c6b55bafb38bf2c3467907e8afeaeae976bbd9f71192c02a13d27906be985bedf4d81f3e9a2a23472ac2eb817331a865bc0a147

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
64aedf6211395f3be5ed4c96ee4e0db3

SHA1
b19eabaa2e4e632e0e2f9910e35555d3ba024fb4

SHA256
6d60b6b6f723e885cd59a224c2560de75f81d88318b73ed3ae8c5961011fa4ec

SHA512
c5ea3634b6fd4929e71ed848630d1032870ca91c4ef584d56355069360bdf1e4b88030d6ffc60f2fd97f7b1e1d4dcdf081ae3d0903d3d4cbcee5e20fc8ca6e94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ec18fef4-c0dc-4708-ade7-967f45843c2f.tmp

Filesize
10KB

MD5
2650f0bf8880b366710a77745a182c0a

SHA1
b17997cccc921270d793f8f6c7f44712fde3df7a

SHA256
3f7287f3e451083e63663737594edff54d15030a05a76c7d1be5d7697554b13a

SHA512
9e31993fdb393af30871f452307d915be6a28572aca8df52d29c73ce12713f244da96349595a2ccb89d6bd63de14301a15963bec8fb3cb445eebfd5260c9a24d

Download Submit