hxxps://www[.]justwatch[.]com/us/movie/inside-out-2

Analysis

max time kernel
82s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.justwatch.com/us/movie/inside-out-2

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe
868	msedge.exe
868	msedge.exe
5724	identity_helper.exe
5724	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3284	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3284	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 2356	868	msedge.exe	82
PID 868 wrote to memory of 2356	868	msedge.exe	82
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 2428	868	msedge.exe	83
PID 868 wrote to memory of 3960	868	msedge.exe	84
PID 868 wrote to memory of 3960	868	msedge.exe	84
PID 868 wrote to memory of 4472	868	msedge.exe	85
PID 868 wrote to memory of 4472	868	msedge.exe	85
PID 868 wrote to memory of 4472	868	msedge.exe	85
PID 868 wrote to memory of 4472	868	msedge.exe	85
PID 868 wrote to memory of 4472	868	msedge.exe	85
PID 868 wrote to memory of 4472	868	msedge.exe	85
PID 868 wrote to memory of 4472	868	msedge.exe	85
PID 868 wrote to memory of 4472	868	msedge.exe	85
PID 868 wrote to memory of 4472	868	msedge.exe	85
PID 868 wrote to memory of 4472	868	msedge.exe	85
PID 868 wrote to memory of 4472	868	msedge.exe	85
PID 868 wrote to memory of 4472	868	msedge.exe	85
PID 868 wrote to memory of 4472	868	msedge.exe	85
PID 868 wrote to memory of 4472	868	msedge.exe	85
PID 868 wrote to memory of 4472	868	msedge.exe	85
PID 868 wrote to memory of 4472	868	msedge.exe	85
PID 868 wrote to memory of 4472	868	msedge.exe	85
PID 868 wrote to memory of 4472	868	msedge.exe	85
PID 868 wrote to memory of 4472	868	msedge.exe	85
PID 868 wrote to memory of 4472	868	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.justwatch.com/us/movie/inside-out-2
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab75f46f8,0x7ffab75f4708,0x7ffab75f4718
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7464 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7996 /prefetch:8
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11336082487119991904,2552617740079990668,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:5508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4784

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x308
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000041

Filesize
31KB

MD5
5a823d1419926f4a9288b49f3749e7e6

SHA1
4996634a640317973f0c888840cdf8b102ee702f

SHA256
d72ae1921c1d639499118afe7e31cee8d67d3fb3f7ef985a4ae5d4814c93a05d

SHA512
30cc01d8870c506d70b7c62a7856f76595877e69134ef0a47abece27a3ec1b1138ec1e778a599ebca54b6dd0a505bae619918b65c5010d749b13a0608081dd34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
767fdff0747e1ea6d1b41c5bc8f03f9f

SHA1
3d25632f7b3b03cc5cd52b9fdecbb253e9ccda94

SHA256
408fb3d059b260e252534148c34dcd18dc222b91b6bc7f46448c339eb7f633b4

SHA512
3b54041699932c89708d98d854f21d20e4259e7bcabf03f064642cbcf714bb0fcbab63922daac6f9fe242d77190300bfdcee12fbd270a16515b7a9fe0e571787

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
4af011ecbb589d3597b8bb324ea31391

SHA1
40435c792778ff8968bdf5224d5ecdbc8ac3e921

SHA256
127cba7a9c4b1f37961a10ac5164148e1436f3d92a2d98f5e79e3590a688fd72

SHA512
cf46d61a67427f6237f706ee8e1788b1cf78d8aa344eed926f27dbde6dfa0487b4dbd18ee51c69d6fb0f3f1d6722860acac47d505783c22801060c3e45e6e1e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9f8092f8cb1d28c97d2719324b6eb403

SHA1
ae1908e2be5bc1277131ffb4a27b02f7cfbbb3d2

SHA256
34d3df61ee4f76754da30034d2b1e8711117fb8776df912895c74865969623f9

SHA512
7cbdc79e3746e2892dd09aa52db9854083ae5afcace74d3a11c0dded213168c5ea355d5d87b0d9c1eb37d53132ebabdb6e9599c535f8aec560df08d95dccd44d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
536b702c1c95af37e358bf8c55569207

SHA1
a55cc3fc3a57ae274cc34d45fab3bb0bc71f5cca

SHA256
9a86ffc4d72f25f356b5e68d5ef3599d2c0ab18e56976898ee36a430fe80f4d9

SHA512
e9efb4f879e9fc1649c45c8d6811f29905f81c286b059a73aae7eaa1d63161dd9489ed027641fb2daf9ca0b20e401548391a08f28930cf6c82ecde9be9fd3d1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
a01fde1e2c10b5d72ab1683128ccc541

SHA1
2d0a775214896a51f5449d0967252e9eb1a65bcc

SHA256
5eb178dc8e67e58f49a4816104adf7821045d190ce47bd112d08d1843dd0e32e

SHA512
3abc331f9ac08c88b19fc8a63e4ee005ccde7ebb8925622a6e5260643407e8460a6668956540131de0f762861826d01df9b5160030aa22459f897784e731b414

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
895411b8b52cf4d1a0919b2039dd0d10

SHA1
3e248e33903eb2acc4b2789d4932cfd35e8397bb

SHA256
39f4e2a77238ed468f8f5646ad8f0b275346d16013649bbefeed420308955cf6

SHA512
706d5695cd2f72403cd5e567254a4b1983732ef1fa92cef43b3a2299464e56cb5324b41df0908431794db14536fbce91321d8058d63fce8428fb8fc613e6889f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
5bdae5ac34eb66d772ec7b61723f0d9b

SHA1
ffb7e1f9c45f7d6eda29fd39ae3e91eaab9af4f3

SHA256
68f5f7ad76a0123900e2b246e6a1bae5b5c78a956b911cd3f0a5583f8b0786fb

SHA512
33a2ffac35996631a11513209fc7e4757b86e0a9565b59f90335644d32d826201a37ea60e1bc2dae118b5f085c8315f9054ad24418a25ad7a2b37be643c0a0fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
39bef5c784fe0780991e0b57202ae737

SHA1
a976de2634c4ed5bfa046df8db662dc915b50b9d

SHA256
ce17a9db18ee1fb0724cefda9f0d4f54cc8601714cd593ab2577d303797b9706

SHA512
311880c56e667a03300b1fe6c5621e8fd8a1ca7472d081eed89298cd68df0b6b0c24da15d587a31688ae344d035d95f20a001309d0c0a5d1e7a07d2715296107

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f5cd854afb02dc37c3c5f1b5aec5aa5a

SHA1
a730df61affa6d8afdb99ae6e183fb2e5a5138ba

SHA256
51bd0bc8c81ba3b9a098f8844da060fe654eee23d7fd7e9bef9d156a9e12c084

SHA512
54bc794724904632e700d488d3dab2feafe288f7196117d4d2c4f70341d8f67b2ab350889f995a7ce7ad06af12f67432fd909f342d0542d428119a22ac3dee29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581f0c.TMP

Filesize
2KB

MD5
2c3993afc4cd9f7fb10bd2d1454f1aab

SHA1
6d7193e530ac9ac0b7983df8d7f56c7252dedd24

SHA256
6fddc010fffb3c62ae39a2a507dcfce10460a408e66bd66a6df3917e2ae96c78

SHA512
25a905b23ff88395b08c306623abdc3c1fa001e671f402662a06b059a8f93f56fa2c22075b173615427fbc05cbc5cd859b4cbc90755b88ad44f6a74d5ba49f97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a799518a84781f6a3c318e5ff79c3bdf

SHA1
df6774cb838f2227576f9dab4014765e2ee92c8f

SHA256
c05c4bed36646f8ea9dcc5b504948fb308e663ce048adf800a0a4cd6ce93bf43

SHA512
9f4a8d314bd49061e3ce075de0ee04103fe913b35dd5d975f1c9e247185ebc0b7c966f08ada606068fd6c62c565f1e2716d084cb218a8f317451bcee94343168

Download Submit