hxxp://uniperjp[.]com

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2024, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://uniperjp.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
3088	msedge.exe
3088	msedge.exe
4204	identity_helper.exe
4204	identity_helper.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 4288	3088	msedge.exe	86
PID 3088 wrote to memory of 4288	3088	msedge.exe	86
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 3336	3088	msedge.exe	87
PID 3088 wrote to memory of 2320	3088	msedge.exe	88
PID 3088 wrote to memory of 2320	3088	msedge.exe	88
PID 3088 wrote to memory of 4192	3088	msedge.exe	89
PID 3088 wrote to memory of 4192	3088	msedge.exe	89
PID 3088 wrote to memory of 4192	3088	msedge.exe	89
PID 3088 wrote to memory of 4192	3088	msedge.exe	89
PID 3088 wrote to memory of 4192	3088	msedge.exe	89
PID 3088 wrote to memory of 4192	3088	msedge.exe	89
PID 3088 wrote to memory of 4192	3088	msedge.exe	89
PID 3088 wrote to memory of 4192	3088	msedge.exe	89
PID 3088 wrote to memory of 4192	3088	msedge.exe	89
PID 3088 wrote to memory of 4192	3088	msedge.exe	89
PID 3088 wrote to memory of 4192	3088	msedge.exe	89
PID 3088 wrote to memory of 4192	3088	msedge.exe	89
PID 3088 wrote to memory of 4192	3088	msedge.exe	89
PID 3088 wrote to memory of 4192	3088	msedge.exe	89
PID 3088 wrote to memory of 4192	3088	msedge.exe	89
PID 3088 wrote to memory of 4192	3088	msedge.exe	89
PID 3088 wrote to memory of 4192	3088	msedge.exe	89
PID 3088 wrote to memory of 4192	3088	msedge.exe	89
PID 3088 wrote to memory of 4192	3088	msedge.exe	89
PID 3088 wrote to memory of 4192	3088	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://uniperjp.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa173b46f8,0x7ffa173b4708,0x7ffa173b4718
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,11933623119772297048,14005720590283131537,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,11933623119772297048,14005720590283131537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,11933623119772297048,14005720590283131537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11933623119772297048,14005720590283131537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11933623119772297048,14005720590283131537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11933623119772297048,14005720590283131537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11933623119772297048,14005720590283131537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11933623119772297048,14005720590283131537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,11933623119772297048,14005720590283131537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,11933623119772297048,14005720590283131537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11933623119772297048,14005720590283131537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11933623119772297048,14005720590283131537,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11933623119772297048,14005720590283131537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11933623119772297048,14005720590283131537,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,11933623119772297048,14005720590283131537,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000053

Filesize
48KB

MD5
c516fc64c2ce2da54e42fa31bd5e663a

SHA1
91323242547fb20ba7c4751ba23469907dcf38e3

SHA256
23625b65966e0e7aee05db5af64384107139cfb3b23783e51e2d98bd6b7c8921

SHA512
69b802c19e43c72d0ba03b12ea31b9a4034073ef7cd9db7c6bf1ba649a927abc99ad08655c78bc9ce380a6ee48442533ad23ac44e2728252f040a20b598f7296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005b

Filesize
20KB

MD5
d184fafd758c0c9ff2d264c230fb0f18

SHA1
5a28ea145347a6b33550dbf35a851d3e854dcde1

SHA256
79ec09835122cf102d1eefa09ad5c467b3231c821f1f1d9fbc4f1b6f00ea823a

SHA512
1339d4aa69870ab3e05eb9eb27cdd3e9cc2926466ce84bc803768f2203c5687a8271d1fe0f283da2a2d637c2e1904abf7cfb985bed86183e3f29696fad67e011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
b430b5d252ac3fc0937962e8e1a305a1

SHA1
f2145fadfcc06af7aa3ff68d552d5d36edb3a36b

SHA256
8f5760c59506c6a755fe880bedfc4de0c8d5e129843a19cbadadf8f30c45f7e0

SHA512
1528133a94833c8613a0de4721f9319337d1dad3bf4182485c5f913ae0de2c5efd151599311a5597b959fcc563c87649e09fe369b8b18d062f5140bbb69702cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e609a97165c82f98d7ccbc37f6d6fd02

SHA1
1d1e43e86d14e06c024a9faf7d503b38f880ee49

SHA256
6e564fa719dd7a15e5d887b400deef05ac5404f52d16c459156ee136a7231158

SHA512
089396c52d48c7e10184330402441188c141978f12f2ced9a341500799dc5209be5850f00a38a980b12ff3af81f94e8eeff944ebc124ff9b524b587fc1133463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
110bb7bb4cecb1530b0d4e960f3794a2

SHA1
e533a13fe1472e7597669d77244db7060d2dbb11

SHA256
525d323062e02c07cb6599c729f22e37f035fde21cdf50c2f23976eb45f41299

SHA512
2c1722ff06dd78b5069baa9661ff13b11814af0755c5b25c423214aae2bd6a44653c2e0c2a3942efff532ed2bd5a50053affa29405eeb877c4cdcd38fd002349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2a71cd723910cf4d0d6b43bb3a548f44

SHA1
51972bc36b7331f67d8f14beff422842216f5bdc

SHA256
2345d4e36b29eab1fd8c14ca6d417e57521d661d10c0d2c174c6f963636a2f75

SHA512
a919ef0fbd01d76a4eaed71909d08f9eaa0f29aea79fb3536dd376e9528f4c619d5aa52711a264b29dbaa99244ae3a25f66aad1289f42420b8ac32c96d641448

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
44ce17d6ca806930490af762a76e61b1

SHA1
ae2a1482b5f8d3ccd0653c6c018de8a0463f9815

SHA256
38896af7da0ebab099de2c727dbfc7e656d8f6411768b1ce93a259fd155ccdd2

SHA512
8a64fcd7d1dbaaa7a7cfad15c9ae225a3a958cdc20c1f33b6db2f0cb5e4bce050fec7c43ad138c61cde0725b192de4e5e4342ca9fb5535e7591d684a05346316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
82ddbe824efee307925bfd7ec9013c95

SHA1
32d79be2d25312f03679b9bb784506dd9a485565

SHA256
2adb5c1e7fbae4ab0c2d4b5e447599a4c29ffffeb8c3d369df4dd6af2ca56709

SHA512
dc6a465d9969278dc111348031c02f55ef11bb42778df15f39651c5da82a19266971ce5d0e9656c3ef2c09a6681a48da1309d220d6dbd5d912185ad34dc57be0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt

Filesize
99B

MD5
2f75c5d8860403ecd1a9bbfd16771f23

SHA1
ec6b6906f67917263166ec099144a5520e5e6900

SHA256
3f67dd83a802c1d16afa092668bc2f5e89280a81d4e4d525440c4e567454020c

SHA512
cc641fea5b11001330ce0255d527eb4bfa5261ce17307f548a7ff31bafe2ef492bea0833e18014f26a1a52ebfd86b0bd84a0d383c409c08bd39a15de4b9cdc61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt

Filesize
35B

MD5
343859b4ad03856a60d076c8cd8f22c3

SHA1
7954a27de3329b4c5eefd4bdcb8450823881aad6

SHA256
8c79b653c087618aa7395d5e75198da7d3b04c08654c39e56b1027f9ef269c2f

SHA512
58014a4e7f2b4b0d446fae3570196b8fb95d0d1b70bdab0dd34a74d6c62cd8d7ca494a486f19c1a829988a3af83a08d401f18d1769ce1799a02ee09807234254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt

Filesize
99B

MD5
8c89a304aeec7be2a4b3c62f9d6aab0e

SHA1
847ceb69a73194340c804fef5339647e9b53f4c9

SHA256
37fba74541091cee1560ad441f08410b491c3d01d2eef85dcf352a62aacd6945

SHA512
ba012597ad45967fe3f78f761815f334337834ef34a722d9a078c8fada5549db5951249bc25f5c860c933fc09a03a2a32e3e85cb9c771b22461f6cee55e999a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt

Filesize
99B

MD5
9a4822d5e58674ae3741dd42d5a1b361

SHA1
e153d25e7fd74df6d491e094587c9a5495cc6c75

SHA256
2d9cec600b257133e1ff1f773a98f58dd990fc36e38791941d57da56d42d6bef

SHA512
120cd2adb59981649b5990d966d31db94f6cc03c758825507f7342de40cc74aff73782a4f82e51f8e266f5b94a6e209fa02e9db02f36763d80777b39292d39a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt

Filesize
99B

MD5
b1d78f4b3a6556587120e575461dd2bf

SHA1
fb901f4cb12907cb50b616984f9e3ff810a86825

SHA256
d9229af66ba26db319f518e8a20801fb08d9407509c3b1f4a9d0ec874ec9a53d

SHA512
a01cf670921e381f49ea947d2f1f6c82f79bbe75e487bbf2d4daea0543f1dcf422517ae93b6bbe20d98e245665e30f2afb86f9973cb448902cbf4a1b771ad913

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b802f50a8991760735495e4dbf1a9c4c

SHA1
036753c47844d7ff6a5d7b202beb01e909a85d07

SHA256
4591ae226c2c81e2d1c37fc267b96e3183e4f53ca91ff6d3f638c0fd522217d9

SHA512
9f7c3425c7807d7c3b1434aa71ad78facd3c0dc2dec811bb2f96e137f9d249948ad26786d89cf73c6411bbd0383ccd8528afc04994d7dc79a5a22dc052321b45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58003a.TMP

Filesize
1KB

MD5
bc1ff428392052c167fa753577596a36

SHA1
4a57fabf8128374839936f2fb80a6e8630bdf653

SHA256
8bb4fcc4d084cd06c50ab287edef65fcb08e1ba06f89780834a523eaac3e1739

SHA512
73abe89aa3a81b9e5a90921bd851518cb7f3bd3acd0cb577b1236de5fa09e15f0aaa11d1f0e0c5c5adaffe6d8ce43d72ba905c7462e68497c2d8a05452949e5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a90d3b3765d346c26e89bf931458237f

SHA1
dae834a13e88eef2b5d7e1ceb9dce409099fa7cb

SHA256
36bdef95982a4335f8079b8f1435e7f8e590c48a1b079aca2cfc13ecebe907bd

SHA512
e782668cfb649e23fc98f4f1d6f8d019aaf02f08e005949f2de2529eecd1a2687d98a118d75228e4eb78f96a9235dcde0098065cd36f543fc8b1348ab4785674

Download Submit