hxxps://www[.]onsemi[.]com/company/about-onsemi/leadership/hassane-el-khoury

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.onsemi.com/company/about-onsemi/leadership/hassane-el-khoury

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: B46927F363E9FD120A495F99@AdobeOrg
phishing
A potential corporate email address has been identified in the URL: B46927F363E9FD120A495F99@AdobeOrg647601541265900631200109227525816773060
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4832	msedge.exe
4832	msedge.exe
4912	msedge.exe
3928	identity_helper.exe
3928	identity_helper.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 3824	4832	msedge.exe	82
PID 4832 wrote to memory of 3824	4832	msedge.exe	82
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 3616	4832	msedge.exe	83
PID 4832 wrote to memory of 4400	4832	msedge.exe	84
PID 4832 wrote to memory of 4400	4832	msedge.exe	84
PID 4832 wrote to memory of 3652	4832	msedge.exe	85
PID 4832 wrote to memory of 3652	4832	msedge.exe	85
PID 4832 wrote to memory of 3652	4832	msedge.exe	85
PID 4832 wrote to memory of 3652	4832	msedge.exe	85
PID 4832 wrote to memory of 3652	4832	msedge.exe	85
PID 4832 wrote to memory of 3652	4832	msedge.exe	85
PID 4832 wrote to memory of 3652	4832	msedge.exe	85
PID 4832 wrote to memory of 3652	4832	msedge.exe	85
PID 4832 wrote to memory of 3652	4832	msedge.exe	85
PID 4832 wrote to memory of 3652	4832	msedge.exe	85
PID 4832 wrote to memory of 3652	4832	msedge.exe	85
PID 4832 wrote to memory of 3652	4832	msedge.exe	85
PID 4832 wrote to memory of 3652	4832	msedge.exe	85
PID 4832 wrote to memory of 3652	4832	msedge.exe	85
PID 4832 wrote to memory of 3652	4832	msedge.exe	85
PID 4832 wrote to memory of 3652	4832	msedge.exe	85
PID 4832 wrote to memory of 3652	4832	msedge.exe	85
PID 4832 wrote to memory of 3652	4832	msedge.exe	85
PID 4832 wrote to memory of 3652	4832	msedge.exe	85
PID 4832 wrote to memory of 3652	4832	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.onsemi.com/company/about-onsemi/leadership/hassane-el-khoury
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef7de46f8,0x7ffef7de4708,0x7ffef7de4718
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,17022066424975027859,7551394797013976620,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,17022066424975027859,7551394797013976620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,17022066424975027859,7551394797013976620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,17022066424975027859,7551394797013976620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,17022066424975027859,7551394797013976620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,17022066424975027859,7551394797013976620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2184,17022066424975027859,7551394797013976620,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,17022066424975027859,7551394797013976620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,17022066424975027859,7551394797013976620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,17022066424975027859,7551394797013976620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,17022066424975027859,7551394797013976620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,17022066424975027859,7551394797013976620,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,17022066424975027859,7551394797013976620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,17022066424975027859,7551394797013976620,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,17022066424975027859,7551394797013976620,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4736 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
581f11c0a8a45fe3cc09d10a23a2c743

SHA1
c302f6be2d0c341c68b58fadaebae4ab5cc3eebe

SHA256
16e6015bee466b38639ba1c609959940de7ade83e1158e80d91e03315788e593

SHA512
a5085da540fd40194b77cd58f5a5983cedb47aad69a53239d416f843f537347d1d2feb1304af962877c30618188338d80f14777f54bb8b871c92fb45f12c2061

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
005ea8fe1df41e29a19c4602789a6db7

SHA1
1158d986112a0c92ce86985545d5eeaaa29268d9

SHA256
ccb5e3f8e7d2b431549bc4a3d415db4346ddc36a85a0ce2d5a83ceeff9d7aa93

SHA512
8835c95dd4969a6019c29c974917498e5cfcc305b3196db638857df8263c6d18fee3317e59b3c8e8044a2b29e86d0aa7dfe4f01e2285db607ab0168e0fd153ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2d94664f7eaf2be7b54b5cd3bd2f3412

SHA1
7782f81da01d3cfa3d7bc1222d9163680a3f05cc

SHA256
ac78ecf9232fe2e792aa2784af1c4208ae15d03cd231ed7f48fcab52147f42a0

SHA512
484f9b8b1f41a98b55e8f0194963846cbbc1b8106f7ed48163665294178b6e0a37f92cc2aa46342ba9b86f21a10dc9ed2c335e51446106cc5507fd1f1f86ef51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0fb973959ff19a21e8540f48d3b3ecce

SHA1
3e10b87fdbd44004d1ec5db78d2f9c161cf3c582

SHA256
ff0d72cb4f9756c0433a221ff65e18749de19afa14d2dc3fe5a8156540c8d816

SHA512
51b30cd81ee0c75104686e72a00f56e83b26fa9f2eb298eaad6a9ef0b8ca7ea3fc5e68732a794567e0b11d623e08217c4f48e5d0dd45706b12d16d532f4ae003

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
28d6788b965a2f92fa0a15e4df7073e1

SHA1
7acc4306c7f947830c074dc39f1763867fd69318

SHA256
b3bf93444e0cd4f4f70bb918918add20080ee2f1152e17596ad1e6f9ed65cd56

SHA512
e2cf12949778dd8cc80e44d06d527090d3bff9dd11186ef24b39ded7adeb42aafcd811f9fe5391032cbc9173fc8b8d43b090196d2bf4d4a8c35f56e0004f34d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57d254.TMP

Filesize
48B

MD5
36c5ede68935b242455e8ce27627bda0

SHA1
d92124f2bfb696e79644602f793231002e7178a1

SHA256
246f2f301f05d7207d8df45b0e388791ac1e00dd0d665272eadbd550ddfeb0de

SHA512
9dfd82168f7ae5daee96b6f1fcd73c284384ad79e92f368d9473390ce40b9223f7069babc0e16f067a80dd89252c3cc6d1fbec570cf598e64fd63f321175be51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d3c7e021b70187dda5991311c4148a16

SHA1
d2804bd01db01cfeb0ea57aab46ffb84cb1133ab

SHA256
fca28965c98fb332953085de7d62f32d77b5c6363f81f488accefed20eeb0a80

SHA512
3fac767c148d61e8bb621ac1508ba0bc9ab89abc52cc8150bec914a751255e2c00c8f5ef9c8dfcc9eb48d7d585fdb486bed6118d8bd8e2e134e5283d56023bcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581623.TMP

Filesize
1KB

MD5
0c6b83ed549f882572a3d15da080b38f

SHA1
9a2c9d38b0d06128cca274ae76b11388b2a4b8b6

SHA256
0e78af508fc40fa6703c751a52bcce92b26fdbf96a58b83cab27647eb6ad1636

SHA512
41c852a40c5e959d1e804a827b9845aea1a3ead3b522fbb9ad644e86265f9da7200f0400b73cc81f64a93907cba4368bb12652048c3bcaf9c59ea4a00cb46ab8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4a003a38881db27f23f9909123f5383c

SHA1
a6cf6dc2d0db53f14ea97f5c0fe380805768086e

SHA256
71e68aba1f7d77baa795406f5065ffd7d8dccbe09be2ecaab6de87d9dc1371f4

SHA512
73766ed26225ba8116b5416ceab0b9ef751c60e606e885762c23690c06fc6b5740af617c80e2cc8b3990baa754dd7bb4881e747af3254ca7b008675d386975e8

Download Submit