hxxps://www[.]banknown[.]de/nam/72c0bc46-6343-4adf-a6df-4df79e22df5e/93326b86-85cd-40c6-85fc-a4ed17fba860/4fb1b23a-004b-49e7-b473-37965bac7313/landing?id=SndZU0N4VFpYQjFoTzBCRkFBTXZuSGRlQythZWZkTCsvelFXYWdCV1E2L0g4T0JONU1ldkxXeWpDZ05GWGh1cE4wamlsSHUvQmFrdUJvTjlTaHZMUUlZNE0yQ2FMdEl1cHE3Wml3Ny9zdm1aK0FLcGZZdHRiT1ZGRUR1WXRnd0lPR0lJWHF5c01ZVysrSjVLWURyYytsWlNJNnRHbXRaREhrUkNqRXUyZEdUZEMyQWt0NU1VdTZTWnRJaEJqZFZiZXUyenVQbStrNjVEU3lucEJFY1R6SElUNWFJSC8yZVhqVzdudVB3blNOaCtxUXp6eTNVMGtFMDVDSnFXb2M1b0lxdytsei96WE1wejBmYzlnSXgzdWRYTENsZWg1cURDQzYrOE1neWczUkozMG14MW1nVk9wWmJKMkxZRndxajgrQk9ucjZCZ0hlR2pLU3owTUQ0OXlzYTYvMkZXMzc5Q0JneVZhc1JLcDJ1ckxDWGplR09NOFY0dktFZWxNVU1peGtkb0hMb0NYa1FWRFNGLzRRZXV2QT09

Resubmissions

16-12-2024 13:54

241216-q7129ssjfs 10

Analysis

max time kernel
145s
max time network
148s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
16-12-2024 13:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.banknown.de/nam/72c0bc46-6343-4adf-a6df-4df79e22df5e/93326b86-85cd-40c6-85fc-a4ed17fba860/4fb1b23a-004b-49e7-b473-37965bac7313/landing?id=SndZU0N4VFpYQjFoTzBCRkFBTXZuSGRlQythZWZkTCsvelFXYWdCV1E2L0g4T0JONU1ldkxXeWpDZ05GWGh1cE4wamlsSHUvQmFrdUJvTjlTaHZMUUlZNE0yQ2FMdEl1cHE3Wml3Ny9zdm1aK0FLcGZZdHRiT1ZGRUR1WXRnd0lPR0lJWHF5c01ZVysrSjVLWURyYytsWlNJNnRHbXRaREhrUkNqRXUyZEdUZEMyQWt0NU1VdTZTWnRJaEJqZFZiZXUyenVQbStrNjVEU3lucEJFY1R6SElUNWFJSC8yZVhqVzdudVB3blNOaCtxUXp6eTNVMGtFMDVDSnFXb2M1b0lxdytsei96WE1wejBmYzlnSXgzdWRYTENsZWg1cURDQzYrOE1neWczUkozMG14MW1nVk9wWmJKMkxZRndxajgrQk9ucjZCZ0hlR2pLU3owTUQ0OXlzYTYvMkZXMzc5Q0JneVZhc1JLcDJ1ckxDWGplR09NOFY0dktFZWxNVU1peGtkb0hMb0NYa1FWRFNGLzRRZXV2QT09

Score

10^/10

microsoft discovery phishing product:outlook

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\c54be60d-7dd4-43c8-ad94-34d6691f6677.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241216135510.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
272	msedge.exe
272	msedge.exe
324	msedge.exe
324	msedge.exe
1072	identity_helper.exe
1072	identity_helper.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 324 wrote to memory of 4112	324	msedge.exe	82
PID 324 wrote to memory of 4112	324	msedge.exe	82
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 4296	324	msedge.exe	83
PID 324 wrote to memory of 272	324	msedge.exe	84
PID 324 wrote to memory of 272	324	msedge.exe	84
PID 324 wrote to memory of 2332	324	msedge.exe	85
PID 324 wrote to memory of 2332	324	msedge.exe	85
PID 324 wrote to memory of 2332	324	msedge.exe	85
PID 324 wrote to memory of 2332	324	msedge.exe	85
PID 324 wrote to memory of 2332	324	msedge.exe	85
PID 324 wrote to memory of 2332	324	msedge.exe	85
PID 324 wrote to memory of 2332	324	msedge.exe	85
PID 324 wrote to memory of 2332	324	msedge.exe	85
PID 324 wrote to memory of 2332	324	msedge.exe	85
PID 324 wrote to memory of 2332	324	msedge.exe	85
PID 324 wrote to memory of 2332	324	msedge.exe	85
PID 324 wrote to memory of 2332	324	msedge.exe	85
PID 324 wrote to memory of 2332	324	msedge.exe	85
PID 324 wrote to memory of 2332	324	msedge.exe	85
PID 324 wrote to memory of 2332	324	msedge.exe	85
PID 324 wrote to memory of 2332	324	msedge.exe	85
PID 324 wrote to memory of 2332	324	msedge.exe	85
PID 324 wrote to memory of 2332	324	msedge.exe	85
PID 324 wrote to memory of 2332	324	msedge.exe	85
PID 324 wrote to memory of 2332	324	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.banknown.de/nam/72c0bc46-6343-4adf-a6df-4df79e22df5e/93326b86-85cd-40c6-85fc-a4ed17fba860/4fb1b23a-004b-49e7-b473-37965bac7313/landing?id=SndZU0N4VFpYQjFoTzBCRkFBTXZuSGRlQythZWZkTCsvelFXYWdCV1E2L0g4T0JONU1ldkxXeWpDZ05GWGh1cE4wamlsSHUvQmFrdUJvTjlTaHZMUUlZNE0yQ2FMdEl1cHE3Wml3Ny9zdm1aK0FLcGZZdHRiT1ZGRUR1WXRnd0lPR0lJWHF5c01ZVysrSjVLWURyYytsWlNJNnRHbXRaREhrUkNqRXUyZEdUZEMyQWt0NU1VdTZTWnRJaEJqZFZiZXUyenVQbStrNjVEU3lucEJFY1R6SElUNWFJSC8yZVhqVzdudVB3blNOaCtxUXp6eTNVMGtFMDVDSnFXb2M1b0lxdytsei96WE1wejBmYzlnSXgzdWRYTENsZWg1cURDQzYrOE1neWczUkozMG14MW1nVk9wWmJKMkxZRndxajgrQk9ucjZCZ0hlR2pLU3owTUQ0OXlzYTYvMkZXMzc5Q0JneVZhc1JLcDJ1ckxDWGplR09NOFY0dktFZWxNVU1peGtkb0hMb0NYa1FWRFNGLzRRZXV2QT09
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb8dfb46f8,0x7ffb8dfb4708,0x7ffb8dfb4718
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,11838017501797128800,1904677668827251023,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,11838017501797128800,1904677668827251023,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,11838017501797128800,1904677668827251023,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11838017501797128800,1904677668827251023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11838017501797128800,1904677668827251023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,11838017501797128800,1904677668827251023,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff789ed5460,0x7ff789ed5470,0x7ff789ed5480
    3⤵
    PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,11838017501797128800,1904677668827251023,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11838017501797128800,1904677668827251023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11838017501797128800,1904677668827251023,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11838017501797128800,1904677668827251023,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11838017501797128800,1904677668827251023,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,11838017501797128800,1904677668827251023,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0d57a449c855203411a38d5ae80bc24c

SHA1
b361032efa556fc4557bbad595ce89c4b0c13dba

SHA256
bb59bab10e406cd91bdfe4fc0e8ce2817a6ca32fc731ccb3f90b6b79c1a46c21

SHA512
8d4244dc9c0e9518cd71aacaa54d43c1e2d74519e3e692160b2b040d00aac25c4ba7a5705391e50957d46c8c711dc07604effea3bc06c8956ecf717f61008da3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
77fe0ce7e1f9c9ec2f198ad2536bf753

SHA1
2a366472f227a24f3c0fba0af544676ea58438d7

SHA256
c69ca7653724e1e9e52518de8f4f030813e1431223d5b6ad3270531d8df89f00

SHA512
e8d4e17b93fb19364eeeffc5b1016fdbe566a8b8d702005291ff263367840b8ccc76290d8a3ad457d40fb5d1c2204bdaa5acba9374236c77935ebb0fe597a095

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
d5be45dbb692282039f81e05cf638328

SHA1
45a3e3d6e4f063cd5a140f9a5ef142a691fd09ba

SHA256
96a3849acc88fe93a63626b5c30089ff9c667c9bb1d7f3606cfa7b3d0ba146a8

SHA512
c123e37d29f44941a0c93a724b81b96ab51001005a8102d16476cae3f0479b597f42dbc05f5fdd1c916e91c4d6c874211d442fa2f3ae1680457f4fac948ecfa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
9a3844554767a6bc0213d90dea2351ea

SHA1
4ef7766765d8a76dde8f9ce5c6b6b9bda13727a8

SHA256
4d5ac9158b4fe06dc5a9d7b69be050f6a6c8a11d336fa6db6c2ae42cf4fee09d

SHA512
ee85368a5442e5fdaf4595d349bf269bf42b05376801323308113a3648d7151b090fa0acd69f832df0a0b513ac9fa70457dcd807bc3814835a85da77ecea0070

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
183B

MD5
e351e6abacf98db1b7b6108be12ea912

SHA1
417241b0a5d29590c825994ec07e15fdbc19c400

SHA256
8c4a98f551271651beb021b8db18be11e1c3280d445525892ed2f2df1a088a02

SHA512
3e106efad56f28475c1e5a83994f765b651c409055d56b8ab132b7964102a43e9b2e3f64ad718b9d48658f01b500ac6ac0188a72e4af8f8da6c705e6e92bec49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58a69b.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bc81efaf0dead7b2306c7aa3a7894cb2

SHA1
4be3503c68ee53de22f152f3089ef56745ea9af8

SHA256
83182e875f5bb65e8f28472fcbbeb90e8a4d7d8ec8f809e3b68fc600b9194938

SHA512
af7ca4a7189e019155f1fa91a36567628881b565418d32cde13820a2ceef9f44c104f00c920bfeac451b78f32489997d54d827e89526e2736f9f79eb844b9a81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
16555f7a303b6793aec40076628a19ea

SHA1
b5ab88d0bf51e15f596b2259df1bc6f31a686639

SHA256
294c7ec01ebc51c343c2d9fa2281251f85c851c42536e3901b0b536bb817ac13

SHA512
838d2e2f8d582f0ba6b54a3ff040b2642c1be35594fd5f4d85a946caca90feaaf20c04c6aed88a5a6487bbef170e21e53ad8cec670242ede63dfc9ca4729d59e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9b494c49d836f38f043d17cf955e3bdb

SHA1
ef8bf6f8388537cb959ca49e1a81d6f2173af843

SHA256
afb3aa30b9df5094c5581ded237aefc298d114168e3525e905de6af053434429

SHA512
384f3706333b396acd6c34a385f644d2f61dc611fc5e503fd1a624fbcf506f4e8dee551b5b3592472f762b7e69d0630ca0f5abea48748f5cf4fe49608733f657

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
77006dacd174a80aa9b867f95d5df337

SHA1
7078db638c72ee5cf4ede7911e4421cc4ae103c7

SHA256
5e22af33da2ed3f3197d9c899a8fec5e2716b54be019c484cd59960da8f143d9

SHA512
e8268ed24af38eaebda4cd864e5580ed1bb63e3e4b72a27fe3404baeb7c8c944a7e79282712ac9d0b33f0123654dedb1984633d6ae2a5b412d6536e2b0389bb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c567fafd-84cb-4446-97fb-a372537edf1a.tmp

Filesize
24KB

MD5
9b2345e425acf05ffaa1dee20d4fdbe7

SHA1
aecf86c5a5d24b77aea68f6bc99e7f42c9048bc3

SHA256
1eb6cc0eab0b222c1111dba69db74281366b9f5dc9f8707ff215b09155c58d14

SHA512
647fc97d693b709ef3b0877b6de1d4f9f4e1085d35b809d27360ede1be52b37f9a967fb80ce43be35d60b52409c7e4036376d7d931c96f0660a2eeffa58a8208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
885717d5a82a02d3dc3d8dbb7785ea16

SHA1
cf24e08054d344ad8852683de93354cf58d55aee

SHA256
5553f0e95727d743e2c8c5728df7a6ccd2eedc016dae91c3a8523d616a2d0ecc

SHA512
b48d1498fc997daed09553703734548be6fb76a333e94d2d7ced6ff95ffe3faa4d820dc56b7642ca20d19edc93daa82b4122a5026e9bb1874ffec5b5a42d8803

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
8484f94f70e0eeef18a99dac7ce72ddd

SHA1
517ecf71af8699d4b2287d8d42273956b072f2d6

SHA256
cd77fb76550588c5de72a20d64c8034dd3e3d9a89db85a617766121567f39093

SHA512
50f2467bf1366c3a92a9495581c81d52a32a83f94adc07ca63fc20ae003c2059ad495e7fd77532a07a4cdf04e71fea447b1ffab414fedc067f552b6f787a6300

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
cf156432507e3645ad10d58bbc7c4a0a

SHA1
03e4fc3436c32a8b8ec5aaef8e3e8813bfdc5a88

SHA256
49f5f7326dc8940251be9039a298f91025ae85e5fcc467592eee4190a9fe78cf

SHA512
f32e9e14dc12f53d2f370b44b751f2f93527bea806d5e01909e2ecdc8426dc37436c37aaa8357c7e1d0ae1f4191998bf22b3b8451758375cba5592b8b25ef86e

Download Submit