hxxp://supplytic[.]ca/chuu/wpia/posha/sf_rand_string_mixed(24)/aeberhard@matrix-solutions[.]com

Analysis

max time kernel
900s
max time network
844s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
20-12-2024 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://supplytic.ca/chuu/wpia/posha/sf_rand_string_mixed(24)/[email protected]

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
3032	msedge.exe
3032	msedge.exe
4992	msedge.exe
4992	msedge.exe
2408	identity_helper.exe
2408	identity_helper.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 4520	3032	msedge.exe	78
PID 3032 wrote to memory of 4520	3032	msedge.exe	78
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 2816	3032	msedge.exe	79
PID 3032 wrote to memory of 3920	3032	msedge.exe	80
PID 3032 wrote to memory of 3920	3032	msedge.exe	80
PID 3032 wrote to memory of 2008	3032	msedge.exe	81
PID 3032 wrote to memory of 2008	3032	msedge.exe	81
PID 3032 wrote to memory of 2008	3032	msedge.exe	81
PID 3032 wrote to memory of 2008	3032	msedge.exe	81
PID 3032 wrote to memory of 2008	3032	msedge.exe	81
PID 3032 wrote to memory of 2008	3032	msedge.exe	81
PID 3032 wrote to memory of 2008	3032	msedge.exe	81
PID 3032 wrote to memory of 2008	3032	msedge.exe	81
PID 3032 wrote to memory of 2008	3032	msedge.exe	81
PID 3032 wrote to memory of 2008	3032	msedge.exe	81
PID 3032 wrote to memory of 2008	3032	msedge.exe	81
PID 3032 wrote to memory of 2008	3032	msedge.exe	81
PID 3032 wrote to memory of 2008	3032	msedge.exe	81
PID 3032 wrote to memory of 2008	3032	msedge.exe	81
PID 3032 wrote to memory of 2008	3032	msedge.exe	81
PID 3032 wrote to memory of 2008	3032	msedge.exe	81
PID 3032 wrote to memory of 2008	3032	msedge.exe	81
PID 3032 wrote to memory of 2008	3032	msedge.exe	81
PID 3032 wrote to memory of 2008	3032	msedge.exe	81
PID 3032 wrote to memory of 2008	3032	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://supplytic.ca/chuu/wpia/posha/sf_rand_string_mixed(24)/[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff70b83cb8,0x7fff70b83cc8,0x7fff70b83cd8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,17432809898824862045,3599321229559785834,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,17432809898824862045,3599321229559785834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,17432809898824862045,3599321229559785834,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17432809898824862045,3599321229559785834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17432809898824862045,3599321229559785834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17432809898824862045,3599321229559785834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17432809898824862045,3599321229559785834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17432809898824862045,3599321229559785834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17432809898824862045,3599321229559785834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17432809898824862045,3599321229559785834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17432809898824862045,3599321229559785834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17432809898824862045,3599321229559785834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17432809898824862045,3599321229559785834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17432809898824862045,3599321229559785834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,17432809898824862045,3599321229559785834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17432809898824862045,3599321229559785834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3016 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,17432809898824862045,3599321229559785834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17432809898824862045,3599321229559785834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17432809898824862045,3599321229559785834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17432809898824862045,3599321229559785834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,17432809898824862045,3599321229559785834,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1544690d41d950f9c1358068301cfb5

SHA1
ae3ff81363fcbe33c419e49cabef61fb6837bffa

SHA256
53d69c9cc3c8aaf2c8b58ea6a2aa47c49c9ec11167dd9414cd9f4192f9978724

SHA512
1e4f1fe2877f4f947d33490e65898752488e48de34d61e197e4448127d6b1926888de80b62349d5a88b96140eed0a5b952ef4dd7ca318689f76e12630c9029da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9314124f4f0ad9f845a0d7906fd8dfd8

SHA1
0d4f67fb1a11453551514f230941bdd7ef95693c

SHA256
cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e

SHA512
87b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
bee45990dc0b5d69ea2e8e42c6557335

SHA1
1eada95f0207715d6e1566303d9e9253a126bc71

SHA256
4d9ba07fd873d6cf313b12a9ff5e67e0c1150bcb1b3afdd6524733a4657d208c

SHA512
dd3b0bafc5a9ae9e76e4c957ff259fbe7aa5fbd8829c8ca38833c1b0729e571ac0da1b693c3c9985f2427a8be1486d606a75706db20ccd6cca969985d55535ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a02421d36de6acfe995f60e85c0918c5

SHA1
50444c2529e5171b711a1b77275bfcae2069b43d

SHA256
7977ca52cdfdb9f13bf56f89657c34febc82b92986d62764e4d880bcca7fb89a

SHA512
0747e1dcd5f966d5860e5564fda43f8d2f179b740887cb141f6fb45b2b21ca73b5a8f16682810d87743414333581d11e56b0032cd249c0c04cf217c1b7f7df5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
35a608208307cfc0d73f2c5a798ca9cb

SHA1
07da010a2a5e0437f4fee520ff6cd562e754d6f0

SHA256
21551712c4125ae0abe5627838e6b985d6a3bdca706b85cbb3176788e4a59944

SHA512
fa0ac0f55861be47418d89145464d6aece5f89a1e7312dbd78fde67b9e7206c75bc01827d7df06452770b55580f153d787e04bc607a7cef928b3d17c285f5812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
11f9f2e1c1f0f90b90a0702c248ab81e

SHA1
feb02da28fab85adc0404b9e4b409337cd00f4ce

SHA256
362713e2a162b8658fc0c594fada698ecf9a1aaa525057d9bc413779d58b9cf4

SHA512
0952b218daa54ccad3d94404ce100f9efe18367234ddc2ddbb75b0d9170e141ac9891301c36053284468017c5fa7fcb96f17ab050b067be08f9659a052f716f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\0b7b9d9b-fd62-45a2-8b81-1c50827c9eb7\index-dir\the-real-index

Filesize
96B

MD5
ca1ebbc5ebf635b02018055c435cf23d

SHA1
15994923f81340964940eebd5c984cbeed126a78

SHA256
a5bd1269b9a76ab42342ba48cc815b71ed7fb60281caa3163a7032f1cce94be9

SHA512
2560a8ab4408a1f7a8894edd558f1d573276437c70bd741fc08db1665dc0b267096af663a8e7b0135b3d8c55e22095f19d497db6af4f56368e32f39b2f26e917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\0b7b9d9b-fd62-45a2-8b81-1c50827c9eb7\index-dir\the-real-index~RFe57cddf.TMP

Filesize
48B

MD5
3c467c301d81933f865df840fe4a5ddb

SHA1
ca9d76387ddbeb7a2dc88e193541cb37fe083b3f

SHA256
78eddcf6140636cf6b5179f7ce572541f2200f6abc99ce848a688bdb279e92e8

SHA512
e08829b08a807a273741ac1a485104aae3d19160805dc615f17b49e95fc4ffa8b520faf4d6c476b8828d7088d69ffd0512da248ac0c782478947f0fc56a487ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\e91f4272-5566-4dd8-93be-6e3f3e5c00f3\index-dir\the-real-index

Filesize
96B

MD5
6c8ade985453df288f8571ffb88a1937

SHA1
2bdf9b9301003735333d9e78d3875d127bef2c72

SHA256
56434b7701ba6fa1f890eaab53d85602ebe7a2029df66b59bf0ef46665709d02

SHA512
4ebe898de70626ef275e057f59233e912f48d3982951ce7af7f13d77ce9bdebea897b69279ac6f048be915950f7d99960d010f56ec4db66fc6c545629b19ea14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\e91f4272-5566-4dd8-93be-6e3f3e5c00f3\index-dir\the-real-index~RFe57cddf.TMP

Filesize
48B

MD5
33b0b5a9d192404adb0f50c21325209a

SHA1
c226b17a7c935e91cd74fb167bf7604817380230

SHA256
423bc753cf856141af0a8bd5d97a6c8009d8889cf7acf995044cad93daf349f2

SHA512
e4f76e208216f4b812495d19f40995a46c509a5b87f2fb96de7225011f9351188541eb29c8b86d5db22a45a384e7dfda4851b88f8ad1ce8232d2521e81e7d329

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt

Filesize
107B

MD5
75991d55f78ecc32d358a07e376815e9

SHA1
4b76fe6487aad0a43f170ddf558e2a995ffc1c57

SHA256
3780f7ca3fc512fa7e16d4e0f557b88cc562fa877346ee36738d0f0b5dc95136

SHA512
303abaf8a9206f9515eb961dfb076e9828da1dd2a42418a30183126381bf9cc7b80cfea9d738b80dd7015795ba79d99714d3a4aec054ecc944e21c37759abcb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt

Filesize
181B

MD5
df7cd81c6eb106ed86bcd44ac270b19d

SHA1
63f67920f62340815b9bf7575d5487c5aec2f006

SHA256
327c056eb52b70ef9cef77b0a6c402ed577e32a3265ffa7af8d5c5ae4ba6e198

SHA512
0055525a0f3e47e7a44e2bcb48e5cff67042d96de2d66ddfe7bcd25b2a5a45b82a65d376f2eadce517e92ddfac394ec056563649ba366dd520e7ac8f50ec19a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt

Filesize
175B

MD5
586b5667f3299bd99db6a6ce6f2885ef

SHA1
d92e062f33425cf8da0f81598344a614477f7932

SHA256
e1a4c29920b9edc538e58366d1a4e4e104ea9891d8549aedd40def4d9b7377a7

SHA512
7e33a16cf323892bbf5bd33fadf4963c72d236fab801acc7e5f2ff7099e531ee1583ac858bcdcd419744875fff520fa264928d55293259d66a4f2b93db8aef36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3a750c85358115ecc43d6714898b9064

SHA1
a435c82ca2c147f188c7c556761255200ef02647

SHA256
704920d3e54f4679312e803a524ecc08723be7c7d84f3dce36bab8ba9e0ada89

SHA512
1d7a4af790cdd26999d042e3cbcbb9fff88a587b7719d594db13bb61fb40519be76bad8dfbaebceaff7b90aecb6e3fe49c5ad589fcbe4f73627ad0eecfa90cb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
15405bb751428a7d10a3697421ac49eb

SHA1
1c34c1fa1b87f1c2cd2caba90cef82befa0d8cbe

SHA256
9728b230d8e85df00aa0c0d6e10f719e01cc9dcc230f4d8690f192aa9fe772fb

SHA512
7f0bb69ac517b04b280c227694e3a9a2399e4ea95cd5ae5a50f24c7bd31332cb123fb2c6ec27bf5ec50d860e58b144edcaa3e81f52403d60b608ef47e0c77afa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580049.TMP

Filesize
1KB

MD5
6ad774bebd2505211df2dff821930865

SHA1
3ce5e395cf491605dbc1a774fc508718245727c1

SHA256
75136b7ed6357b27ca645e90cfbd592b3b605e386ed4359f463559b8b633e3dd

SHA512
a391e9ccdb0959604a243ddfe479609ef790fb5278b5eff24ca637614cf6746d13b4d06ab4c10ca61408cbd644163af12cf012b00c0bffd55a9ea37529cb92c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
918907683c21593b5526cd836bcf07e2

SHA1
66c42be741d640aa4816ca32dcf94770688f283c

SHA256
d48d51f8d8354f72b4c825bcc7104f6734d4188fd4938fcfb3f5e09c5d40f958

SHA512
3bdc35f5dc71b9e4d1f69fc00ad8f83b316e807bd4279e093f04d48725b1e2b83f3f77d1703f51b9acb8ac032e4fc913accc217e2df055f02ef92c9cf8b2a4e0

Download Submit