hxxps://www[.]google[.]com[.]kh/url?q=vvhghzxvqozfpsiwsbru&rct=Egm&sa=t&esrc=Alex&source=&cd=Leandre&cad=vvhghzxvqozfpsiwsbru&ved=vvhghzxvqozfpsiwsbru&uact=%20&url=amp/sasaol[.]com/ccy/ptsd/1qAokMk1YZaNTIK2eueVW6o608C/c2FsZXNAYWRnaHcuY29t

Analysis

max time kernel
134s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2024 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com.kh/url?q=vvhghzxvqozfpsiwsbru&rct=Egm&sa=t&esrc=Alex&source=&cd=Leandre&cad=vvhghzxvqozfpsiwsbru&ved=vvhghzxvqozfpsiwsbru&uact=%20&url=amp/sasaol.com/ccy/ptsd/1qAokMk1YZaNTIK2eueVW6o608C/c2FsZXNAYWRnaHcuY29t

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
5012	msedge.exe
5012	msedge.exe
2928	identity_helper.exe
2928	identity_helper.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 4372	5012	msedge.exe	83
PID 5012 wrote to memory of 4372	5012	msedge.exe	83
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 2400	5012	msedge.exe	84
PID 5012 wrote to memory of 3424	5012	msedge.exe	85
PID 5012 wrote to memory of 3424	5012	msedge.exe	85
PID 5012 wrote to memory of 4912	5012	msedge.exe	86
PID 5012 wrote to memory of 4912	5012	msedge.exe	86
PID 5012 wrote to memory of 4912	5012	msedge.exe	86
PID 5012 wrote to memory of 4912	5012	msedge.exe	86
PID 5012 wrote to memory of 4912	5012	msedge.exe	86
PID 5012 wrote to memory of 4912	5012	msedge.exe	86
PID 5012 wrote to memory of 4912	5012	msedge.exe	86
PID 5012 wrote to memory of 4912	5012	msedge.exe	86
PID 5012 wrote to memory of 4912	5012	msedge.exe	86
PID 5012 wrote to memory of 4912	5012	msedge.exe	86
PID 5012 wrote to memory of 4912	5012	msedge.exe	86
PID 5012 wrote to memory of 4912	5012	msedge.exe	86
PID 5012 wrote to memory of 4912	5012	msedge.exe	86
PID 5012 wrote to memory of 4912	5012	msedge.exe	86
PID 5012 wrote to memory of 4912	5012	msedge.exe	86
PID 5012 wrote to memory of 4912	5012	msedge.exe	86
PID 5012 wrote to memory of 4912	5012	msedge.exe	86
PID 5012 wrote to memory of 4912	5012	msedge.exe	86
PID 5012 wrote to memory of 4912	5012	msedge.exe	86
PID 5012 wrote to memory of 4912	5012	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.google.com.kh/url?q=vvhghzxvqozfpsiwsbru&rct=Egm&sa=t&esrc=Alex&source=&cd=Leandre&cad=vvhghzxvqozfpsiwsbru&ved=vvhghzxvqozfpsiwsbru&uact=%20&url=amp/sasaol.com/ccy/ptsd/1qAokMk1YZaNTIK2eueVW6o608C/c2FsZXNAYWRnaHcuY29t
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff994ef46f8,0x7ff994ef4708,0x7ff994ef4718
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,7541995488316492452,12174614345009350107,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,7541995488316492452,12174614345009350107,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,7541995488316492452,12174614345009350107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7541995488316492452,12174614345009350107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7541995488316492452,12174614345009350107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7541995488316492452,12174614345009350107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,7541995488316492452,12174614345009350107,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,7541995488316492452,12174614345009350107,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7541995488316492452,12174614345009350107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2780 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7541995488316492452,12174614345009350107,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2116 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7541995488316492452,12174614345009350107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7541995488316492452,12174614345009350107,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7541995488316492452,12174614345009350107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7541995488316492452,12174614345009350107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7541995488316492452,12174614345009350107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7541995488316492452,12174614345009350107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7541995488316492452,12174614345009350107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,7541995488316492452,12174614345009350107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2276 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,7541995488316492452,12174614345009350107,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3592 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
031b33ba627beac31a1689c98bbcde0e

SHA1
8b6b8d84513cb0ab1b4d642640cf5ffff5c97af0

SHA256
87798817dcacd1ea4680029265b5134fbfa06ffa6ca0833f8fc11e86c527226d

SHA512
6f60841c2ae026b7212a1a766c095f2bed2ce4929e36df833fb385929da8e7236b098602bd6aa34456053aa9040bf8b0ed4c4119a710af0b0aa273ef7bdcd316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
2e059b789a92bbaaf0c72dfa649f903a

SHA1
31a6f28ae063562a18351708c34b137d91e4a11d

SHA256
c4da3dfd47969ace13db91b7e50fe48528329dd53d40cf61e27b113b2108bbd0

SHA512
2a5c0437b40d1eddc7ca6d2f79f9969e09b20ec7e56cc99f8beca36aa612422e641eb960ae7c9ddf5a12e9cca1acbdba3f844a69b9ea01270e652205518722ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
336b2d1cf7888a8781d20eafab77f0d5

SHA1
5e3dd038decc279d36f9b90d9e3fa2c40a33e8f8

SHA256
b0613c79a97b77b65974d11f961b0d67f8b37562bf552cc2df990b1fa6090c09

SHA512
5bab67b4d3172beede3293fa0fbc23ceb9f2d50c1387ac31f0796c5f06103b8b6e88139e65df007c0e9ed420f298de6eefcfe4e31f2a39956f1e115367cc5362

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e21c80787c531b08d0023e57ff4fa1cd

SHA1
cae54350bcbf1b2f49cc723638da303824916c97

SHA256
d8320e9e30476131239378caecfaee056e20c1997bac540fe8f77b50f93bf5d8

SHA512
7c2697ab6d687915a17eff02fa121abc0098962eac980675d70f0ab3be0d9618b091553fb6dcbc8def05a40f41c4999441fafc2a7171208b09c2f7fdf0e3f1b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0cedfec68e17b577d11eb5eedabc1b62

SHA1
32b3388095a77a0103b26b64bdc5d8102148016c

SHA256
74f109023accfe99461a1a5e7bd33fefddb93a31b8739e15cdecade248cc310d

SHA512
207d1cdd235f838078ebe5cb39c744bc6bf0c58dd8ddcc7eec8cd490f6a0eec364da79dfb95190640803360c7c24a47b29875cbf73656ea04b780a84824d13c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e96d8c7fa06ec36bf69320d699ed49dd

SHA1
81d2105b56574a6873f2bf1b5e7391baa3de7123

SHA256
cf2f6d44fa4bedc5e2f27835c30216b7f2726b71bd31009bae5d003764f8bd8a

SHA512
b8c018cf23255e56b9712aa72188ebd209e62bf46689df857f08538ec939f24f4ad0a13e9422a43e40c4399eb05c5d90ea5c7404d3be36ea000f7d3499cb59fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0f3ccddef0c3f659bde5c693c9add74c

SHA1
246695d78cd3d24b2e238e84e1811109ec85dd7e

SHA256
644ad3201c0367a5dc4c8f7c82216de1aa7876bb6ee8346f5837d448a2cb580f

SHA512
6f54299ee6b0f0d7862c81e8560a543f3753a6148d5adbd64a6cbd0e8eaa9c54c47e306e77974376c7b3a5e7e23de0614b533ea044fad1014b5c2cdd86907b24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f7aa96f7c307506161aa68ca7f4bc8be

SHA1
fc8cb4a65231834aa3ceaae805543fcbf884773a

SHA256
1324525a7a59e68d3da10464065ffe740f8c42411d389a384dce4bb9a36eef6e

SHA512
74966aeb19e4524ed0491a197179c0c57e79550336995923851ca7a5c7cfdbca1ac353dae7ff257b0dfb07163f6b582114fbafb111c2b4dd308b80a782ff6d6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d975385357baadd981cf548b0c9523f9

SHA1
6b08b8ffb02981a1fcab724501fb549522beaa18

SHA256
2ffe8bdc9496381e46524c23feec95e127fc6f611d87e61577b6a47631100952

SHA512
610b184e5a2690927d09c3b8b4154f8f637871059e617708b979d58d0e3adb6035c0e357050e86aeeabd14ff1941cf11dab8271d874e081385274dbc3fc906cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
869B

MD5
193f5a8f7976e345a38bdeaabce9de29

SHA1
4ae97f71ced0f65f5e2173c2654253fdea404ac9

SHA256
9e9906e446f79989888782d07a2c1ed40bd3734eb602b4afef0f26fe1074a87e

SHA512
c7e8acd59e99c8b7d26ba83f849275559623fedefd8c4328781d8f76e24511dc20427b229199d7539ae38030009a052ce19f263e5f4e459745ba2bf4f2510453

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d1a3.TMP

Filesize
204B

MD5
b99c9c508840d88b0d273b319b1fdc9e

SHA1
097c76ab93f8a7a8afa40898ccbe431ee0071392

SHA256
51fa2214ca3e1dcbcbd139bae005e9c13acbef5618ef17475af0d6f6889bf3a0

SHA512
c4e433f91217b287d838fe12a36828a8f32e95f9754a32f1741d0a38f5ddfc617a48097a05ac453b9688710fc24bdd17667bef96d918ac69f5e2a48452731c53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
38caaeb659e7497e2a6db86f6086b307

SHA1
fa0b9e225c43ca29e0df126b45eaf9e8708f9252

SHA256
93999640042f11cb8ab265f9479773711e8f0ed7fb57fc6a404f6312ac835ff4

SHA512
37721257bd06fb51bfad62f997da195be8acca1d530230f50700315c39ea39f19e91964cc3c8db3955edd00b0d9e56ccbf33650d3ed9b7eecad79231a6daf98b

Download Submit