hxxps://ezstat[.]ru/2XR8h4

Analysis

max time kernel
39s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20230915-es
resource tags

arch:x64arch:x86image:win10v2004-20230915-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
11/10/2023, 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ezstat.ru/2XR8h4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1141987721-3945596982-3297311814-1000\{5E593BB0-229F-40AB-92A4-AF88D3BB3BC6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
652	msedge.exe
652	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
4132	identity_helper.exe
4132	identity_helper.exe
2308	msedge.exe
2308	msedge.exe
2060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 3628	3756	msedge.exe	25
PID 3756 wrote to memory of 3628	3756	msedge.exe	25
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 3504	3756	msedge.exe	86
PID 3756 wrote to memory of 652	3756	msedge.exe	85
PID 3756 wrote to memory of 652	3756	msedge.exe	85
PID 3756 wrote to memory of 4880	3756	msedge.exe	88
PID 3756 wrote to memory of 4880	3756	msedge.exe	88
PID 3756 wrote to memory of 4880	3756	msedge.exe	88
PID 3756 wrote to memory of 4880	3756	msedge.exe	88
PID 3756 wrote to memory of 4880	3756	msedge.exe	88
PID 3756 wrote to memory of 4880	3756	msedge.exe	88
PID 3756 wrote to memory of 4880	3756	msedge.exe	88
PID 3756 wrote to memory of 4880	3756	msedge.exe	88
PID 3756 wrote to memory of 4880	3756	msedge.exe	88
PID 3756 wrote to memory of 4880	3756	msedge.exe	88
PID 3756 wrote to memory of 4880	3756	msedge.exe	88
PID 3756 wrote to memory of 4880	3756	msedge.exe	88
PID 3756 wrote to memory of 4880	3756	msedge.exe	88
PID 3756 wrote to memory of 4880	3756	msedge.exe	88
PID 3756 wrote to memory of 4880	3756	msedge.exe	88
PID 3756 wrote to memory of 4880	3756	msedge.exe	88
PID 3756 wrote to memory of 4880	3756	msedge.exe	88
PID 3756 wrote to memory of 4880	3756	msedge.exe	88
PID 3756 wrote to memory of 4880	3756	msedge.exe	88
PID 3756 wrote to memory of 4880	3756	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ezstat.ru/2XR8h4
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa6a8846f8,0x7ffa6a884708,0x7ffa6a884718
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,17400106627452930770,7117394127787409222,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17400106627452930770,7117394127787409222,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,17400106627452930770,7117394127787409222,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17400106627452930770,7117394127787409222,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17400106627452930770,7117394127787409222,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17400106627452930770,7117394127787409222,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17400106627452930770,7117394127787409222,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2104,17400106627452930770,7117394127787409222,131072 --lang=es --service-sandbox-type=video_capture --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,17400106627452930770,7117394127787409222,131072 --lang=es --service-sandbox-type=audio --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2104,17400106627452930770,7117394127787409222,131072 --lang=es --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17400106627452930770,7117394127787409222,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17400106627452930770,7117394127787409222,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17400106627452930770,7117394127787409222,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2104,17400106627452930770,7117394127787409222,131072 --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17400106627452930770,7117394127787409222,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2104,17400106627452930770,7117394127787409222,131072 --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17400106627452930770,7117394127787409222,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17400106627452930770,7117394127787409222,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17400106627452930770,7117394127787409222,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:5316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
61KB

MD5
4355e6b7ad8f7edfc312a7abcb1dde08

SHA1
9a36a6dc018dd9e093b56d74fb05a1f51c5d5ef6

SHA256
0955945083e202d80af803ff8c627455d8a913740c141cea563aa09b68f46485

SHA512
66434fdbbd07c4181318c74b777c30f8c92bbbb35713dfa4122c82a8d4c98fb1464a3dad2ecb4793020b7f48bbf5a40913560d78e96ad935bec681d775bc2c33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
76KB

MD5
962b7b7607ea6fd82d9715d5d90ef45f

SHA1
7e44350ad758cae6f98caf01b58842c58c541534

SHA256
ebc4928bfbe96c0c5fe0e67eaed57c9c44ba4a07b14cbb9561428c2aa425d6e7

SHA512
803fa7ae9bf20bb834472a08877aa355b3d14daf075a6f5a4ec9b8c60457cb79f263901d13d4f464f5d0f6886929bdca8b5fc3aebe56bcafad41fe675a0e2823

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
122KB

MD5
2cea209546fbc3da9cd4f2260d3a37f3

SHA1
71e568ba83467886cc7d7bd75e7c879539949e2e

SHA256
fc923bd399e8d20b9bafb0d16c3aa8db3249b62b3542670ee22473198328e175

SHA512
fd6858a0aa1f03f9ef857b8c77cdb60d1cb3cc7bf23e5c34c4d4192b75edb4e1ca3932f9adddbab3c50b436d2269526c6c5ec2a2d9f70afef655c00754ae8afe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
83KB

MD5
4f65f9c651ba81535dd5a859d88feb41

SHA1
c6b7dce873365aa0944462591452f1ad5044e125

SHA256
378fd56398d43b00583081902f5162e459a86fd3d6e9d96242200ed4cdc8cd45

SHA512
4292471a9344fdc82d60f692ebf0a243a1be092f8333a66bf54b490034bf746e90b9f275d6e84b5b29052c024c3fb07aa4f91db9e294b04cd0777cb375cfc6e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
83KB

MD5
f649bbc6a03234349a0c3789d9a67161

SHA1
30fb7fd1246d75fdce3d5ef2021800d4a370a04a

SHA256
7e86f161edfa370ba66e7a4eef89f611c733931a4a0874551aeb10987df43944

SHA512
676bf4b7f6d0ef64b9c051f9070d09585230ba4aabe3212e49b368c05ca72a57dba3a07d83107bd489b7677ce44534bf1714a830cd7365daa393108a17a6ae05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
118KB

MD5
30add4e982f8d5067ac9ab0196a17560

SHA1
4a493e05416b37907dd259213b5a30852a1e4d5b

SHA256
f25ae3b1f76574c5015f0c91e45ceaabc608104be632062acc9ac8ef9c427ec7

SHA512
64669b2ec58e3b54c29d61af909f49bd4863db8cc9507a54f7edec61861f3e22bc9f347663c8d0308d4a8f95ebff0e866587055e48b83dd7228fce8284a1a5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
186KB

MD5
80b320950ba9ec5b0d827fd5cb0c1476

SHA1
8065c505528c9e49a178d6fac408ca19bc800466

SHA256
db501c2157687be56d82d8f622a89c558349bf3da7dc1b3d09b4cfb792e7550d

SHA512
563d1898086a51976683d6089bdcf6dfbdb1024af7145144bcff424815f52ea22f9aba1c61a5fe7bad64b747ec0d16568aece7245253ad2e68bdbd1f1b1470e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cd6c8ba84112172139983b5085d08a28

SHA1
7171e1df1bf7b5ca3e5c632e663cd5296d59f805

SHA256
8a1faff6235056744623024e3778ba60c50d38816a4bae79f1d2221d419e2324

SHA512
d9e13db45b16c149fa578410a1fa0d676abedd0e1c316908103e94f9df168f82f6edddbaaecc9644add03f115e63030fc5840b612620806c14b05390ad3a7931

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5269431ac4e4412ae202bfa42ac65d23

SHA1
ef65f1495d93c103bd7d73cf5f4f13dd3a46fedf

SHA256
e541f7730ab53521ea78aa22f2a8c93e1f27229f70779f94fb8dc61cc90e9a1a

SHA512
9240beebd36ee018127656bf10b7bce3ed50ccf132f1c43a98f4651b8f040bbf2f3f062efea5c6dad183a660d131129672f68adbb8837e8b74f358f67f3efaa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2e911842f42da4dd454b340d2dd70918

SHA1
ed644701d1e6017ba963a3384424f798d1afea70

SHA256
c1d65f35928ed6e74739c66fa4fe241a3835e39d0916b55965052b2446201741

SHA512
967f23dca14cb5af77f7f1f53b17f440783a1948b06e6771a9a25ec5987fc1c89df80689cee7e0eb999124180861b015d90a6dddafde417f3f61242ca01c1665

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d555d038867542dfb2fb0575a0d3174e

SHA1
1a5868d6df0b5de26cf3fc7310b628ce0a3726f0

SHA256
044cac379dddf0c21b8e7ee4079d21c67e28795d14e678dbf3e35900f25a1e2e

SHA512
d8220966fe6c3ae4499bc95ab3aead087a3dd915853320648849d2fc123a4acd157b7dba64af0108802522575a822651ecc005523c731423d9131ee679c2712f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b8d52edbf3ecd4ef467a609f1ce00807

SHA1
ab75723f5f6de321ec0081df8d8b6e0c5a1edb7a

SHA256
67f16140c8e5e14f792e53586056ccbed21cc245000f6c6f1848d2399b0840a1

SHA512
3556bb503a9219f2d6e744a908218a8ae636739340254859bc1deea53a9a1bb101c78ee379dccfb8dad699084ef43c2cde68d707931360247b959904940cf68a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583004.TMP

Filesize
875B

MD5
dd8c182fb925e3d24563c095e7292cef

SHA1
1d0e68069413af3119faee27ad382b31ed348a90

SHA256
8b3cda8274b26e07533a4710a326896b20b2d62e3db5880749ff0099321b49ae

SHA512
132ddff28233843229f8925807f87005b7eac7e7d8c7436e173cbe745b7c2113036ff2b9693a066bd0e12ec23c1a7c32a0b2c77ed9e0cdc398b52a0841b701f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8fd840f7faa9b70c0d714b5ae2e674df

SHA1
b7864b4491a84c6e588e8c33730d6f0602dcc5a0

SHA256
0297966932e1114edef33aaf6f24f61e0516cd60bc176bc5820a80dc18c80743

SHA512
b89b58032bcb378be0857600073ba99d0c4b0407cf9eabd5e2bcdd19158535bb68ffe48f9f28b0f2b139feec888d178bce9138f73ed11b949be357d630fa833b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f3ba3aa2b9d826e58437dc56c291a024

SHA1
3a27902d93628e20d45cf972703f7b2d7c115fac

SHA256
be4ded45c69ffbe6b1a259abbb62719527a759a607e59e3b7174e620bc0aa2ed

SHA512
13c33bb247d3337f1c9f4b6f5cc7f786970b23cd0559b1c122e19efa54bf1e862088d00de4831e939068b70205cabb8258292f0763738ed5a6fbcafd04fccdc6

Download Submit