hxxps://carolinapublicpress[.]org/11166/how-do-school-lunch-prices-free-reduced-price-mealsacross-wnc-compare/

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://carolinapublicpress.org/11166/how-do-school-lunch-prices-free-reduced-price-mealsacross-wnc-compare/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe
212	msedge.exe
212	msedge.exe
2424	identity_helper.exe
2424	identity_helper.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 2348	212	msedge.exe	50
PID 212 wrote to memory of 2348	212	msedge.exe	50
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 2216	212	msedge.exe	86
PID 212 wrote to memory of 3972	212	msedge.exe	88
PID 212 wrote to memory of 3972	212	msedge.exe	88
PID 212 wrote to memory of 404	212	msedge.exe	87
PID 212 wrote to memory of 404	212	msedge.exe	87
PID 212 wrote to memory of 404	212	msedge.exe	87
PID 212 wrote to memory of 404	212	msedge.exe	87
PID 212 wrote to memory of 404	212	msedge.exe	87
PID 212 wrote to memory of 404	212	msedge.exe	87
PID 212 wrote to memory of 404	212	msedge.exe	87
PID 212 wrote to memory of 404	212	msedge.exe	87
PID 212 wrote to memory of 404	212	msedge.exe	87
PID 212 wrote to memory of 404	212	msedge.exe	87
PID 212 wrote to memory of 404	212	msedge.exe	87
PID 212 wrote to memory of 404	212	msedge.exe	87
PID 212 wrote to memory of 404	212	msedge.exe	87
PID 212 wrote to memory of 404	212	msedge.exe	87
PID 212 wrote to memory of 404	212	msedge.exe	87
PID 212 wrote to memory of 404	212	msedge.exe	87
PID 212 wrote to memory of 404	212	msedge.exe	87
PID 212 wrote to memory of 404	212	msedge.exe	87
PID 212 wrote to memory of 404	212	msedge.exe	87
PID 212 wrote to memory of 404	212	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://carolinapublicpress.org/11166/how-do-school-lunch-prices-free-reduced-price-mealsacross-wnc-compare/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd29d546f8,0x7ffd29d54708,0x7ffd29d54718
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,12634602132917564142,4819900415558171014,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,12634602132917564142,4819900415558171014,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,12634602132917564142,4819900415558171014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12634602132917564142,4819900415558171014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12634602132917564142,4819900415558171014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,12634602132917564142,4819900415558171014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,12634602132917564142,4819900415558171014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12634602132917564142,4819900415558171014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12634602132917564142,4819900415558171014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12634602132917564142,4819900415558171014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12634602132917564142,4819900415558171014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,12634602132917564142,4819900415558171014,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6dded92ec95cf9f22410bdeac841a00d

SHA1
83c32c23d53c59d654868f0b2a5c6be0a46249c2

SHA256
1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e

SHA512
e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1008B

MD5
d413ea6737c550dc84e6ef4a38ff5ec3

SHA1
d308370e0bc7d4f4093332dada6cfd0be2587a4d

SHA256
720e90e00a19a7caff52ad29e4dee72de3801724c42aaba87a326cc59d6818e6

SHA512
9d22dd8014825b96fb01df3633a8a37b7721cf55b4de108b22ef032f8f8f4bf0f5bdf22d9a1d2aa226ea8eb54309c6ac2fd9cf5fac7a8f413da083607cea0bd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_carolinapublicpress.org_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1659a7d2c8300e52627158d4bb157f43

SHA1
8f68998c5918a1d1bf7713683e2d782dbac0aa38

SHA256
e487dc25e67a58ed37b582dbf73f512adf684b44efe568c52b94fdf0205dd169

SHA512
01f257b9242fb044f7969730fdb03bddc872234e382bede158fb6f05fd8630136bd835273bcd1014d13e2e1eeabad528e7428b7f810070f656611285932e64ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d0b6b5a70aef62781d27016c1eecaff0

SHA1
7ef52434b932de5ed52b56bb256ac2eb62517925

SHA256
6b6e8c1dba06f7d30805a03e0bbfe8e3905eb20cc74bc0a76597dfe9a4dd5eb9

SHA512
2e65d00a0a4ca553c0db93f49151e53e463b78ddd3ea6995db31ceca26ea3e0166fec363cf3814e984caa793b081d2172198eb8688abc241bfa3b6d982a493d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
22c64d8b2283266c6c5a4d75f73bf3b4

SHA1
2d71d1d89807153e571350d5725b8410fc76dac3

SHA256
5be7487fdcde100f3a66a70c014766b9b083d434d0fcf178a690271a2995144f

SHA512
0a150632594f9d2f568d4efba4863a1a740df5f77b730a9d51ab7718887b6e101bc371d54b85bdd7f6f6f0bd2c70ec82a7688db8a617bb80c4fe5c20483e3660

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e05436aebb117e9919978ca32bbcefd9

SHA1
97b2af055317952ce42308ea69b82301320eb962

SHA256
cc9bd0953e70356e31a957ad9a9b1926f5e2a9f6a297cdef303ac693a2a86b7f

SHA512
11328e9514ffaa3c1eab84fae06595d75c8503bd5601adfd806182d46065752885a871b738439b356d1bb2c1ac71fc81e9d46bd2d0daa1b2ba0f40543bf952b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\56ae44bdc473b25696b471e45939a15fb4bbffa1\3a525343-fac9-4598-9fbb-e8874e8e8708\index-dir\the-real-index

Filesize
384B

MD5
412c7a3eb09684599009f6c9244ccfae

SHA1
f3f08050b8a21cd527abba4f539b02c79b179055

SHA256
176948e8b3e86540a2105affd4d5b43e7bec2c4dd512984ef62cc73920882baf

SHA512
97d04915fff8b8c174d80d989222ab603ba7a1f3353f4dc92a9b6948f9ffb78d7928ff421ee7a0b0719156e87fbbd0fb578cb6b5d38e74d2f6a435e337b4ab2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\56ae44bdc473b25696b471e45939a15fb4bbffa1\3a525343-fac9-4598-9fbb-e8874e8e8708\index-dir\the-real-index~RFe5859e3.TMP

Filesize
48B

MD5
44d323ddd19c11460500d91d908170ac

SHA1
066e8e5a5bd55f2878d0ac2530385abe8e2c4ccb

SHA256
63fbb56f74838b10228e92617250ce870e6831ac0349eaaccc028ac7755c61a1

SHA512
ee5eadf84015bd7f4ac9a793ca13024565e45fcb994558a6b798718f2081a1002a1b536ff63a99ca8704e5059a291b7428e7ab9c0a44721541a0aef0d85e5779

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\56ae44bdc473b25696b471e45939a15fb4bbffa1\59b6a8c2-9ced-4542-9d13-836f00ca34e7\index-dir\the-real-index

Filesize
96B

MD5
7dc212480aa2b05d2c1617a2cf052fc0

SHA1
735e2240a68af27f20ece7d933e713f72a8ca3d2

SHA256
e139ae6aa709c1464c1b96b81b6dbcba22e4706e140c31f1eb980cce750a9b2a

SHA512
7380a7fd6167773f352582689b253480be123f7ea471338b11977fac2d9566a35bfa25128f218ad3055a1ea8ac8f515e3ddd8dda4d4d56eb254906f0d04c8452

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\56ae44bdc473b25696b471e45939a15fb4bbffa1\59b6a8c2-9ced-4542-9d13-836f00ca34e7\index-dir\the-real-index~RFe58391c.TMP

Filesize
48B

MD5
dfef4b3db34e56c4739206878bde51dd

SHA1
a3250f162136dcceb1ab5c21aeb7c7e5e668d4e1

SHA256
5d37794cf78161da2c7d1e94e75ff533fb6857cc431370e1b910164e17b673e9

SHA512
eb9db65a08c90c5d5c49852fe23676720f794e3d8cfebe835567fac68938ecdd16c65f4b8d40a6cfbca0f5b6e5a7b8642a31a763a4794513f3b13679279f7e80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\56ae44bdc473b25696b471e45939a15fb4bbffa1\e366dbff-78d4-420a-8a4e-27b00889d02f\index-dir\the-real-index

Filesize
96B

MD5
c6afe8f7050af83b621e09cc16647da0

SHA1
4e1d426bf969067cf9d2b8656c9b16e687c01193

SHA256
44ceac9e9c7f7e71e348a3947de85731abca627d1624692fc9efe49bba0eb88c

SHA512
b5474570f62536d4a51e8d3241f64ce3e3cde1295e3041a144a3fc2671ab7963b8e96f8e8e421daa436f1e400d4f7e3e33e7e8a91364662c411b2997afcf2a9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\56ae44bdc473b25696b471e45939a15fb4bbffa1\e366dbff-78d4-420a-8a4e-27b00889d02f\index-dir\the-real-index~RFe585687.TMP

Filesize
48B

MD5
9ed2ae4deb0917129ad2433867e7eeb1

SHA1
6246ec598a6f96fa6bda5418f7c3c8ef53679b51

SHA256
31c28bcca49f60b7872eed0315743b1a7b5a6b9d9a30d1de7b9a147bb8f95e3d

SHA512
fbadf9a008920618edecffe5fda81eedbc7fff419eadbe1ec9ea7897d157c808a9134efce59f1ff6e623c6e51476f7703e1c471484254354e4e8f20c1a462a33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\56ae44bdc473b25696b471e45939a15fb4bbffa1\index.txt

Filesize
111B

MD5
ce8ca1fa4f55a4f7cd3a2e2ddee851e5

SHA1
b700475af3b65536a72d87156f06c69f43a1d718

SHA256
f0d19ce1d1cee1506189acd22480a0d3f26dc6d652acb5ae63949b045094ac96

SHA512
51e80d037db99193f26340baee6f136280a718e36a4328f239be1df9a88faa7947fd4ac063af142f6e9fda25b5900f7ae054b39d79f1bad0351f0d570be57f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\56ae44bdc473b25696b471e45939a15fb4bbffa1\index.txt

Filesize
179B

MD5
c52579f26d3e7cc07aaf5418105facc0

SHA1
fd98b1ea1083e8eaf083d92a80d890953f278f76

SHA256
c77f63f013b5d7dd1d782438c37eba9fae267299d92b42e14dce7036591fc1be

SHA512
0f3370fb2a643875413b8b30039b9d1551c8cb147e2b67a62d291e40d0ab42fc24510781cd012fb887b425da1797c2c1945ea86d5cebcd8c626924c381bae385

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\56ae44bdc473b25696b471e45939a15fb4bbffa1\index.txt

Filesize
245B

MD5
866865bc072a8b7a65ff99e139392bff

SHA1
c63ab0c37772fbb87a43d225ad054efb98883fb0

SHA256
1ae70dc8ccc8e1eadb74c6d147a06336c349c8ec48c994cabfc311a86c28d261

SHA512
c7e41b808ad76c7c33fc42d3f8ac27ac5dbbfe3575e1868c7e3ed430dd8b5dbaf63da628a27f383038426b89542c74b93331390bf208ac3f71dfe82fa8bd10cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\56ae44bdc473b25696b471e45939a15fb4bbffa1\index.txt

Filesize
241B

MD5
9fc36155dd9279405588c133229529be

SHA1
d62d1f46e02cbc2df8d64e06aa438b54ea983e54

SHA256
b3d4518fbbb62286cf9feb9e91ee6f8337ef96e92caa6bb6b1ac80e577a79772

SHA512
610bdc3c739af31c749c09f1a069e0cf1221ec77eb991b0faa6a6d54c0b26b20dd37a0b0cee8b692601ca4c757b68a431bfdefb77474ed3aaf82c3498f802ec5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
216B

MD5
70c102ca1c1de6dda8bdaa107aa8ed58

SHA1
cdec54b87ff73118580602f695d1522f7c64cc7d

SHA256
31d4facfa196e60f35b49bcd06530327fffe5262c4eedc3a665d1da6ccf9fed6

SHA512
2a07be11a86c76a04b78bd92d287364a6ea6b80b3ab2b84f86602e59a9bedbf385a3e1f89ee88b86b97db23de5252dd3cd460d3691c75339217ee1687d03084f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583738.TMP

Filesize
48B

MD5
a18b641494f930b4680e0276ce6788d0

SHA1
065edf65753d587526d0358fab0394017db921c4

SHA256
1183ce0aee5926b458acfee508ee57442bf043a1e16a22778a30e2d8d4fc9819

SHA512
bba5729bc996c5a2f8e8dcbdec2790742c2ddb53d365dc37abee17313941eea6c44f04f4b183bd787442819700084672bf504c80175924b796b4c04571aaa9ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bd28d5aded6565ec992a0f5ff0a47378

SHA1
11e251a4b975bdd4a0ce7b1733a7518bf92e8751

SHA256
350e2efd264258c336beab2eb728c08ba48e9d87821ce62514f7aa199d6be820

SHA512
df144d50efc4e7221148e34437cfeef204a8bc5a9323456c9e6b3ac5800f6cfb9996b94229ebf1f36c6c535aafc1ba02327c393ee1add4a8ff94aafd3cee5c8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582e5e.TMP

Filesize
708B

MD5
9dc4f2ad165907d12895d6bba7188558

SHA1
337c234641a50ef0c89500b45cac1ece3bf125fd

SHA256
c652ee56d5c5a63a68877aa1b0359a349e30790c06f3f129cffea631cf3e8cd9

SHA512
c28766cb5cd5afcfc9449bcf9d5953925a8d2c53d228ffc4413b4cc846c8c11c40e303be58200da06a990fd041be1fbfbaa4f7f955526d5ce724c2c6ae9671c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9c380bece913f11db48e2a734c40bb67

SHA1
14c4011d423d880b1501231e383ddf8268e0bda3

SHA256
43d7ac3557b889b58fab3db80a0308785d5dded1289bc539802abfdf1d95ccd8

SHA512
f67308198e293772dd7050719d4227c2fdcdce2d9bec7a134c58ccfd23bdd75ce8774d37e5ebffe90fb324eb56cee38f039824693806553c8b9603072144742e

Download Submit