hxxps://workupload[.]com/file/vYrmwUt8qUQ

Analysis

max time kernel
189s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2023 10:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://workupload.com/file/vYrmwUt8qUQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
316	msedge.exe
316	msedge.exe
3988	identity_helper.exe
3988	identity_helper.exe
5464	msedge.exe
5464	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	5908	7zG.exe
Token: 35	5908	7zG.exe
Token: SeSecurityPrivilege	5908	7zG.exe
Token: SeSecurityPrivilege	5908	7zG.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
5908	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 2588	316	msedge.exe	42
PID 316 wrote to memory of 2588	316	msedge.exe	42
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 560	316	msedge.exe	86
PID 316 wrote to memory of 2280	316	msedge.exe	85
PID 316 wrote to memory of 2280	316	msedge.exe	85
PID 316 wrote to memory of 1492	316	msedge.exe	87
PID 316 wrote to memory of 1492	316	msedge.exe	87
PID 316 wrote to memory of 1492	316	msedge.exe	87
PID 316 wrote to memory of 1492	316	msedge.exe	87
PID 316 wrote to memory of 1492	316	msedge.exe	87
PID 316 wrote to memory of 1492	316	msedge.exe	87
PID 316 wrote to memory of 1492	316	msedge.exe	87
PID 316 wrote to memory of 1492	316	msedge.exe	87
PID 316 wrote to memory of 1492	316	msedge.exe	87
PID 316 wrote to memory of 1492	316	msedge.exe	87
PID 316 wrote to memory of 1492	316	msedge.exe	87
PID 316 wrote to memory of 1492	316	msedge.exe	87
PID 316 wrote to memory of 1492	316	msedge.exe	87
PID 316 wrote to memory of 1492	316	msedge.exe	87
PID 316 wrote to memory of 1492	316	msedge.exe	87
PID 316 wrote to memory of 1492	316	msedge.exe	87
PID 316 wrote to memory of 1492	316	msedge.exe	87
PID 316 wrote to memory of 1492	316	msedge.exe	87
PID 316 wrote to memory of 1492	316	msedge.exe	87
PID 316 wrote to memory of 1492	316	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://workupload.com/file/vYrmwUt8qUQ
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe9d5f46f8,0x7ffe9d5f4708,0x7ffe9d5f4718
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7460 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1273098886121700223,12925605397999026766,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3816

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5632

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap1939:66:7zEvent1154
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
483924abaaa7ce1345acd8547cfe77f4

SHA1
4190d880b95d9506385087d6c2f5434f0e9f63e8

SHA256
9a111c2b76c1b5f6d4f702502b9ff4326b7b5682921c2760286dd073824cb684

SHA512
e4ac0a0d5f06e056901c68488e34358a32a5bc7aeffcd82af7eba6043d0fa35eaa67a67c3716dcb661aaca441677819bcba7d35bc4efc6103f3ce32f78e32310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1008B

MD5
0c2f8f7ffa299fbbe1a914d8ba584471

SHA1
033de7ba7547e66b0075c0fdd5e4fa38116a1210

SHA256
c99a31b4202dfea924088e2c510df857f25160664bfe7868f5c028f039811d24

SHA512
14df820fc2f8beb215c1c64944ca733230764016fc726f4a0e08478deb5b0941fa031459a3d7f67cef5422928c39276f7cfa04739fa9a1eebc33234890a69b1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ae081729bfd92edddb382c55cafe3aa7

SHA1
88030e88f22d83f7690d7b087fb6a0dc4408837b

SHA256
a89ff1df3ddd1ba2dd2bd94b2220ed9a4580072f45bacf9c3ce618fd0f57b41b

SHA512
0abf683ff6acc088a9ff45c60f364324dc7465163302e13e0f475a064784293e176f2ac264bd5fcdb64059e706bdf8fa4d328ad9a5bcfed9c348e8f1d3ec5447

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6b7cbb06b307ca11c084ee5566d73a02

SHA1
6c3284ad33c3af103308b087263627dde3d515f9

SHA256
62df0326db415bc6c53970a984884ed734660caeff164da03a8dac44cd8899dc

SHA512
cb616ccd90dd28fad392329045721b91dc2dece865f075bc00dc2b74420a43542eb854116f76f1ff911d15b74a811ab9a9d0ae35e366fae2ec405803cdbacac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
84b73d8f4b5e5f2900b08fd29446079d

SHA1
bb0958be1c5cef1cbe7e46fe8c750a30453ccf42

SHA256
50a1b4e633b06ef7cc1063615a5c71c4a0271ab58f9f2af736ce87e274cf1be2

SHA512
eda14c99541e7ccc5c842879b0f01ce6260518aa64b413659d0522ff309a3c3a19bd0229bc684c711acf56bac66df118d176ac6695fc45e892ef04b19b182bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a88eb728c3a446a4e530d7c256ef21d3

SHA1
d7338cccc2d573bb0dbcce0baa8d5783ea621461

SHA256
5f017051391e62b3afa4ebbd2f9a09af1f9893fc8217e1e5ab0e55840f272afa

SHA512
9b02823c2b11ddd341889c13f31edd3a9788b3e7b5a2ce32c332a5ed1364db094d7cba416705fa807e2f083122477fb9a6a19fcd1776ac1fdd92cbf63d37b4d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1c706d53e85fb5321a8396d197051531

SHA1
0d92aa8524fb1d47e7ee5d614e58a398c06141a4

SHA256
80c44553381f37e930f1c82a1dc2e77acd7b955ec0dc99d090d5bd6b32c3c932

SHA512
d43867392c553d4afffa45a1b87a74e819964011fb1226ee54e23a98fc63ca80e266730cec6796a2afa435b1ea28aed72c55eae1ae5d31ec778f53be3e2162fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3938be626ca49b0e02ccca6c4b87fee2

SHA1
5d3ed883daad037f492e6ee42bbbdf03cbfd52ba

SHA256
5cc8a4292cfadac2decfdb0bdf0eb9f31dacca9c9a6e39728ed4540df8bdd204

SHA512
c1b4e17f4fcdef07e20bf96d0a3b542e4883c354194dd00590b040dd36ad9b6a0e3fcacab9a4642174403703ff9a3183fb5da625577e4bb73d718a4b6655532a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
815810bbb9c8da71827845be7b2d1af5

SHA1
f8cfd882126444aeae1b27e920f7c58e3d54da51

SHA256
8b6b2d71e3ed25d6e22abe658b8a50f57e379a8bdf1a7291e31985b26b55f954

SHA512
73eaec4bcc9968d63f0344c1cb5b1a95d0146865a6bc55696d1539f6f6ba6983432331bb6eaf711a2dd46450a045638740e9dd4f5d1a4486091fa648f214435a

Download Submit
C:\Users\Admin\Downloads\Xn.zip

Filesize
48.5MB

MD5
ef3949ce60c3fde147563506fbd10012

SHA1
d7bfc16c0082279c118312338ace4e149a7de250

SHA256
5d8f8ec81e0a9a116793bbbc815a2e772e1db936436d22c1f473e1de80538417

SHA512
753423e36533ad68f51c3e79fadd3baae76bdf09b426940f935b225aa44475e42792f34a3d74d362d50c4bedb20640458186eb4918155e16915ec86fb90f2372

Download Submit
C:\Users\Admin\Downloads\Xn.zip

Filesize
48.5MB

MD5
ef3949ce60c3fde147563506fbd10012

SHA1
d7bfc16c0082279c118312338ace4e149a7de250

SHA256
5d8f8ec81e0a9a116793bbbc815a2e772e1db936436d22c1f473e1de80538417

SHA512
753423e36533ad68f51c3e79fadd3baae76bdf09b426940f935b225aa44475e42792f34a3d74d362d50c4bedb20640458186eb4918155e16915ec86fb90f2372

Download Submit