hxxp://track[.]unear[.]net/f/a/11fdX5cTAaYXUjoDDiZSXQ~~/AAAAAQA~/RgRnOLSjP0ScaHR0cDovL3d3dy5hdGxhc3NpYW4uY29tL3NvZnR3YXJlL2ppcmEvc2VydmljZS1kZXNrP3V0bV9tZWRpdW09ZW1haWwmdXRtX3NvdXJjZT1zZXJ2aWNlLWRlc2tfZW1haWwtbm90aWZpY2F0aW9uJnV0bV9jYW1wYWlnbj1zZXJ2aWNlLWRlc2tfZW1haWwtbm90aWZpY2F0aW9uVwV1bmVhckIKZVUjgVdlH_A53VIYbHVjaWFuYS5hc3Npc0BhdGVudG8uY29tWAQAAAAA

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2023, 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://track.unear.net/f/a/11fdX5cTAaYXUjoDDiZSXQ~~/AAAAAQA~/RgRnOLSjP0ScaHR0cDovL3d3dy5hdGxhc3NpYW4uY29tL3NvZnR3YXJlL2ppcmEvc2VydmljZS1kZXNrP3V0bV9tZWRpdW09ZW1haWwmdXRtX3NvdXJjZT1zZXJ2aWNlLWRlc2tfZW1haWwtbm90aWZpY2F0aW9uJnV0bV9jYW1wYWlnbj1zZXJ2aWNlLWRlc2tfZW1haWwtbm90aWZpY2F0aW9uVwV1bmVhckIKZVUjgVdlH_A53VIYbHVjaWFuYS5hc3Npc0BhdGVudG8uY29tWAQAAAAA

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
3612	msedge.exe
3612	msedge.exe
4816	identity_helper.exe
4816	identity_helper.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 4624	3612	msedge.exe	63
PID 3612 wrote to memory of 4624	3612	msedge.exe	63
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 4984	3612	msedge.exe	86
PID 3612 wrote to memory of 3236	3612	msedge.exe	84
PID 3612 wrote to memory of 3236	3612	msedge.exe	84
PID 3612 wrote to memory of 4832	3612	msedge.exe	85
PID 3612 wrote to memory of 4832	3612	msedge.exe	85
PID 3612 wrote to memory of 4832	3612	msedge.exe	85
PID 3612 wrote to memory of 4832	3612	msedge.exe	85
PID 3612 wrote to memory of 4832	3612	msedge.exe	85
PID 3612 wrote to memory of 4832	3612	msedge.exe	85
PID 3612 wrote to memory of 4832	3612	msedge.exe	85
PID 3612 wrote to memory of 4832	3612	msedge.exe	85
PID 3612 wrote to memory of 4832	3612	msedge.exe	85
PID 3612 wrote to memory of 4832	3612	msedge.exe	85
PID 3612 wrote to memory of 4832	3612	msedge.exe	85
PID 3612 wrote to memory of 4832	3612	msedge.exe	85
PID 3612 wrote to memory of 4832	3612	msedge.exe	85
PID 3612 wrote to memory of 4832	3612	msedge.exe	85
PID 3612 wrote to memory of 4832	3612	msedge.exe	85
PID 3612 wrote to memory of 4832	3612	msedge.exe	85
PID 3612 wrote to memory of 4832	3612	msedge.exe	85
PID 3612 wrote to memory of 4832	3612	msedge.exe	85
PID 3612 wrote to memory of 4832	3612	msedge.exe	85
PID 3612 wrote to memory of 4832	3612	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://track.unear.net/f/a/11fdX5cTAaYXUjoDDiZSXQ~~/AAAAAQA~/RgRnOLSjP0ScaHR0cDovL3d3dy5hdGxhc3NpYW4uY29tL3NvZnR3YXJlL2ppcmEvc2VydmljZS1kZXNrP3V0bV9tZWRpdW09ZW1haWwmdXRtX3NvdXJjZT1zZXJ2aWNlLWRlc2tfZW1haWwtbm90aWZpY2F0aW9uJnV0bV9jYW1wYWlnbj1zZXJ2aWNlLWRlc2tfZW1haWwtbm90aWZpY2F0aW9uVwV1bmVhckIKZVUjgVdlH_A53VIYbHVjaWFuYS5hc3Npc0BhdGVudG8uY29tWAQAAAAA
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd54846f8,0x7ffcd5484708,0x7ffcd5484718
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,8637999172419281495,1409221896365413285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,8637999172419281495,1409221896365413285,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,8637999172419281495,1409221896365413285,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8637999172419281495,1409221896365413285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8637999172419281495,1409221896365413285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8637999172419281495,1409221896365413285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8637999172419281495,1409221896365413285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,8637999172419281495,1409221896365413285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,8637999172419281495,1409221896365413285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8637999172419281495,1409221896365413285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8637999172419281495,1409221896365413285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8637999172419281495,1409221896365413285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8637999172419281495,1409221896365413285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,8637999172419281495,1409221896365413285,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1ecce9f3-8791-4cb8-bc1c-f60acf1dcce2.tmp

Filesize
5KB

MD5
aa14d5b2ac115c3c53c7f9d9dac0a91c

SHA1
60023b26f61e7fcb4e92fb4efe5ec8cb46156d2f

SHA256
60426d882160d2898c430dff0a4f6c0c9aba448d294e8498fdb1bd506a56977b

SHA512
2a93fe1b268463dd233d7c347616ea13b581d7c51d8bc363eaa4ba6c4b1f8fa68eff63eca6d103b9b705a8117a555198f9ad8b36c3cc1ca7c0cff0930bdc524b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
936B

MD5
12ecea6a03f9654c3677cc8f2aaab6e7

SHA1
ee8c4f6bc6dadce382d618ba0a3b3dd396a7a0aa

SHA256
672f1c4d68e401e89ca92d6afa43084919fca2a987bfdfb0f864e6cbae660a40

SHA512
2f81ad448dd5405aa462b7bc93b725e0d78c9ec62a9bfd496cde377d88bcf537892f748196369f21920b29e645b138015bb17a56e8bbeebb33da18598310afa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9e150ed1895d686e8305b5e1b74c9418

SHA1
2ada25d91f503e450a5ee25fbd96895a9859f33e

SHA256
2f3f422b35a145ac48b87a9cd1ee50220e284fdb907d4116f4e5e8de4d6ff595

SHA512
506f7c1edd31f21d544714c6e9be1820e4cd24b57ec4114516577c741cab62b7beb48f7aa9a91f341e30c776686da8c840287fafc8cff92c19855458756833fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
85d9818ae979a146fd72c85e3d29764a

SHA1
1bfe49f82cd261ddb0c74a5455a0c527080fa14d

SHA256
d14258bc48a7cf638964dc5e51f68855845f13842ce8ce4ad9b9b8a2c8ab01f6

SHA512
3a36451193b678d740cd704fd78141ea8bde12b2d5dbbd952ddcbe0ac9b9e5508dc2317f7f95b6a9e73db775405f7de7a80bd16d608dd339a3b5059d3aabf3d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
fd20981c7184673929dfcab50885629b

SHA1
14c2437aad662b119689008273844bac535f946c

SHA256
28b7a1e7b492fff3e5268a6cd480721f211ceb6f2f999f3698b3b8cbd304bb22

SHA512
b99520bbca4d2b39f8bedb59944ad97714a3c9b8a87393719f1cbc40ed63c5834979f49346d31072c4d354c612ab4db9bf7f16e7c15d6802c9ea507d8c46af75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\274d1d1f915fafc8567179954271fe742319fe99\index.txt

Filesize
160B

MD5
d9ffe1895706b0b5383d01f8273e1b24

SHA1
8216ab3b5fde32ecb92d8dc970d40d9bc3c19d5c

SHA256
a9a0ce26f0f6b4575b53a29627c11e0b0f377bb4d8d57a305cbd5abf151f13ff

SHA512
5a01c806efacc8b1d9714ad7bbbd29fb1843409bba95a576f5083e1d71a1798216e28048e35ed803427801fa485f1cd362af94b758c5a08443497d83795561e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\274d1d1f915fafc8567179954271fe742319fe99\index.txt

Filesize
153B

MD5
07eb21238792800647814b2cc944b884

SHA1
462aa4114835fee43cf024a3ca9720c116d7f1e6

SHA256
aeda37faf8c0028b5859c739acfa41b2b5775330cb343e78b88a8b468941de34

SHA512
4f37d9a434b17e7f363209e62fc680d1f963fc52145b5eae570c4c0547c8d77a21d2b56a0d5e103f00c346146acf3b4bb376fd59555e6486bedbc2aa8347d938

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\274d1d1f915fafc8567179954271fe742319fe99\index.txt~RFe57ea60.TMP

Filesize
94B

MD5
50a39e2985241a3cbcdd4f4dc9291665

SHA1
68be9a65b12f72e1bc55e8f4b6b155546d9706de

SHA256
2f61d10549d3db7caffa73e497d208d5737e765810de0030831b04cec762642b

SHA512
c8aa55fa674c06354fd4f781d13fbff005b653a5ca1f2b71ae30a2cf5e4b343c51d4442eacebe961c89de77e18b69c50dd7460e35ed36fe481cfd3777fb97a16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
21dbe47a910e0aa82738858e3bd0fa06

SHA1
6f4f1bc57703f98767cf6dad652759c30e4bbc5a

SHA256
3c21a6f079225ab82c23c622e9f401dce9c8985df4a91f9efee205853bd7bef3

SHA512
53903b87e44e612a9355cac27f5fe23fd2c8256033b369743a64e1b7c9ccf2505f8c0fe5cd104cd414e1ec52fa3b1ecfce5ee50782c367a7f3712715cb7cdf2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582834.TMP

Filesize
1KB

MD5
50f917989177f3198c0fd810defe6341

SHA1
f9c76264f7efe85446579dbdab005fae2b867aa3

SHA256
f369738855d0606b7c372f9886014917feef6c2c55c3247119ff47b479036042

SHA512
543e64722ade8127698e39a96ac7fc248e3ea4c31b5c65ad6c406ac25712b4df8b215b91fdb8f3f049571dd5fe5efd2692c04f8f5730e6c70b7a8fb07f4f0e65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2ef84b08365062a3b25c2c942fa28ea0

SHA1
cdfcc71fe99717fdb3d6d71ca6bde230c56f0ad9

SHA256
5c7443a77813d2ebbb60454499f3f92394c493049454f70264090f727e6593c4

SHA512
6de57faf171aec5f58cd2095dd12627a3428213e82279713386f5897f27c34bf08fe62f74db9c8a3166a65b54b9e861451980f521384c47ecb31f4e386fe1742

Download Submit