97a9503962a8f7ce96bda4cd45c388f7261e8537deca5366b3e27739ae0b9a0c

Analysis

max time kernel
1778s
max time network
1794s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 17:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

download.jpg
Size

9KB
MD5

f037317a62ce3e1ffa38373ca519890e
SHA1

0813ab36fc372ac0a7d93e062abe9bf0b4271dfb
SHA256

97a9503962a8f7ce96bda4cd45c388f7261e8537deca5366b3e27739ae0b9a0c
SHA512

5b0e018fb1f87509514797503a8fbe571c2f39db53d27d5f62d3de8590b15f7af380719dfb4d5cebc6b8d50e86b80c9f99ecff497494bf6f28f28759f8ed119b
SSDEEP

192:HW4Xhl1fd3RE/UBgwF5re+1AMd1UT7jlfc0TlSobO:HWc1fcMBlF5lHd1sjl00TlzK

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
92	discord.com
93	discord.com
94	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1168293393-3419776239-306423207-1000\{CF929E87-83D1-44DA-9BDA-E16723492339}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1568	msedge.exe
1568	msedge.exe
3076	identity_helper.exe
3076	identity_helper.exe
2972	msedge.exe
2972	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	888	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	888	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 2348	1568	msedge.exe	102
PID 1568 wrote to memory of 2348	1568	msedge.exe	102
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 3816	1568	msedge.exe	103
PID 1568 wrote to memory of 1396	1568	msedge.exe	104
PID 1568 wrote to memory of 1396	1568	msedge.exe	104
PID 1568 wrote to memory of 1976	1568	msedge.exe	105
PID 1568 wrote to memory of 1976	1568	msedge.exe	105
PID 1568 wrote to memory of 1976	1568	msedge.exe	105
PID 1568 wrote to memory of 1976	1568	msedge.exe	105
PID 1568 wrote to memory of 1976	1568	msedge.exe	105
PID 1568 wrote to memory of 1976	1568	msedge.exe	105
PID 1568 wrote to memory of 1976	1568	msedge.exe	105
PID 1568 wrote to memory of 1976	1568	msedge.exe	105
PID 1568 wrote to memory of 1976	1568	msedge.exe	105
PID 1568 wrote to memory of 1976	1568	msedge.exe	105
PID 1568 wrote to memory of 1976	1568	msedge.exe	105
PID 1568 wrote to memory of 1976	1568	msedge.exe	105
PID 1568 wrote to memory of 1976	1568	msedge.exe	105
PID 1568 wrote to memory of 1976	1568	msedge.exe	105
PID 1568 wrote to memory of 1976	1568	msedge.exe	105
PID 1568 wrote to memory of 1976	1568	msedge.exe	105
PID 1568 wrote to memory of 1976	1568	msedge.exe	105
PID 1568 wrote to memory of 1976	1568	msedge.exe	105
PID 1568 wrote to memory of 1976	1568	msedge.exe	105
PID 1568 wrote to memory of 1976	1568	msedge.exe	105

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\download.jpg
1⤵
PID:2204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9e9b046f8,0x7ff9e9b04708,0x7ff9e9b04718
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2804 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,11871371977129096917,6818984538910065913,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4712

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x370 0x4f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e71d66ce903fcba6050e4b99b624fa7

SHA1
139d274762405b422eab698da8cc85f405922de5

SHA256
53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3

SHA512
17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
04bf3600fd53c91324ecaefc0bd0e87b

SHA1
a068f1ff9d945bf7fb9ddfeac462103662fd4911

SHA256
3caffe56e412cbfb9ebeb41785b35da677f4d1e2327fe90751e360ed9acfcbf9

SHA512
b34f4eb5e53e8bbbb236b33069f476a4630ee78d7d3fd1cf39c24fa62133ed4f6afeffb86c64766babe3a6be9854a5f0f8d84ea4b2b354a2ea92013c6caf8cb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
8dd439a197fb898d9113b4e67def9ee0

SHA1
c5076089fef934c9e39588fde4ac85ed6235e92f

SHA256
35d84054e168b78f91355c716b957172e0534f522248b9049e212f86f4fd6e59

SHA512
ef6b74709779517edb8200fd4461c7c2c0450d1d362fe7ee4cc330aacfd4848d20ede6c0c9837500299ab8e3b49c703655a9cf389cc7691b6a93be282b85f0eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
095d90c8ab60ceeda4830c32c02fcf1b

SHA1
9d04e566774b1677b8f04d05257204fec6dafd03

SHA256
37b9af58f7991bfbf27ecf4c2c4bc65def42c2139004f3b4cb9546918f3d783b

SHA512
5913970ed6bfa548ec73e46f2814f222a5f1de2324e9cabfc5c20a5d793ecc1d94746d93a4bb24bd3808da86fa3c7cf11f935b1a576d4b45922c1fc76ebf1af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
80b2147b537ca2b0572f90bd8db455ec

SHA1
f40089902484e35dc859cececbeceb4d7f93412b

SHA256
38f52d383d811c5c583775eeb8c2bc53ff075b707416e78644bcae53435845d3

SHA512
a9d534af6941ea3a465346001d01bf3554d51bd2ccd336a82ad14c9ecd60ee2b2d4c757bb62cfe43d3cc64d3f9cd33de07dbdfd5e5b99c3392c9c522970c8254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9c73ab23e991d4c175613156ba8a419e

SHA1
2c752abeb50dc045b323a82df698c62dac5c7ac3

SHA256
b4a0a88a771c618758d77a0b8c4888cd25c63ac55238c4b6db65b1a2eb5ce6fc

SHA512
c13677283ad3bcdaa111e21944c439e515b516760246f3c5cfa7e8bf7f680bd7b460962b8f99188f26e171de933225a70d131ca15649e6e0e3936a8a73946b4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
443964da78f7a90320f4f13dc21a9c9d

SHA1
34a88c78a7ff56add4968963fc0d3793158d8960

SHA256
2cb61054d77b9cbd2ab35d065d1fd8b52844dac6e18e4627d69fe9c3261fda3a

SHA512
d26684e9280780c1b9e0e778750a874c121e7f1eac06e3faf6ca015680f2e20c618dc708fc8899378eddc0a755222c54a034eaf001c5e09a9f81847fb4edd41f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
bf85631478b503d7aaad50225cfb16b8

SHA1
d39d43bc4e184b9c763270c68e2faf5928cb2b08

SHA256
431f583cd5f3631410d135a27a51590e36769082cf52d70c82833db771f2afcb

SHA512
f23c515bf32a685765ad1f3971c91385e1c6c09fdac9a9e3cf866032f76a7a7d516fd777b19a9cfe2e03794ea1a4b08cdcccba39015c2cda1f9305cf96bb2cf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
171324464bc502ac97ce2887fcf7944c

SHA1
6968e435fca0ee2cb4c33f88e16fa8d94ce94071

SHA256
78f5dbea677b73bea444a7e675671550f5937587aaef34e5b531c4151a7c66c2

SHA512
723be9ae1cfbb92e429f1e579ace0c52b9fc14d823fe84df6aad79f7e2a62da67009b34cdc765a7516d53295dbfc0cf4032d7276077df398285c8257b196b389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
90d652f4a65b852e6fdefcd34d8b6358

SHA1
3abe18ca3727d4b572db03dd206d0cd286e3e5e8

SHA256
52b957c018a26fb265e45dcfac1e86c33dbcd036b1d984cc07d6a3158583d29d

SHA512
24920f72ab61fb33e18493b2b014ceeda259cd52e8a643405864f3436d74c3006bec4d36b686b9e803ca50db014a3145dfb439da8bf0d799ba794c8bc57da886

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f080c449bf4c7203360220d6052e34ed

SHA1
150281f43158eaba55d1193d39ddce662312de18

SHA256
50dcf4c762bf93e56e297fcb4f7d12b1a924b6bd90a84e36c68f843d881dfa7e

SHA512
301a104b958babe578a4b489473bea198a173bb9a0e0b6244890420cfe935aa7828e2f5805e1d81d5e107e578db310dce760d9f7e42f25ae25e5bada96695f00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c79b36a3ce674fda895c9b133a3dc368

SHA1
aa0a9bd6f02c5a36e67b4322a38c46faeae15c45

SHA256
224318250aad32d384db2b7e4c66887ff46289e42e345a07cf8c2cfb55147406

SHA512
8ab6e5f1c69ce633c25a280565e7a3859040aa943e03eedaab66267be3cafdc97bd90c65ba360c38ceb2d9303f0af8c1b174b5cc353ed1fa25c4b2bc0cd0adef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ca4d235f83db65471dfbaa7cf26259b9

SHA1
aaed323f05e339abddc4c4df734b29acfd12d637

SHA256
ae6157088bbdc6c7baaef773fbd4552f0b4c0da45480b5eff245f02dbab152a5

SHA512
5f5b5f0b5708ce700af006e3ee29eb704d93a8142bc42722e6996fda020fdba24aed972b76771a130bd17184fa905b073ce10b82850f8efd302a7b3ffb164daf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a6b897fddd997cfd14c7d70716766780

SHA1
ab48357a0d88c9aeb19d5df9866b753ddfdd9fca

SHA256
672b806fdcfe651ec5cabcb3dc1481b4e6a8b4efffb2a4ebf76639aff7cc29f6

SHA512
65ac4c7716f66131e29dc0266ea61f0ad04c010be9fdd0f9ce277b96ab5a5febe7d86ed6740b51b474893941b4106412d2527b80b437249520cc7c0a279c4009

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
57e89271f3c234f48fc9466fdaef6d40

SHA1
46c2e9eb375171bdf7db63e85775956961b75022

SHA256
68ff97d38cdb548cd01c13da6300040d04a6f047ef1ce5817daa0c9b0043856a

SHA512
767178e936d3f731990609b881d47ae67e09f00ae7b2b114e89f30ac50fa5432aff14131e6a122b14a6177a9767f093d67c4521558490868f8765246ed292b54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c295ca6d2a3f2b6ab5004a829d91cad4

SHA1
baf7817742960d7fc9864e68860e217e0b303c72

SHA256
d0f2fc6736a801a1e53e54bcf14deaff0cfaa915468da5a23297f32ad4b5fb16

SHA512
804fea14dd54147d82e90ca31d66ed9ddb0b470cc91b63251c39b8992f4950554d2e96d43673dcac3672528fd6118f80ffc1ef296d7b9f80a50ccb2acc0efdaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1b1b142e24215f033793d1311e24f6e6

SHA1
74e23cffbf03f3f0c430e6f4481e740c55a48587

SHA256
3dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1

SHA512
a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2f854c650b831d172bfca81d701036d5

SHA1
eee6b47a6ac7fce095903c1766e8b74f7e77d51c

SHA256
0ae30d84e87d1dba15b9f82bc099f40d2a7becdc6014e587106556c078d5c9ef

SHA512
5b77e8896483fa47ea7c5664e9a7a61980beea673661fa3d103b9083f5013c6da73598a7f0b3554d62b85b5ab25d5222c4b3331e4a39d85a387e4d7e79e47ff3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
49ddc626cb48da57b7fdc11ed7179e21

SHA1
ed8c5c89aace7b30d0496db9161a9556e248610f

SHA256
008310a3c83a88babe5894719ad8911d16a388ff44024a509dfac815fbc5f4ff

SHA512
a0fb5d56bad89e3167e000eb581d280a513e069098da61c40af7944ee8a1b1efc3fab8c764b3447afb566708d9f8b3f93bf1f79ee972eff2602edbfa7f43e1cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
88e2b8afff8260f3ff22b2d1f8330b6a

SHA1
b1ccacda556a56e8136f239a697aad7cda4680e2

SHA256
e34f321b5a74982309ee8e0af991ade93b72af2dbfbb659889ab1c8e3bdeaaf1

SHA512
e1d7c2c1dfde39526613c28749ee7113951dcd66a5b9b4f6b4eec0b12668b2f91a0c0c288030b84fb14fbb69a0957b9284095eb01170e76b1b4f75f854a3b456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1312e88366c7dc7394f531640bd65738

SHA1
6ff0f67bb104c605580656d3c5f09d73f4a36dcf

SHA256
27bc3a476faa53e7b0ae62a544a4ad63e954c241cdc801eb695edf509b6c2bdb

SHA512
570d9c439f2fd66dc753b809ae2e64e754f7828f03180b556ec387df8653bb8229cafdb514d1c1805318baeb35c22fe04562aaa2b916951c9bf5a4f37f307fe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dd7dce58fee2e4719ceeccdff5fe307d

SHA1
abb49a6286c9f29ec85fe4fa8cb8f2881a661bd7

SHA256
62fdaa81e4bab3df7e37ab22f6567edbdfd4b787f80b2665a36d2ea5a89623a5

SHA512
e66c636a4328c1468cf32f54e99a162ba496e090fe0ec4e790e2671fad8594d807239835c384decc3f16d3390ae49eaaf3bfbab6467ac4337c9f1c02f13663f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f969f88f83b73a5a2e1a445d5376d03d

SHA1
2ea88ea12737057fcf028d11486f834eb36ebc76

SHA256
dee2702f31a2ea86a5a1e5d11028a017697cc953a5f16f48a99abc41e56da505

SHA512
911c661377b665d0080c699ae3876c7e936affde054123842ceae5436fc6f27ce484852d1ee266564aecc9bd3234f9fcaea34c2552dde7752b4aa408b30f3518

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7e328ea0b2bafdb185d8ae792a4fe116

SHA1
69febe1b8428ef0c9fa94a026543bc1034f17ef0

SHA256
940ab379ba485e7f7f7bf592d39603528dde76304db51cc5bf8e5a8a65490213

SHA512
2dced831fca30375ec5aeabdefa95bd8934901aa9aba4e44edfe0e681b7f14200366371854ddbce1698b5ff69003549b3a197d00fbc57e5457ca70f2e9cc7973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bf7f14bd7c289593fe96109c87d52303

SHA1
5937a7b388ff48dc0353358fb383a38df7eb6e90

SHA256
4b5b09a2a38ab90b125b8bcfa06238473334af1cc33e7fa957108e65d147fb71

SHA512
18db1f63d628e95019166832922723ad20cb56ce032a8505daa36d235153659efc7a8a32cbba9fa4f202e68c69de51b07e7b12a70982964301bbd3c3d0d8780d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
71c32dd1e22f1115afa608b791e56e95

SHA1
0c9973e772d9df8bd8e7b03b7b240724a277376a

SHA256
ca9daf3ec3d447a4b6ec9a954185c33e7be82ba3ff8bd7296f67f58e0f7e1b6c

SHA512
cb89ba0a35e92c8c8eb94e67dc663253e4433ec29c2264560887aa326b7ca59c194a4a5abccaa583fed25f026e00ff2044c155b94dd523b4f584ac017896f53a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
36a69763662dc9d7f67c429b6e3a1a03

SHA1
276e100a00d690655d8e06c752554c44dccfe3e1

SHA256
898dfa475090c1d095ca20066def0fb11b2baef30f9b7d0373bcced59ad96d30

SHA512
042c6b3f1feead975ab8d0798765f305ddba750d863be26c24e40e7a1314d2d95c7f1fc4caade787bc2a887a12e4bc49c0985f6bedf777806342be8ace399db0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cf4b804a6e4b8bbbbeb4127c97acd405

SHA1
2195cc5a6e5bb2c998aa856272e176e85d26c27b

SHA256
b221b01238d0d21997ace83776e24161a54b20a9b15d6e6312ba54706cca7c75

SHA512
668a1cd1c68a8a4480d27e12bbfae990a679056e7d3d9f4b7e3c5eef1ebd4d2f4121fcf28341ac173d55527f9b8ffb4884cc1bfad524bd115b265fb9ddaf3556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c0b5aa65271e147b8511d9e676862abb

SHA1
7d99f0369034867dd6dcab4fcf9adb9aea1dec8b

SHA256
d53134f8199aad61e3da2fc8bde83f3316ba0c112e25f08487c7adb55170a379

SHA512
d3e081a5046671222c336878aa6e6fd6194b29012c3db79816ba2785c91f54a5dadf4c68eb02235b9a21e8e32fbdf26cc442bb68b4ad53855380762a1d5b02ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
12013fd089998f9393a59920775eb4f4

SHA1
4c3353e09a4ed9b11d4712fd5b123314371a3211

SHA256
60f66ead1423e62ad4573ea27aeb72fe27379c3125aad4993c700bbb08557a7e

SHA512
40ac47fadeedb3731f121c38c3bd71e3e928059ae8f72456359db683f60e555808d76acf91dc5394dfc1d8450f0796c27bc5efe2e051e308567e572e330f6854

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bb1d197e17cf595c7e0927881798d9a3

SHA1
2f84019eb2cdabe6b27d7d2cbb778f432f901a1d

SHA256
b3293079994df26b2f3832ad3b6735640125a281bf1cf97a56603758aae16064

SHA512
3afd7911952545a6feb20fe99933f907296c9ec93adbe354597f29f6db24fbb9271c3a178d37971e9dd07a5767d356144ce0b0294e21b55c7cb88101a17ffd07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8fb9ed04267bb8773b084c394621f227

SHA1
95b689374f9e8e7a4a289fc78d2ef7d57715662c

SHA256
e0d50ae20a5a05a7f03399c2b9672ce5df6adfe18fe482e2e90b73d2df1370a9

SHA512
5aa49c06b7633f7a2825a31076142cf3ae2aef35db8fc5863850472a6ff45dd99d38ffbad4221eb188147aacd58cca37f505315afd2a5e1a0a263bb2304995fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
edcf0ed08c998115bd9170c4232e160d

SHA1
57cece87ab2942ba22e5770bd5bd40a745a753c6

SHA256
df634a3a512d5e971633f7a0b7c22dec50b6c429a3341a6267299de31cc3a7d9

SHA512
fb05d679968b8b295110457144bcc6ca69c202d224633dc947b9c0cd9b9529aaadd23d44995528fbdfab2840e57463bbbf6008aaec905c6718bae235ba9b9348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f8505339ce6b5ec3095f2ca928e24f02

SHA1
1236d5a669c077ea3b28fbaa8d46dd6dcff96d73

SHA256
febc196a606c3b96d4fb1291ea6a2733df60c028acbd4768c55ac55dd2cd419c

SHA512
bfee112a55d72df025424dbd9a0f9cd3afcb4de584171199d675a750ed3292c72d67f3a0e06f931b789a76eb273ef51f20e1cfc5b8e7902fc5c8403f385786dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ce94c5a643e6d8200378fa89873b9f85

SHA1
240bad7e5622ec4f27057b46076d19c2cde00ad9

SHA256
bd7d3d9f95adb718163ec618454e54fc70ecba56c4c206e6566c3403e920bea5

SHA512
fd02a11568631094dce9214e8e08d101c5304ecce729ce8a9427122725071e55beae79fb19938d1c378447141d448976a86974d9c794b44d9d39d4a01158b4f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f181c6ee9761cfac7e346d7f7bd9ea45

SHA1
628a6dad4edf83671ba51ae269d0bd3ef8ad2dfb

SHA256
88b0eec1db690450cb612cf02fefe0737ec5041a726031d6501143ff2eec12c9

SHA512
6505899960eda892727a0d58a0159b710fd2ee8b446388f8638a0139b8e652a34c4f895d40ec1235f59ca323f4bee0626afdbdc723ff30a132ff3408e73d4624

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
338e95cb4aa5e580ab3fcaa33e674749

SHA1
cf2f9851cbe2150d5539e502e410a35ccbd76b42

SHA256
d46d7a59e5bc976a2ad33ac4e1c1f354f8bea5b87910680fb8a0648df867a699

SHA512
fe29938797aefabd73f6163dc51db4607848b4a4ca3f8455a9e81729a9fa8532e8a7d9a79103c2f6575126e77228fbf24a49c0047f73ea6073c9093f663c49f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0d246f2063d4de4f28837483e0d0955b

SHA1
daf1e32b47c11a4c20d7d3fed50481244f82807f

SHA256
eb19660c59ab8fd195515156d87b706bc9bf874b2995674c98aaa48ee0fdbdf0

SHA512
9f878247d753631078b07d071352a0f20b0c3c214d8ccc3e7a91319cfab978f38bec282a5ec15b26391a397c5f56a09cf9505b672b631459d50124b0f6196e6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6f8645e5d58e2fa5b1bd20d3ddb1f064

SHA1
a5b3374420b67e715ba61fb4f179631ed7bff244

SHA256
7bf94fc16f7ce8b425b91dff59d4961e8e23d59ac634bfd6c48359dfdfbcd106

SHA512
13a2014e34590936c9e8a709ee56c07252ec8fef16be81169ab50c5b15e8646d8dd22748ac50e3f4811cbc8b92441ef054621ae98e9092ea0a22551e9a621775

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1856a450eef18652c6192d453dc21446

SHA1
47dd67729100bdefb3132f4932cf6a01ab478ed9

SHA256
f3cf2994cf676e0fdf57d4cb5cdc1bae3b283ebbbcba7063ccd3e6fb5ca93f45

SHA512
1a05e1959c70c63fe74092086bdc0b1d7aefa4b8705bac51f77dd0176ae663396b282c4c042b1e313b9eeb05e4c1282d6738fac9b2b61df89df070bba58c8d4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
84f2331a1ed6bd618a77f6b1b95b32e6

SHA1
b188314ae17d48ff097f25e3e199865baf8f114b

SHA256
4273cb85016c1796af60162209c679d797121010d35048245d3009808bb64c54

SHA512
92235b234cb76f9a5131c93affa5769f50e7c7557c8517710dbd1f15a7474db14cd5a693baa77f07b9971a735ef4b0d3cc55c022a9599c7688d2754cc265efdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6455e0c6e0516a3576acfea9411d7692

SHA1
8d893966d25c27c4b4746f1b36a3b14c22448e2e

SHA256
fb2be93f3161eee0d6d9b0390d868d3ce1dda837eb33720af3db889cfef1822b

SHA512
28becef7bb3e463e904bb75f533ea51182f7b9af683c347c840c0f341c6aaf32af5a7c85538730874cded4652ded95cefc5699ef3fe4f0ccab990ee86adefa7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c1b5e9b9c76ecd3ff89f68d284af1139

SHA1
10dc30a317883937f53404da2a92f925c243e052

SHA256
6e8908605eb9613647c73f1aadb043a6483ee0dbb467a86162df7b16c4f24a08

SHA512
906afb3f8f058a6589234feb0213b0359eda1c5f0259a06cf8a52a9fc46a208d40e7dbca9b63dfe0e041daf7f6b7d07d2957772ac448e9e33134821c35dc13ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5731b7a6cb98a993939518f8f55448cc

SHA1
4fc2c19f493e50703ce857246b5c65e6f450b7e4

SHA256
f3b06caf56709580b4f199a00c1160ecb35197d0c49940857b2ffc18007a9602

SHA512
8430b16a52ef6b030e75d496963493e518f4976d297710a91112342124996eed94a903ee0394c3fda5e1b38e7d3d851f36375341b0b2338317e4fb6c6de7e357

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cb6097121383309a94c3bcc2074f1f6f

SHA1
faaa358ca20ef9d2e31eeee2e274d190877cd5b8

SHA256
0dac8225ae918dd682bedd1c2deba02947942bb0802529f8b34894bee2c7a41a

SHA512
17fe8b862a0c282434541fe7b98c454ea48a547ff4f2c5d7337c4eb79a1ac16480c10d17dcc94f6ae6d70cce5551984ca3f62210852b364fe371838e0b4a1855

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ac7d6c0e1b7aeecafc300f46066fc9d3

SHA1
ad42950e64facc0c8c98e2976cc47e6b545f439d

SHA256
ccdf88ad0ae26798b5ab3ae6872a8290a8bdc745348254d074a40403e76a2ddd

SHA512
3a49b77c8eb9f0a8d55a3d9b5d20c73baf46b909e7f134896b8f570c9c6631cd79a33c53d4684376c11e1c7189dbc3c19e7180286c6e249c039c69b8bd76b89e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5d55a4e5deceef385e2d936d0d523ac3

SHA1
c3d0377b73bc5ffe1c4bf64553b55ee728bc2387

SHA256
f7b3228314971f50ff01b91121bb9e9bf91333363d6d4e6cc3e77fcc27c0a76c

SHA512
8af1ad7177f6c96d57ee56e1f340baae197a389f9a9048d7b6108e142f0b1c1e729a46b9edb62764f346d9f759ba5a3c7758351e76c156537ab6bf579a7a7294

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f9ea84d521005ecba60a1a107d16a734

SHA1
a63a220532522046cf310fc485c3030fde781059

SHA256
39773791378bd34d9828fa9c41432ba5e588c7401d3e4d1751f30d39411f8c22

SHA512
4101a3d35e6b673cecac6e4d8c06f398900f62918cc904f4fc73c9be193765d3f30ed02d764ed44fc54928871466e381a70f94bc4000b8f9784e6c99a3fcf5b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5b62685196b11851170ab4c03f3221ce

SHA1
a111b8b100ac18873d3156df3fc424755e805529

SHA256
36684e60cc577f94896cfdcbff52e8a5e50b93df55250bc1d4d8c28f4d260465

SHA512
822155b3c8345f6ed438006dbda62f17494707341d188eed327c3bb438bc4ee0c5ef1016e16e32eebd08149c0222687f9a1f9019b4d392cf3a412084a94f9727

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
39b7967a12589e8500fc13e64ddf321a

SHA1
35bc49df012cf81eba89afc2ce9848a1a1a32ef1

SHA256
068a03f3fc25da34a8a6eb74ec29514f4fdc50a3ed5e05a81bb2187a5a77295c

SHA512
8038df2beb96ba860250feb310bfde933dce3881a13a07e17372df49e1711ca08ab80d1b10a31b4832dd2ddeaeec40ca066a4fa0baf56e5812a399ef982d4696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e39dd1f88f9ab4d4191c5bbe9c2dfa52

SHA1
90d23b21e4b77f4280ccd2afb99f0be0e5c431c1

SHA256
bef39d28f271408342510cb1da60313cb740392c803afe9623584a31267d289d

SHA512
a8b7fd5a1b484ca8d74cc52881a519642eba27769a0b12543017cae13b6f6f27d363a077f63fe857420260d357c218b7a63e17488950119e127f447d24ef9182

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e9aba2d4fa65eb4181258ad97bb2eb05

SHA1
5dc89ecb592d4396cb71a0bd1fa5481c26be9b62

SHA256
c9cb0c8ad3fb512c852fd1675a3c1de4f7626d39b6d0cd6497ec7751afdb4610

SHA512
3859b468c4095c40a51b498f0863141bc5474c75da76a6a632a0a474003f0ce52735ed522aa8ef4c825b8ca688f2a44b48baf8dcf0aa3f6ba11fdf1d99f0bb38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
929cbabf906dab226bedcac7d1cd87f5

SHA1
872581e5b56f059d097ff3b217f37c93273930a7

SHA256
bd8fb8441bec3bbde2fac184adc3798fecb6ea359f02228d18000a75d217d9df

SHA512
e7c07005069de475b2a473c9e0eda7ab148a6763156b8444fd5ea9813c2be2181d46da69827e9d493ac7b20c69c9a8eeadb2c71cb14adf0ed599cc1ee9dff08a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
63053596228dbf6ae09e060f64a699dd

SHA1
5201357e0c15ad5983b8913718bf02a42b51fbcf

SHA256
056dae2f07bba470c265cbd2109d8cc43a5d1fdde6c11819f6040506fa177e2f

SHA512
27d29c01b2226e14cb31097d57ac7f45e6e77cd689ed271cdb0014694ea40ea1997eba054a0702f7cb3162a93046d63e438a20033eac34bbb0eab6499698a7c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
135046a63e5b31468aa3efcbdb015b52

SHA1
f27acbfe6c9f70be37327254624b228942f35191

SHA256
fa8ed9ad3f3c6e4fe12c1e4e9fa50c4f20b1ca5aba602ce2979ab146edbe4b35

SHA512
89cb3ab5773af3bf7af2edcf496718d983cdfd817907dea5bb76ec4d6b823916ceff28b734fd2ccebe7e2d48f9a31502d1d5fd2c71bcd7274d0d301f62a9e4dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
caf61df7c85369b99ab4a91d43849649

SHA1
75a45274c41f8e8cd26d0504e4912fc5b6f65c05

SHA256
a356c9bfb10d6e5e250ad8d43d3ddd67c9d6b885c34e8b1782497c77dfeec556

SHA512
09f949b41c8d69a71dc27ff9a88a1fb4d5b2189eb5c069450b833b9cda660739a395c993cff26b5cd7df6bf6f99474fa9285ac056b94732db0d89805bbd7c58f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
71fd2944b7b3099b0310b194c9507eb8

SHA1
a85928a22269e9cc1bc184ec69c6bd8aa406cf11

SHA256
e36596fd4ef2404b177aef79583503e3aacd02a2942550f8c019453e02634ee2

SHA512
dea50708d25b34e5164aecaea189d5034bda5b891c5a35bb8aedc0c1f61428e6d2b7b70e0504e7d96ebbfda656fa3aadf07edda1e0682d6b2ae88ea5ae28f2d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0e65fb310357f101199b80aae991d0ba

SHA1
23da506a2beeab0d06ca7378cd08f133de441333

SHA256
18dd8be469b005241d357f954a69a615fd56b8644f40c8ab863ba5a9d363144f

SHA512
e17c5159ff2ce4c779b910b4dbe91776dab67d998697f30383dad518c3624c341d6f39e7e9d2d35ab35382637b37c337f80e14e9dd41eba71ddd8771b0b84067

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
898551e9c3a1cd6a3ff50c071d94901e

SHA1
265c9ad5693c0180a398fb82d1a1f21a6c3a82e5

SHA256
1af07a1e3c279024271abdecd309f95800ef2c71db17625facdd044aaa697b0c

SHA512
dc28965a0797c5d82cf3fa5b8c40e08a2ec902f15d00c3baaf9aa630b370943482ea6db97b9174a720e2956604720f0014e18e6207ae3424277e60df2fdaa721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4d1dfe1bcff058d72354bf181692f6ed

SHA1
292eb860c7a9a1539c75cfee9382d26b31d7d04c

SHA256
43c901d38ece127cf2fd53a43bb3470ae5edd8362d447e134bec891a0e44051e

SHA512
84479e616beec1f0d1eb2097e215add8bafd7a21c4632bb5abb0850d5069619cade4b902718aa31d6732e703e0b3bb009f2061d627843ddafaabebb3d5779145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c890f4e9540e63859577a1a082f439c3

SHA1
eef094cb77c0bdb9a98f0aecd89adfa99d92eeb1

SHA256
8b8f104b00df078e1700d1828b1ed8020aa61728b05c96b4399c8d1fd15d3fd9

SHA512
6149991816cab654a512af99584d4fdc2001ff3c820ee952ece773bed48f51108aa848907820d5314278486c28f1d77bbaccab1effd57d7b7169abc959b151d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
92b69876e175dae6594d809d86812360

SHA1
064659836ac7cd7ab45d131b79f25efe564eabf7

SHA256
7f922db7121bc3d53ed3a9865b02355b3b43b920fd1b8538d64b7c7e9c0c4041

SHA512
b2cc31e1930d013eb5835ab529f8b04ede8f6814ef415e351a94b7368ae7d3065d4ed064fa244e275211a9a8f21c15911df3e4bb1adc29875ab2982741acca42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3f2ff8b7c069d0a3941df3ef1369da49

SHA1
3e181b26b9dea94b3a0dc08f1ece61064e3433e5

SHA256
dd781f5863896ec78fba63eae8462696072b35e05821073f2cefe8ad89c72b07

SHA512
7b7d4b123896b1916d590db6d19c7be63c52fb51148be30127f31d5c785668576f17edbc8c31f224866b5865adda640febdf94a0b5a45d15a9f1264312873b22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5ac830f9dc72ae7d0493ae95fdf1854e

SHA1
5e4c2880e2d430156643bc2b2dc2bdd41edd4b8e

SHA256
aa8380944a3740905ce62c9ed7abaf9911d980b64a514f9517564e983463403f

SHA512
1ccf789f68a9221b3c588dd07153c0fb15c467df2fe287a20a4f080a055512f6e74643e3064813031c857ef62832e0a89d30512948cdb7d4e56a446502c01ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5b9111.TMP

Filesize
538B

MD5
57400e6374e91278e761ef8b96f79039

SHA1
a6daee219955e7d03056de9d4c31817c66d21003

SHA256
8ae47b6c9f5acf85dba4ef9bb7ee7a8b57f46d2f2a946614290df838cd7ac4fc

SHA512
55d006eab2541c2eb862be51178a39592c01bc51a51aabca5f9e4a54a8cebb79cc80ffb495dd5ecdfe3eedfd59974a53a454e7b6d6172f4b316ef0cd34e4f7d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cc04713a-c68d-4803-9240-71e50da35717.tmp

Filesize
2KB

MD5
d2f9967b033cbf36e4e54bf58e82fa08

SHA1
6d8ee4a98c9da775508fa957d6be8c7870c68dd4

SHA256
9617baef51ea2dae1ca8d85ada83e67abd05534d9e18794c933d58511d3ce5fe

SHA512
b5a7b36d2130d002b62f67bb02d6498dcbca918650eb46254982f67da5e444b35175754c1b4dc90a9033fbfa2d2e408ee1077b732eeda7fbe2851ef38d065937

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3c43b29a1722c41faae61f5cc522ab19

SHA1
567704b0ca5238f7d03ba210616526a673962e13

SHA256
909c6fd90efaa390a56198d2abcaf8a06aafb4762244368676e274e0db5e81fa

SHA512
66df2b047e0847ba09d795dff7a67b6ea712002459573004e6edadbed80a28e2db4b8ef9abbc34560e59836499868228908468f17b34687ca69e389f5e844dd5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit