discordrat | hxxps://www[.]upload[.]ee/files/16338433/Password_123[.]zip[.]html

Analysis

max time kernel
1764s
max time network
1768s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
01-03-2024 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.upload.ee/files/16338433/Password_123.zip.html

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIxMzAyMTg5MDU1MDA0MjY2Ng.GSmB4g.z7mEl4nRyHZl4zLjxgwZ_ERwgZQJEakPOZ1N4I
server_id
1213023729379053639

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
92	discord.com
94	discord.com
96	discord.com
97	discord.com
98	discord.com
1	discord.com

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3594324687-1993884830-4019639329-1000\{785DFD3A-B265-432B-A6C9-01572FF3B027}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Password_123.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
3576	msedge.exe
3576	msedge.exe
3948	msedge.exe
3948	msedge.exe
4732	identity_helper.exe
4732	identity_helper.exe
588	msedge.exe
588	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3748	msedge.exe
3748	msedge.exe
2044	msedge.exe
2044	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
4384	msedge.exe
4384	msedge.exe
3356	identity_helper.exe
3356	identity_helper.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 38 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4128	Electron V3.exe
Token: 33	1820	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1820	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 3064	3576	msedge.exe	80
PID 3576 wrote to memory of 3064	3576	msedge.exe	80
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 2916	3576	msedge.exe	81
PID 3576 wrote to memory of 1536	3576	msedge.exe	82
PID 3576 wrote to memory of 1536	3576	msedge.exe	82
PID 3576 wrote to memory of 4368	3576	msedge.exe	83
PID 3576 wrote to memory of 4368	3576	msedge.exe	83
PID 3576 wrote to memory of 4368	3576	msedge.exe	83
PID 3576 wrote to memory of 4368	3576	msedge.exe	83
PID 3576 wrote to memory of 4368	3576	msedge.exe	83
PID 3576 wrote to memory of 4368	3576	msedge.exe	83
PID 3576 wrote to memory of 4368	3576	msedge.exe	83
PID 3576 wrote to memory of 4368	3576	msedge.exe	83
PID 3576 wrote to memory of 4368	3576	msedge.exe	83
PID 3576 wrote to memory of 4368	3576	msedge.exe	83
PID 3576 wrote to memory of 4368	3576	msedge.exe	83
PID 3576 wrote to memory of 4368	3576	msedge.exe	83
PID 3576 wrote to memory of 4368	3576	msedge.exe	83
PID 3576 wrote to memory of 4368	3576	msedge.exe	83
PID 3576 wrote to memory of 4368	3576	msedge.exe	83
PID 3576 wrote to memory of 4368	3576	msedge.exe	83
PID 3576 wrote to memory of 4368	3576	msedge.exe	83
PID 3576 wrote to memory of 4368	3576	msedge.exe	83
PID 3576 wrote to memory of 4368	3576	msedge.exe	83
PID 3576 wrote to memory of 4368	3576	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.upload.ee/files/16338433/Password_123.zip.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa2b4d3cb8,0x7ffa2b4d3cc8,0x7ffa2b4d3cd8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1280 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4884 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1672 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1288 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2604 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7840 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,364368998655496689,6862830899278666914,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7984 /prefetch:1
  2⤵
  PID:3432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1388

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:428

C:\Users\Admin\Desktop\Electron V3.exe
"C:\Users\Admin\Desktop\Electron V3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004C0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa2b4d3cb8,0x7ffa2b4d3cc8,0x7ffa2b4d3cd8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,5496361320331899100,13561949906901537921,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,5496361320331899100,13561949906901537921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,5496361320331899100,13561949906901537921,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,5496361320331899100,13561949906901537921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,5496361320331899100,13561949906901537921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,5496361320331899100,13561949906901537921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,5496361320331899100,13561949906901537921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1960,5496361320331899100,13561949906901537921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,5496361320331899100,13561949906901537921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,5496361320331899100,13561949906901537921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,5496361320331899100,13561949906901537921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,5496361320331899100,13561949906901537921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,5496361320331899100,13561949906901537921,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5572 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bb097be8fe44902052fc1f597fc57c43

SHA1
b6c292f8e2ae0f8ab47cd6bb51c1917d1ed8b27b

SHA256
974a6baaf93295967794436709ec16fc54c234a7f3a22a69829d699dc21e7c60

SHA512
597ab5c334cba13a40e4655da6ef75f752e45fef98b426d7e17c7d21eb140cc8e4f8e109b35a5c81b56ef8a2d5394b89e76aa4be17f1580f3f507ec1f6c57731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c65e704fc47bc3d9d2c45a244bb74d76

SHA1
3e7917feebea866e0909e089e0b976b4a0947a6e

SHA256
2e5d6a5eeb72575f974d5fa3cdff7ad4d87a361399ffdd4b03f93cdbdec3a110

SHA512
36c3be0e5fbc23c5c0ad2e14cfb1cf7913bea9a5aeb83f9f6fcf5dbc52a94d8ccb370cef723b0cda82b5fba1941b6a9ff57f77ff0076a2c5cf4250711e3dd909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c3ea95e17becd26086dd59ba83b8e84

SHA1
7943b2a84dcf26240afc77459ffaaf269bfef29f

SHA256
a241c88bb86182b5998d9818e6e054d29b201b53f4f1a6b9b2ee8ba22dd238dc

SHA512
64c905e923298528783dc64450c96390dc5edbda51f553c04d88ee944b0c660b05392dc0c823d7fb47f604b04061390b285f982dfcc767c8168ccb00d7e94e21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
212KB

MD5
dccf12096bb297369451afc6db16a236

SHA1
571bc48377a985f63fc7899142a7224e24aa4c8f

SHA256
7715812d50fd87d35cbcb910abad64fcc94360346e7728011c71820c8bc73a54

SHA512
d14341f35d251ad4870d686a810feba0c1b802e552c13a050f34af51aa491645d4cad9dc72a8d664a567844d54ff758c09165e41f8cc9c9a03966dbc91efe8c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
46KB

MD5
8de2c3401fef13f5c0f8e82a2fb76354

SHA1
f208974c5f866e071c838d0407a6a72d2d1ef1e9

SHA256
3fa1c740fe39c7ac18b90935c9d64505c77ab4b95256356ffaf9c0cdee5f7643

SHA512
ce357e11fbb1ddfd15be9d2534e392799b94af0c2ce614980e3c9124e4267857989662ed2b7e46e0697d0d3ee222e259f66f5a03d0f321152cb5622f5a8bae5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
9b7e39e467ecc03b1220dbe7255fcc08

SHA1
52007932299d495c0fd5fad145368f549abbabaa

SHA256
bb51454eb44469ccbdd364b5a5d26c12a534405f664fb9321e9e960189f2709f

SHA512
5339fa8aa53b4e87d9c841e07206128af7385b16148d316d774b2f64ae7ecef396810575a885965b49e71d199958932b6e98f224dcb2a16f2b66a693235a1ed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
d1616daca07d2d7a09f65ffc5e2c579a

SHA1
7bf0b862e72ace37d59d4228ca12a6d141f4b067

SHA256
9d853988b93d60493f38441726f809a246b719293a40b69c2c67845d56409d66

SHA512
ab729e36631a80ba06ff339d3e2ac591fff3db7913ea76751005fe7d53b47e6987cc210a13c57140dedca9d9450455d096b582d1d688ea0878a21775605f9fcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
faeedfe6030d0ce838c8b669ef79c324

SHA1
b125da20a5c93a7b55ed0f333fb14efd232f16cd

SHA256
ca19c4f903bd3084cb3ef918fe736cb16c7f2f63dad57d387afc30c902c73d95

SHA512
2c8d881e83cfc79ad5cfa0581b23d7a769963c05ce07fe95a257d108b0404d8988f1429a56e30687356b0a90f8deaa2bb6a45b7fca53c5640e4ce7ad34bdbc9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
44KB

MD5
4fd5b2103407d5df395f63cc7bbcf22c

SHA1
9a8618dc3250092287dc2e030413ab98f282e22b

SHA256
d2e34e16dd599bc5b17021d95e36ede8de1cb4725addc05039b6f2aa167092b5

SHA512
b28c38371b2f288d54240af533789f4ac8952fdd6ace7af5ca4910330323a74ba0f0db9f81471fe29e0805314780afb8c8c9807c3795131101ff536363548aab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
136KB

MD5
85c5725b81aa47e08e75478ebb2cef96

SHA1
4c8de0284c389b9983f40b53818e85a533751785

SHA256
4311d04f95b05c20848e3e6365aa399a08693f13feaf0276eba46ea469d34d98

SHA512
1539b7c5325215c0e472916b29b53bfa96dfcb73d776cc63556e412888d421e15ccb52c2afedec1bfdb4daf91a65c89cf9b637e85be64e3b85c9708db11b1547

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
21KB

MD5
3e4c82cd03e28b1930fd18b1c7d97d88

SHA1
4964e5d29e285520a00bbdf61a56d0fbe49e2c3c

SHA256
24c7594837728e3e22a3241e65664b3c3fbc0e75b4b132f7dc6bc66415c8373e

SHA512
cf21ebc3f0de6723594652b20280d1fd35333b8639b9a7c379faf97a6e5186a9b4be365bfbfb88f1b964fed63fb9cb4764b44be3beb37181adc58c724bd582a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
1KB

MD5
364739090ba2416071c5866172536758

SHA1
915101b3ae9e3478632bf7ecca7c649b4a180f55

SHA256
57bb3b8a2f7c68253a6e442b4922b392184ecbef705b769b3b3848362f110c31

SHA512
fc0ec2faf7970a12aac83b5e12aac413bde0256476e75c4b3f5fe82cf1bbf13e13b47c1d2490576104d8f4976c14652bd3d61dd30935a034657fef4d7af8eff6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
1e113898c38df106e1c2096af31e6795

SHA1
24a056504535b9b9f8930a36d9e314aad863ceaa

SHA256
70434316971b78719a1b00c11cb81fbe2f2eca8a28514399e7b6ab4cd4a0004c

SHA512
c3b5dfb62542596da8163e578d807440b2362c3301bea455ffe4841b8add2bfd1d52871ef66a2f1417ffc1d43871afa5920457f05d863f39b7a18cc1716e2a07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Media History

Filesize
76KB

MD5
2fae26afa0b1a9539dd139082a5b166d

SHA1
253df26310247a84dd7b3d7d141f0d77bee4ce08

SHA256
4d299448df2a08c07f495aa8388471939169f607b2bb4ea6d53274835230220c

SHA512
c33b071bad9053fd7cb538e5f706e0fa66536272a15dd07b27b2f194ba146ddf35ab7290d94ad7045b214f8207a6b470f994c5d5eedd5ee093ee5dbaace9ef85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
74af0a22d1453a9388e609df702c4fd8

SHA1
4b90a28d1a504d94f00be558ce447808404cfde9

SHA256
b04f7f4392f0a0f41c4dbd6ba3f47cd77e8dc1a196106f7567519be0e64c64e4

SHA512
cfb172fd329cfdb430f3a9b2ee834d8cd0fb87799a518c0993d5d6771b7104f97abcad177d85bf0a0bc2c823fe4640fb94de626b5783202c0da6d59e7bde192d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9af9af52c71bf8a563e0f853ca421180

SHA1
5a895e6236c230539ef0bf93191ac8f1bf59727c

SHA256
c3c662efccd6a838f05b47050d4908bfce8eb9949781b728bc4ed91c011921eb

SHA512
ca414d637787a08b475a82b8a0200bca8c2c008798035bc7d94ab0a055a46aba68820d44361beae5e25ffbcfc4a97f58c150ccfbb0ead3d47b0cdf5220e2db4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fdd288c4896c8ccd59371df3e5bc3c4e

SHA1
149afae941e283e116af4e3205d522d12d9acb69

SHA256
b0dbbd31bc8ac4b623c401de60b69335ce69d65ae56586a2c4ec76c6dc9e3b4b

SHA512
6aa27e5f6b25b76d99b8b37af141a47f9d047d4ae96540093c00b0fc68e180ab90312eca0361d184e1deae8035424047cc057fd3858e97b46fb9d538f1387d0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
3a6fb25631f0da26d575a373a73cd8d4

SHA1
885ab8043eceeb95799703931448dd84bc9c20e3

SHA256
cf72d87bbcbe9983264ad6f4fcd8800e9765f21fad5c3c05b6d85c749d218bf5

SHA512
5c3e0520a92885182ea6942bac7ab5652796eee32c23de6456d60c136af8cbc141ff8cf3198c76919cf8213a23fc6ae95fccc5eb9876d7705a3eb05985b21071

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
9b105e157df5478e463cb4a52e1a2c71

SHA1
894606cd01c36595c46d0caa50e6771d5b2b8c5a

SHA256
a1f70737012ee34f7b4addef74f197a22603df4beb2a21cb7883c9f4c010582f

SHA512
4374fcc129e4f6a3f754116a7bb603351d44a47ee3cb62e53c0748705369fe2cb863e9bf193da9be533debd74f1b35cf5f0472ca77378278b028fb23b508fa1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
e95df0e9ec352b2fe9e6782b695844b4

SHA1
cfad05944fdddf5db094299a867c9d4a79914296

SHA256
a000005ecb5714a5b2c376994e1f23f741e098d65c48874f45b9a41b7575cd95

SHA512
b042626f3a449c43a19e4c6c8d413684e7c321aa4b0881d207a426081978c513e602afe032420e8ab0eb8307e9301a178c1cf22ca3f10a112bcb4174c4340304

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e060d652963a6f82b72ddea78ab7954e

SHA1
1052d25109abbeb4f1c87f23d3ac580ce963bf2d

SHA256
59151f430631a0006017422ecf4d474dc05634b4f50571796127ea0533cda587

SHA512
1bc7c9a8f2ab376b4337ca56ac370ca36f2b5c4341ab984d048c022f9f413b54e7e24f5f6951971b27d5e0e502e81f14c2b50050707daa20a48a49c542e5003f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
b4f6ca73822b62a4ab6fa79f8232d78c

SHA1
bbbb5cacb0d0377ca6ac5c8e773a250ff757eecf

SHA256
b333cd6fc59444f291232ade97a9535f2ff0212ceacd60178b50eb911a4de83c

SHA512
3923787352fae140b9aab624a47505da41b6ec2e38e49e1386fa65a65454477f58a24accc38c04f526b0c624b66099c242b08ed7fc5e62ef1214bffe9821a58a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
2419f864952d47be2cdaa826c42bb923

SHA1
f0dcafc3b90995180a75ae715671693124132822

SHA256
ea4c5f27b89414b9cc1fe97b29bf868c365de3d512b7f8de65e8b35b8cca6b11

SHA512
821e04535ccdb6c0549b0841f14c3cd770bf0c80a98e97ec7686c5578588aa358e49cc26c241a85b27fb99218ccab9cef6265ec7735a923eaf61f13dd864bcd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
8bafd58695f766e0053d079e7f3e3889

SHA1
1906b42b75542fab9629cbc4e6dbe5ddcffceab0

SHA256
fe7d4ef244743b273817f940a3d5cef02ff31669749ede813c68abee38236945

SHA512
6f67cea5ee2d1472eb82acc8bcbac8947a481c20473dc76251d8db5a5b5d4ccb0046c27c8541d59352b9636099e44f980b59042d9785493058f6db4d80ad2045

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\0fd37f0d-3fdb-44d0-b4c8-9e3baf270d83\index-dir\the-real-index

Filesize
624B

MD5
d2be96debbed5951f7f0a51e9745c503

SHA1
24dfd6de6fec4b26437560cd8d02c79d04a91737

SHA256
678a8ae9af8070107adeda7036936cdca99831d280600115eee6986e12e66e2f

SHA512
a38e52a794e8e1318175c718e885a59a71f815181cf2f608728351c52e46f192326b95669cead7a2e3aef5f75aa8729534036e1990295749e0c7f4159f910981

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\0fd37f0d-3fdb-44d0-b4c8-9e3baf270d83\index-dir\the-real-index~RFe5a2d5b.TMP

Filesize
48B

MD5
1e5c116083d96cbc8048ade5db0001df

SHA1
bfc133755c2ad338b34859eb536a18c8ed08be3b

SHA256
2fe5c11dcb4a7fbd449681562c277638f4817dace7e370885892aa88a072757e

SHA512
2c35e9609153d96753f09084c6634953d5a8fc96a535513f34647c85fd9e8a9ea7e9c7ebe6b09dc64219040649627ac6d877368a7477e7d1bffd7a6af3fe757e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\45dcd440-4ba0-40bd-9d61-218b0244dbcf\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5ac980e2-2de6-4532-9667-1334e92b8eb8\index-dir\the-real-index

Filesize
2KB

MD5
3b2c5ee055b246220527383113e28095

SHA1
6340d98590407ea18cdc76afea83d6e6b6148a17

SHA256
de0961df3f8868ad0231bc66350aa4e3f3b4e0101fa500cd1e70223bdc54bb49

SHA512
f7f327f4ae1ca31bcb74bfcd6549a7c6c9fbe5b962653aea2a97c038309bc57f3799fbd535bd575aa38186ff172e6ca3108305ae527375029d3f60180db453e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5ac980e2-2de6-4532-9667-1334e92b8eb8\index-dir\the-real-index

Filesize
2KB

MD5
26726267e49a6c5158897c30d33a15a4

SHA1
0208562a1a3c789eaa929d825a9451039a51ba84

SHA256
ca3da114380108f2d55a871fbc21f0f8390df23c5dd729d67eafc6fc01d8b6e9

SHA512
1aa7f69616cb8a235e3b9b9658a6800af6ebf740d436703645f1f5b7220e661d740ad88287817f5a4c3400817f01ad56245373d12e4b54ea4b185974b7635324

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5ac980e2-2de6-4532-9667-1334e92b8eb8\index-dir\the-real-index~RFe59d70d.TMP

Filesize
48B

MD5
cdf0d433a911b9260989e96a9b5295c2

SHA1
a816a79a4cc98ba13a4716ce9adb1944fb0337da

SHA256
2294f67409cfa6bd6b96dab931bd89fa91a0274609a14c0bc2323d9ffc625014

SHA512
69b27bb6efd159293b9a41dce55bbae4ef1fd6a2c2ddf8344574193923e9f63d5936ecc0b54751431458fc2ceee3fef695bac2f10672b00514c43b42c9ee1141

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
79b85954d250e56ed4a94b7f4aeaac78

SHA1
422fc7992d4d2abf2a7cde4de97dcc37a9471a45

SHA256
464d07ddc32d5f390bc3ffb8f1e5c256af24999b7d7065db5091974ea6799684

SHA512
e0c2882a111f99c4199d902a4316c54e33744b7b4283a617ffa753cf2a60ef99e0ad9a7bc3c6fa5e087c2504aef8eb5b437370462c609279d4f1fb8db2c3d7dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
ece2eee20c046470ed8accadc1d83a24

SHA1
1128930c9d0d7b953cb88347d087a0056b59d187

SHA256
89e9f8f87321b6e230961dc886030c9a0fee586bf2cf44b52f6c07691855eb73

SHA512
906bb72397b5128421f74e9f72f577b92dc6100ebe14022327c460b58021fcfe63ceb4d652d2ebf4172278812e8c3cb5585e962fc6d86bf9729281ff09657d13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
157B

MD5
e4994f6dbe5484750ae44e5469a63a36

SHA1
a98df0cfb9a4cd6d824f812de07850b49a733e32

SHA256
605d06fbff27916084df021d39da71e11708670d2768781bd2a99f4de6121be7

SHA512
f13e4c38e6a72b6eaafcbc7ec8e1aa96d735949a6f773565c9ad0e0dfd490994bc392fe79179e11a43d1ffd876fb664bfd3f17abc169d67c391540942704d551

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
b95860221b215cade9c49863e501f532

SHA1
1615154cca073ef3f3b8ba898a6989ac776cc406

SHA256
ecf6fa94f7b9f9f6854c49d755c246562a3855997a50a766a0b18a978f036cb5

SHA512
d29c05336bf2ea503260afce3cd19cee79ced126c8496eed403f85e17590afa1a5fb7aff62affd69a129aaf56f7a68a2691c4b49450be4d542ca6a853f36ad50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
999d9b407856fd797c045fa9b23ea883

SHA1
ad19ed2c79ab4ef79105e8664e7a785e529ce2a5

SHA256
276630e9014012294a32f9077746eda0b679c65a2e87724184c54647969527aa

SHA512
3674fd6ebd1eeaf067f3da38bdb83582ecfbea6e0413983f21fe03ce87aeca082a2d46482027697059a639e3a2a8b2455ee8689a1104520d5ecf1a4779e8e2a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
c9ce958d437791d5519fa7c9c607048b

SHA1
7b301d73762d5ac600faf886166778fc75e8cf2b

SHA256
4243f6eab37d00032d9502baf8659926b78468295ab2a136c035d7f1b62b556b

SHA512
a49e61e8bda2b1fc834876539e17614c5f6335d2891ee551859a619e4fe47b011ccd7029ae403201e92841b2d2a1c5386ec88badcac2a7153036778b5a3989db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe59c932.TMP

Filesize
89B

MD5
b90bcfa396728488631b3e3b44ea5097

SHA1
0f5f99de7507b52cc8cbec58c974c7ddada75e8f

SHA256
1221bec06e0a80f844034a9e92874ea2b12e8b5374df67e785a96723eae1b6eb

SHA512
92dc558b165660058cc3c70bf8d2a584c495a16d2026567b98405cad4c2a6ae78d8e8b1191ce1d9790bba24a802450189eef07672398818a1cf4341d6ecd1319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
c4fedbe2a36c0576b231853d91e9a5e0

SHA1
9419c027782b7aad4d698e5e554b62e3113ed696

SHA256
23bcf9012ff7e03b9137b1265437c6fbb47cb50737a111c78ad4311ba2e579a3

SHA512
3e37f94f0a4f453db99e7f25ef075012b3e5133e34d2e4fd66ba61c1c86854783676b66ac5802dbf38bb6cfea1ca44e520039940fe0254c71f7b95468e0cfd30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a2992.TMP

Filesize
48B

MD5
7a1004d16ba3ca9844bd23d0f5ab0800

SHA1
41f2f35c99aed0439224c2f63a47095533eef56c

SHA256
36906a513a26f76502562b40b3137ddfddae7d419fcdfb3afd4a3c85af903672

SHA512
3dad8889760a9951579ca8ce2ab33e64f13ef10761f5a186e51ecf9cba008f3dfcddd7e7e40452b5edb21b939828e6c1df7e5356bf82ef5338e92f95cf3b0b93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13353766162154640

Filesize
50KB

MD5
0ceb48d3929e4f90ca225aecfae69584

SHA1
1a81b9f9342dc1550f5917aa5ee33d24ad06304b

SHA256
33f023531f68ab859f151653cae5e23892461084ca8a4af705ee27750569514b

SHA512
aa20280c7ebdb1e091f7914099c37f3c5b90da4e8f576dba930470de7bf7c221bf49a1562025842be58f4c82df1c2889361a4eca7f0552e9efecfee25021c35d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
259B

MD5
70f0625f7e1a944a2fe4ade00b55a000

SHA1
18e0672df465087e8a70aa8ccc2b7bb88ad83b0e

SHA256
4ca9b1b61b3c39724074b7d3d40742f401bfdf6f1829eb2535f674f095d72d41

SHA512
b4b6cdce4fae82dea8ff0672644c2e432ba8d5cc0ee60e321ee9163a4866b864771023c49086fe2a0e2de869383a15ea036ea6e41e0b0d0c53f06684fad5c5fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
763e8d2ca29e202d039f47f651ac3d6b

SHA1
338a608bedb4f3ca036c3d868755edc009f8c971

SHA256
bc3d997a68be6d9707f4c04ee6b08f4fab38632cd8548ca60554c9b0337b27bb

SHA512
d978442a71630d7e6d495176e54f8bc1f663ffa654f8ee0b424e2a8564ca1f21483d87e4dc21fe704b2825cb5d63cbb8438c329cd5e4a9497356f6db08b9d852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
b38ca4e840ee41a85451d597c49b61a1

SHA1
1f64ea5f117bd374ced507543454bd65fac9ce6b

SHA256
009482f189b1af55968763b9f059804f222a216c4315c9385e51a4d44c54e721

SHA512
ad9cdbcd02a788969ba3c93013ed494f6c13fce4237c6e884879b9aed95a26c3e5889e1e23df463c2a483fd8914798125cb9d4cdd196b88ad8c929e2c59b6479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
70a119c6c196d34e7f99e5ef6b1abd90

SHA1
e2ded1f6f28e47eddc61aec9e73b488f90f266d2

SHA256
bf625e79f1959fb818b4bb6d512718028761796f189f52ace7a32e839713b1a2

SHA512
7fc77303ee9e4d47ff0b106588a00a5ccd4f2f21954b7d9caed600676d04a97c5c4d1b2e1f21ab95e03d78ffc837a93d1ebe7abec0625d5aa19a0cfbd5d8ba08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
de62b860a335073cc6f1a8f5a3bd0e8c

SHA1
f44486c67220d750fa97187dd351cb658d835645

SHA256
a0fc8218b56ac540bf9f1c80446c79915dc875d5671019a239f4c8abf98adc27

SHA512
49670bc4747e33cbbee1b0e4a6b7455bdfed4df5cd35d058f3b6a481f16546015a74660858166f1f9d062070c11d752a3bc3bfe7c8e8b6ca2923462d4a5bd8e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2202b6f762f9a8289eac13eefa144f8e

SHA1
590ff3a5d330d7b88ea8b24f20ec24ff4892b74e

SHA256
ad09eb9aa4bcf5e44fd0716b698744aa3d39cf86e8fb50b4c824c52e6f052013

SHA512
5e40e254bd1a32ad6135247c84f2f7572624d61fb67df2afc8b7160f41516f7d252befcc01b8fb20c4891e8fe2ad385f27621533892011c8b25ef2e795670af3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5833dc.TMP

Filesize
1KB

MD5
9f01f92cc59e0c1e3f2c4e90759790dc

SHA1
4b0467976a71b2eb333100500c41770c178aaf93

SHA256
bafdad4c888c5c03b8ffa3ce6eb7acb8dfdb9c36d1219007179beffcef5e4484

SHA512
220402ead02b311c86c971f10b489bc94ad0e58f328c39214fbc2fa9c1979e2ac462437350bbdd6ad3ccc54c6e406dbc41a25a91fb3b3b687583313cf458f0e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
d8844dcb8fc33a8d54a210183c946b28

SHA1
133004163b97d1ea8f82ff4aeea7243c3f46c6b1

SHA256
11d5cf154fce38726eaf5880afc4fd11d79516f3b2113a753f4a017b9a12ca26

SHA512
cf0cd419048a890ea49beae1e9cc086fcf28a6f0f95925ab966dae6edbdb20c518828e1486dcf0e7ada0aecb96c4d8745dab7c0a73479b526f1005186e5f66b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
112KB

MD5
97cee9f13563c435e76e5043cd0aa8cf

SHA1
eaa7dd7d2c531a2fe48a365cbd20d106ce1aa564

SHA256
b5008a21dd47f46c0a4bda3942f187560d6de6d224f685213fc70572638310eb

SHA512
306ae6d6d6ff2ede49ec204dcfa9a9a182ab0bafdbff729e731674deabb189660099a3e8ac6eba358a5a9cfb85c814bb17d26c95acb84aba2d401c2e1db15600

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
88KB

MD5
ce3cf3304b9843561de2728bc058b71a

SHA1
49ce1c919b8fa09a42bac076ecbe7bdc1de03bcd

SHA256
ba4d3c2a2fccc4a77792adb9d2e5b5ccb42dfd5e58b13f81f73097639affae53

SHA512
0357b683bb99bf6c539d566ea4d1663d00b8bcc20e24f073fefeebfb24df19a540c9bcb2b9173e383fa7fb955a907d22fedb875a099dab04cf73b6d195ffe36c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0124989140d95884943483e7d1091a57

SHA1
0d5dee42c86610c478f029a3ea77e6ce182ac62f

SHA256
38a1773a30383a4afe1f7cd9229a5a626375987f750c09398e111be30abe8b79

SHA512
9580a3223bcab2a6edbe079e68567ed05430558dcedabfa2892939d423a2a1b6d04d7f3bb6d46955e7d658043603bb17f709b56c69fa4e53edacc221702501c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
67c570de192587d4614a87f0fae1b00a

SHA1
2c1d8a4618673649eb1af585eb81d1c5c22921fd

SHA256
83a73a96ebe5d27eb48e1c2160ec9cc6ae50ef27cf3e09e47649e2798c0e8b5b

SHA512
a4b11f156d5a838aaf7b4e82b570b8185ccc47584ec0600a9c61e9d166a7d0f2eeb9f0e0de50bdc683cebfa06bedac84ad4cb2464700e5881a5e8b520f91d1b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b6c3b3cb7c4d9eb7c854eb0404db361c

SHA1
f296acec704bcda10df0c6a7e54155d3f7d9b751

SHA256
e04613c570df289550c1caa53f60490a04054b131d43e21f4efa775c795670d3

SHA512
0aa53bdeb758f1e61e5a15c3f8bb1692d24d454ecf156ab8b051527358a57b01db291fc137953874b7e399cf8cc371345072a75357bc5b2eb0ba493384b2392d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
90e725292e946e0200ef3076f979121a

SHA1
da2100cbfe42b1d9fe54d97fc71e8f9d77c79787

SHA256
a21198e54764ef386d0168983bd20f7987c2a693eeaeac487f068db0f1bd2338

SHA512
d65c92478e77bf4d86290aec3f1e8443aea2e2e42f58447755b57ef2075889344c7e56e66dfc7c12db1793f524dc015483f813b65a0b7e84c17cb2d0920ba64a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
5a95996d21e3e6cc1c4726ba6fdae1bd

SHA1
742ee05849f8cbe4a46917cc6f6a93bb0eabcc23

SHA256
f038c80dfbcdcd28ba0594af9bc660e5eef31154ee53ef854f49c48ebc7e4365

SHA512
8c72f62128591fbdfebf437820cb015ad209fe65e5e9650f0e3e8a5a9ec9d9c0472efbe879146b3619e3395cf1a403ac147cbd45f29a15b909958d1f1b650935

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
13KB

MD5
b4018c83b875301172e1f639765cbb1e

SHA1
9193fb3bc8e3864014e396ffbf27b48439987ff6

SHA256
945fbf258342ae2170e54a8ac192d954ccee60e3a92d55a129316be225e5200e

SHA512
1a0fcbca2edc2b421138bf0fef0c0c97a62151791a1f0bf3ae97f95fa1634a4ee54e7dd2429ee5acfeec267726c9290f92b63034a843183d2d4d725ed64799fb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
11KB

MD5
fb6cccb994800e3d37a0bb09d2c7b8ab

SHA1
d29c76c08253f72a875dd91a1ceee90694000880

SHA256
e44869ab816ba574822fc95f9e641d68ba355d75b29f58a12b25f088935d9985

SHA512
04d01a6bf8ce64123e4f81f045e9cf061376faaa445a4b6d3cf4f1c70b3f87e3e749bc01c062679ea53367bea5bc6c3eb9478885734e3f7cf1cd61aa9272dd50

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
13KB

MD5
a83e4b88378ebbc012224c0901fbab36

SHA1
bf9511ef2c6ebcfbb54504adf5b0475faf0f6e1f

SHA256
8ae6872979c44ef6e1f44c6b67a0889fefa917fada490dff09f5667a04b33ba0

SHA512
5189aaac6e5a11288fd6b551604f327d3e51f2afb2d7b4f4aaa9db360d4289f5449e9d0971907a8970362b07de673e0d84beb07f29c78c10593e4b861a7b82c4

Download Submit
C:\Users\Admin\Downloads\Password_123.zip

Filesize
28KB

MD5
1937c2d21b0532f78d54dcb6f1d7d21b

SHA1
4e6541a1b1c1841330423798a573d51283a312c2

SHA256
fcfb47ce2a68976ff255af5ed4eeddff316f5b786fd2f932e545400079e25afc

SHA512
05e13a51ebaa3840202a0053461d3a278404e5a428a177cc8e6d4a46419b8059204316ae121a77f20631888d0b949585075362f3e5f1b5eb41a20bf27a78ee83

Download Submit
C:\Users\Admin\Downloads\Password_123.zip:Zone.Identifier

Filesize
185B

MD5
12e5d55b11abe75148c467f6d2015a76

SHA1
bde0991f8b1fba70b6b6681c2c50015626c9b946

SHA256
a9abc3dbef6ee9dcba8a520524af8e70005d813c7b6f7909b605295ffaa0a164

SHA512
e1b5c7de886c22ba5bf74d9fa99de4d3c39ef398bcd955379cb4e4ed08c84e384e9ac32bed10cb5059bebb3b63eb8b5c314d336e9f7d3a30170ba2e96b8fecfa

Download Submit
memory/4128-285-0x000001DCF3700000-0x000001DCF3710000-memory.dmp

Filesize
64KB

Download
memory/4128-259-0x000001DCF18C0000-0x000001DCF18D8000-memory.dmp

Filesize
96KB

Download
memory/4128-260-0x000001DCF3FC0000-0x000001DCF4182000-memory.dmp

Filesize
1.8MB

Download
memory/4128-261-0x00007FFA15DE0000-0x00007FFA168A2000-memory.dmp

Filesize
10.8MB

Download
memory/4128-262-0x000001DCF3700000-0x000001DCF3710000-memory.dmp

Filesize
64KB

Download
memory/4128-263-0x000001DCF46C0000-0x000001DCF4BE8000-memory.dmp

Filesize
5.2MB

Download
memory/4128-284-0x00007FFA15DE0000-0x00007FFA168A2000-memory.dmp

Filesize
10.8MB

Download
memory/4128-299-0x000001DCF4260000-0x000001DCF430A000-memory.dmp

Filesize
680KB

Download
memory/4128-300-0x000001DCF3700000-0x000001DCF3710000-memory.dmp

Filesize
64KB

Download
memory/4128-673-0x000001DCF3700000-0x000001DCF3710000-memory.dmp

Filesize
64KB

Download