hxxps://167[.]172[.]75[.]96[:]9999/themes/ws-wine/wp-content/uploads/2020/01/discover[.]png

Analysis

max time kernel
47s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://167.172.75.96:9999/themes/ws-wine/wp-content/uploads/2020/01/discover.png

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
4228	msedge.exe
4228	msedge.exe
3240	identity_helper.exe
3240	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 1412	4228	msedge.exe	89
PID 4228 wrote to memory of 1412	4228	msedge.exe	89
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 4112	4228	msedge.exe	91
PID 4228 wrote to memory of 3036	4228	msedge.exe	92
PID 4228 wrote to memory of 3036	4228	msedge.exe	92
PID 4228 wrote to memory of 1136	4228	msedge.exe	93
PID 4228 wrote to memory of 1136	4228	msedge.exe	93
PID 4228 wrote to memory of 1136	4228	msedge.exe	93
PID 4228 wrote to memory of 1136	4228	msedge.exe	93
PID 4228 wrote to memory of 1136	4228	msedge.exe	93
PID 4228 wrote to memory of 1136	4228	msedge.exe	93
PID 4228 wrote to memory of 1136	4228	msedge.exe	93
PID 4228 wrote to memory of 1136	4228	msedge.exe	93
PID 4228 wrote to memory of 1136	4228	msedge.exe	93
PID 4228 wrote to memory of 1136	4228	msedge.exe	93
PID 4228 wrote to memory of 1136	4228	msedge.exe	93
PID 4228 wrote to memory of 1136	4228	msedge.exe	93
PID 4228 wrote to memory of 1136	4228	msedge.exe	93
PID 4228 wrote to memory of 1136	4228	msedge.exe	93
PID 4228 wrote to memory of 1136	4228	msedge.exe	93
PID 4228 wrote to memory of 1136	4228	msedge.exe	93
PID 4228 wrote to memory of 1136	4228	msedge.exe	93
PID 4228 wrote to memory of 1136	4228	msedge.exe	93
PID 4228 wrote to memory of 1136	4228	msedge.exe	93
PID 4228 wrote to memory of 1136	4228	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://167.172.75.96:9999/themes/ws-wine/wp-content/uploads/2020/01/discover.png
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8425446f8,0x7ff842544708,0x7ff842544718
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,8176670710933423984,15590834637762042573,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,8176670710933423984,15590834637762042573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,8176670710933423984,15590834637762042573,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8176670710933423984,15590834637762042573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8176670710933423984,15590834637762042573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8176670710933423984,15590834637762042573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8176670710933423984,15590834637762042573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8176670710933423984,15590834637762042573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8176670710933423984,15590834637762042573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8176670710933423984,15590834637762042573,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,8176670710933423984,15590834637762042573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,8176670710933423984,15590834637762042573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8176670710933423984,15590834637762042573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8176670710933423984,15590834637762042573,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8176670710933423984,15590834637762042573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8176670710933423984,15590834637762042573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8176670710933423984,15590834637762042573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1908,8176670710933423984,15590834637762042573,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:4336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5052

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3dc 0x338
1⤵
PID:4652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
ecf66f758d447b1f8e996698a6ad467b

SHA1
eb21697baef219f8aa37e49f5c0b83eaf2a05453

SHA256
e6b0631fa37a3d2e738ddad31dfc7bdc4e38dce8699e11c4e58b2bdcb52a7c44

SHA512
2b30aeccde7f66819bce055636ca73906d30f3f68107508537ce4538c90189eb57bfa0f9cb4f6d4d4a69090151e8a0ebb67545d8638557946533cf0b68d74e63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
66d40dbab8878bdeb7c92ad6da4818f5

SHA1
914677c7a2383f986b74db032bd3beb0ecb2149a

SHA256
51508f7001ed767b4fee624a5bb8735a28150f365c262e300ebd07ba5fbdcc0b

SHA512
3583f408bd0a350332949799683014456021d6e7dd7a43a702e991905aa00b276b0655b3b1f0ca70ebc23690cfb18d54b5444b07c7dca584fdf024eac5fcb372

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c93c4ac5c3ed72c66e8a0f978d4d24ce

SHA1
99df5ddc54ff03c9af5acc78839c00c257d3e990

SHA256
04717ce61e81b3ed5aba10d2cc29a686959ff17ec24fe5318a2c3f87abf2ce93

SHA512
1e20427ca97a83d40b0c7c3d391fc3bf6ea0a4306ee4a9eb17f85b7c71d83fe806121b6c0e0edefa908f0ae5eee36dc862e161047c43211c460774fc43cb0090

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e73f972623a8ec99d8d1eecbfa407977

SHA1
407c9556658301eaf28c175f772bd40f4e94d8ea

SHA256
616c58c35ea41b36e66d0984ee201cac58af6de8862de15b985eeecdd3646c03

SHA512
49cdb57dc1bf1e3440f3ddf11276999c078c1b9af407c28a1ce1b0178fe2486a623c0371c9bc0dacc049814956db4af878abab5f164fe3490d09452d3e3dbd78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
b2d3141da52885b62b1fe773c6f37ae6

SHA1
a4407edd4631346509e7236c1216d00e2f822255

SHA256
50d9edf801dc5844d7c43abac14b0de9836ef4e65c4106d7b05d86641b09f38f

SHA512
7af382cbdafaead7f848df3d4248104f8106b3107cdb2f0e20ad47e7e873daa3f21e48977df4cea34a9aa3e77c69a2e49416adc82fa17ef1be142425185db214

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f983.TMP

Filesize
48B

MD5
769105aefa1f2363153307b3c6ebe6c0

SHA1
8edaf37b323a3d4439f799a50b9ec1760f785eb0

SHA256
48216e62ee00cbbd506c21a48fc9cf8a67cd907dcd1882a34014c1c9ac5cb57b

SHA512
a59356b1ba59487f560d5e2da1555091defb07d5a81d6ba1ed7b0de952dfc8d25fba0aace650eeac869210eb70d7c79ef149dbf8c07aae2284cf2af937d070f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d3f2e279fbfb1060c66f9216cef075ce

SHA1
44d8af4556bc704b1f011b8371062d4254796e18

SHA256
556df8a8c26afd9821e590b4beff381b20630e2f05a4b9cd4a82f34d8fd088a5

SHA512
1126c5c826af33cb454faa83ed532fa9d922ba032790b2841cc3e7d2884299cc3038a535ca989fc6176c81b38168baece6e9f6a60e5d597568438988dd32d3ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ce1d.TMP

Filesize
1KB

MD5
8fd2fdcc8507babca06cd10bf59c04ea

SHA1
3dacfceb28ed11964d77d79d17618cd1c97e5d34

SHA256
3ae02e9d6adc1e4a1b1e8513895aa99e3d3aadac4122650d17851f64c87b04b0

SHA512
3f1b0d885fb129997f00aecbc161ec90b7a3144fbd1d51f523501a2454cd6e998f2bace4775dd66f395989b10cbf49f8fe6e01400402e2688bb14201d4b289db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9ee03a01ad2986b772f3387e63051f59

SHA1
e10fd57da81e00c17ef5e58c428c3691f59da9c3

SHA256
d0a448ba63eec2ff8ce11dad1629e3e8b1bbd26a43e6b0c91074ab6dcf912d2a

SHA512
a57359c68cfcd0777c1cd4ea8ea94f4d35992d30a21ed2ee252c468b4a3eef62f39c68840cc16bd5454289a3ff5c6eda3fd3f1b93ae03b2f059d2fed09769a4b

Download Submit