hxxps://freerobuxgenerator[.]com/

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2024, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://freerobuxgenerator.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-609813121-2907144057-1731107329-1000\{19D198B2-464D-4BD9-A54E-03033F201E1B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
680	msedge.exe
680	msedge.exe
4428	identity_helper.exe
4428	identity_helper.exe
464	msedge.exe
464	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 680 wrote to memory of 4372	680	msedge.exe	87
PID 680 wrote to memory of 4372	680	msedge.exe	87
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 5056	680	msedge.exe	88
PID 680 wrote to memory of 740	680	msedge.exe	89
PID 680 wrote to memory of 740	680	msedge.exe	89
PID 680 wrote to memory of 3264	680	msedge.exe	90
PID 680 wrote to memory of 3264	680	msedge.exe	90
PID 680 wrote to memory of 3264	680	msedge.exe	90
PID 680 wrote to memory of 3264	680	msedge.exe	90
PID 680 wrote to memory of 3264	680	msedge.exe	90
PID 680 wrote to memory of 3264	680	msedge.exe	90
PID 680 wrote to memory of 3264	680	msedge.exe	90
PID 680 wrote to memory of 3264	680	msedge.exe	90
PID 680 wrote to memory of 3264	680	msedge.exe	90
PID 680 wrote to memory of 3264	680	msedge.exe	90
PID 680 wrote to memory of 3264	680	msedge.exe	90
PID 680 wrote to memory of 3264	680	msedge.exe	90
PID 680 wrote to memory of 3264	680	msedge.exe	90
PID 680 wrote to memory of 3264	680	msedge.exe	90
PID 680 wrote to memory of 3264	680	msedge.exe	90
PID 680 wrote to memory of 3264	680	msedge.exe	90
PID 680 wrote to memory of 3264	680	msedge.exe	90
PID 680 wrote to memory of 3264	680	msedge.exe	90
PID 680 wrote to memory of 3264	680	msedge.exe	90
PID 680 wrote to memory of 3264	680	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://freerobuxgenerator.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe691246f8,0x7ffe69124708,0x7ffe69124718
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2548 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,10053897773272527160,3338062551983726784,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4648 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
71KB

MD5
11d40969538325008619baf957e17626

SHA1
f1e98330a9762337d2ab7a09bfd42e5a074653ba

SHA256
cbcc65e43ec792ec4dc6435f2aab77666480f92540fbdb50b9515d2c82982764

SHA512
5f2b194287a01ebe922d5541fc09f0784b9b8cba15a8e969b7cc119452237362738bf456ac6e395474aa8b3b634216c41efdbd39a89cf22332bfc44151637366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
83KB

MD5
7cc39f8d0537fb63c80bd49a4bd62d0d

SHA1
86bc167ed04e9bd4b22e7ca00c3275d1b77d8a51

SHA256
b915200027eede29c9ef55cc8e64acd0454ac9b44740b9d559bbdcfd9baf6e42

SHA512
950160cf873163e40ee7c8a1c01f1026be5ac840e78044187c0d94a326aadd48496ff781dab7293eef26256bd5236c3c61b72f0d4d07444519446b9ab881089c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
80KB

MD5
6b698285a1961acd631a74eca20f125a

SHA1
12a340f11b812b03bd64f5d9e9a4c5a6fd6eb327

SHA256
9bff5f20f0dc38cf7e6fac757d53be0f5eee9fd490f183f975b927d4fe9df2a1

SHA512
ee2a66e1d36a0359d62d9c5a70f3fd1600ef34ce820616c690a1d9e954f5ee069c132dd6259f5797d67f4c5ae09ebfec880485201bfebaf7b81a308450b45772

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
67KB

MD5
1acd474a5be9ee9c4497d7271cdebd1e

SHA1
cdc897451d7b8942f08a73b2ec3128c742a5f598

SHA256
9ba7e085d9e354d60f28528f0d95a3feea53e91c1a5334046612dee245ae7992

SHA512
52246e145c089beaa259c7f7cf640c5577c4abde87c8d30667147ad7cbf234fdbc473025a074dad25c8e43652729f79f25a49503b652b988d236cbdc29da350c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
57KB

MD5
484841cf1b974381825671d0597eb6d1

SHA1
0f1a47d150d1b520df20d40e3a0bb44238fa022f

SHA256
cd71678d2f36be5cf19920265608334467a7b6a044d1c29b0eae6a6360f95c08

SHA512
2cc34edeeecbe9204524daabd1237084857c36c2261ba98ed5da87b85ab98fc9f1dac46b88512399d65669818e7e83c39ea61de07efcf739370d992e17e657b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
70KB

MD5
304c4b7d83c7247f43dc1c37487d3123

SHA1
75856fdc8f3ca20a980395769fa645bc62c405a4

SHA256
eca50585eb394e019b771aa81e2113384cb50e062eed021d00750df57412cce7

SHA512
b7a2c8158f55b49ec28801724ba41e1e797b0a3620ee91fb1dfddc5e9a56c129787b2f87d6c06ef4e6d1ad1d5a5a41ca17994c76c463596a6c19e375e7c9bbe6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
79KB

MD5
b7088b2f96ef2844eaa503d7e2c83418

SHA1
da0a239c4f1ba7a263530991fe9338457631d256

SHA256
8569a80711320c5cd5fdb34614dc5709f81ee72fcf2929d707a46896758af73b

SHA512
214539f9b25fdbb849ce5f3b07eb0ef3c0d3061965f04d9305cbcfa171ada3977ded847bd06f41a578e6c7df28cadc9dfef4e159139396003b5f27d4197d6c3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d

Filesize
19KB

MD5
26b7962db99dc90fd6c02500c89d6a8a

SHA1
f97f323c4a6fa32c4dd1b11df6007642a2d03d4c

SHA256
5e3931e3c21b934092d7b3d327bc05f5b2b1c7f0a8d60009f5c5749f974bec16

SHA512
beaf56510d538ba22f6b7677db8db28a6adcf62af3cb182eae554ef6cd043577f6f3475df69877d638c236960cbaa9655ebdc6c09365b16339f7092fa8816847

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040

Filesize
196KB

MD5
813c1b41e435242e7365a4bcd7adcf23

SHA1
2d25e1564eaf93455640413b95646b3f88f9075b

SHA256
70cb2151ee4ef83195855d29819491a23c5eafee2e72b7ffd9041b35363d1542

SHA512
268c4fa1797700a205e37e716c1472592ad6242344645c703ab1ab8d4d68452c3ccce7cdc4d56a0b42d4061bdc793f1c79dffc397f038133387b94b2a1f4051e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
5a2a0758d1390018a169ec7117c035d2

SHA1
5310b248303d4e7c75b39788dc8305a08f2973ba

SHA256
2d65324347e8c47cc91d7b1f344c155ca8ea8d59f8a8f3a244ad8788f6c23938

SHA512
e7ff2ea385381b61ec67665f1792d581569de23099c13b21852826efec965f31908948ec737895407534a1d8068635ff73250f15311bb3a74aefa5dde6fdb8ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
23285ed8595be495c74571ed0fb28ef2

SHA1
5782184a4e7ce30fb6a08ffcdaf5346f4d8bda11

SHA256
3de117099c8dbecfb9d774654a7538a63f2e1dafa79226a6c15b681f93810c5a

SHA512
e05a567f1c67482d0a0404616e1ff7436252f8af73c07ab809d7aaeba007e5e3141c40f00910ab6130245133f8399c9bc9e659e65b62820e264b0fa96c0d1898

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6fa0cb1da9c174cdd5db862f67279631

SHA1
33dc50c64ace618cefd0a82caa3ce66274fefd9f

SHA256
42ee012947691f99348a33adf52381a0c964c740f4b6ee46748f18ce3cddfa26

SHA512
558d3c46915632d46978dc4c04d57a7aa813125abbcf6023f7cd968bd8311ce90f68c41c103f85782ed502ab6c68767148e22dbc6f1c77819995bc35d69a5154

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3b0a83f07eeae28ab9d91379a709795f

SHA1
9e15ec0fbd8de3a22af30c4ee3ed3966c93a69ae

SHA256
3ca92351b7f48c0573a0cc10e3bf47251381387e31fd989e9a2f3b12ab5ef35a

SHA512
52e6383002c7aefc5f2a92ac1d6eba305806b41023448a39f0f22083eae9ac226a24e7a45425d8acfffb8a95e131e00078f97f0d3e7dea68a13b2d3be2b42fbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f6faffb1e73bc131eebf9db85d0b3600

SHA1
9b4f8f28d3565b143fff962534c42c05e5160aed

SHA256
360f86f5de485a546fb51e95a41b56dbc4102ad9ca34f03e0cb60c4534d02011

SHA512
1afc93c79e1a4447d32c9da0d40660763733889ae6e76876f1b3e894307ad819cca58478d839d956a5823a5e8e07e1cd9382f1081fc823c3c964b8064790b759

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
94ebf244931834eb01c6deb6d5ac61a5

SHA1
ed9d299c337644e93b2cb9714269ce6c0aaf6c99

SHA256
331f9b46cbc951b4511481dadd8ab1e9a0fb446ddfee0e59ee54e2ab61beab48

SHA512
1271043f6fff7b4cd37c368ee2f698c1963d180a52d3de9f303efc622e4918a68bc60ed47e4fe6117d5d998bd594d4754730b5bb7f73158d279a0620f757d3e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aae97445769d47e3e3a923e0b2c094a6

SHA1
910c9d3610b38bd14c905c439eb9487e383517b0

SHA256
60972f171129d391dc743febeb5ffc348ac4f633d7956e3f8bf99d7b1afa14fa

SHA512
0f0042c1b7491811dc0a138ec56f2a3d885f16928fab490155941b8b5c089e6f8f047e4b3ea22ab06c2cf458906d2d27f7d2e71ce724f3d2f1dd6e5e82f1389b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ab2260d6aab4cf0866a4bf6c740914d2

SHA1
e41a7105161ab6001db5a9c0cea9ed7422e46eee

SHA256
deed6fb8b52143b6d9b97aaaba8a6ade9da8669a4f08d3eb898d0c7bed0150f9

SHA512
eeb4b8e28f5da4a1570698d94591f452965705ad15fd39bc9a520e492ce21cdd91712d1bfea5bf1882bb509632f2c8fee4ea2b30d954f2468497a7e4e9780125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586647.TMP

Filesize
872B

MD5
6817792e1a05db0ac119141e4b88089a

SHA1
7d646a24f1c0f80d09bb6a2893d2b057def1f898

SHA256
ef68e4fcc545a79824e1c0e7aee380ad25bb43f1cb415957e198e2b1face31d2

SHA512
ef5e2485c5e5ab04b4321324a59633c4fc58a6882aa2738467aec173efda4b53a1f28d6a6215983162f3277ff49377a3cb8a837290390b40246af128e7118a38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
708fe12da8296ee2a7389be0321666e2

SHA1
2d33b6e80406485c9314830983d096a2ca244167

SHA256
38e482280d9decc17daa40790c951aadb251a204fb015641f679c28eb80fb5fc

SHA512
fe30f7e9162e963782843134a62d3db49723c3bac6fa98cbfc2339f9818d7ecfdcc033d531977e5b366b58a948a4c9b6012325c392ca38236c5fb637b18c6967

Download Submit