hxxps://www[.]coinpayu[.]com/?r=lol21

Analysis

max time kernel
560s
max time network
563s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2024, 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.coinpayu.com/?r=lol21

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
412	whatismyipaddress.com
413	whatismyipaddress.com
414	whatismyipaddress.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2096	msedge.exe
2096	msedge.exe
3664	msedge.exe
3664	msedge.exe
3224	msedge.exe
5548	identity_helper.exe
5548	identity_helper.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
5688	msedge.exe
5688	msedge.exe
5956	msedge.exe
5956	msedge.exe
5204	msedge.exe
5204	msedge.exe
4560	msedge.exe
4560	msedge.exe
1188	msedge.exe
1188	msedge.exe
3376	msedge.exe
3376	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 44 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1080	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1080	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 2400	3664	msedge.exe	85
PID 3664 wrote to memory of 2400	3664	msedge.exe	85
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 4156	3664	msedge.exe	86
PID 3664 wrote to memory of 2096	3664	msedge.exe	87
PID 3664 wrote to memory of 2096	3664	msedge.exe	87
PID 3664 wrote to memory of 2720	3664	msedge.exe	88
PID 3664 wrote to memory of 2720	3664	msedge.exe	88
PID 3664 wrote to memory of 2720	3664	msedge.exe	88
PID 3664 wrote to memory of 2720	3664	msedge.exe	88
PID 3664 wrote to memory of 2720	3664	msedge.exe	88
PID 3664 wrote to memory of 2720	3664	msedge.exe	88
PID 3664 wrote to memory of 2720	3664	msedge.exe	88
PID 3664 wrote to memory of 2720	3664	msedge.exe	88
PID 3664 wrote to memory of 2720	3664	msedge.exe	88
PID 3664 wrote to memory of 2720	3664	msedge.exe	88
PID 3664 wrote to memory of 2720	3664	msedge.exe	88
PID 3664 wrote to memory of 2720	3664	msedge.exe	88
PID 3664 wrote to memory of 2720	3664	msedge.exe	88
PID 3664 wrote to memory of 2720	3664	msedge.exe	88
PID 3664 wrote to memory of 2720	3664	msedge.exe	88
PID 3664 wrote to memory of 2720	3664	msedge.exe	88
PID 3664 wrote to memory of 2720	3664	msedge.exe	88
PID 3664 wrote to memory of 2720	3664	msedge.exe	88
PID 3664 wrote to memory of 2720	3664	msedge.exe	88
PID 3664 wrote to memory of 2720	3664	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.coinpayu.com/?r=lol21
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe322346f8,0x7ffe32234708,0x7ffe32234718
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1840 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6572 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3408 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6972 /prefetch:8
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1768 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7220 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7224 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7648 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7780 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7912 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8028 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8392 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8856 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8752 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8496 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9148 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7904 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9080 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7348 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7492 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12180524929908138092,13977758683814866649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:452

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500 0x420
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e36b219dcae7d32ec82cec3245512f80

SHA1
6b2bd46e4f6628d66f7ec4b5c399b8c9115a9466

SHA256
16bc6f47bbfbd4e54c3163dafe784486b72d0b78e6ea3593122edb338448a27b

SHA512
fc539c461d87141a180cf71bb6a636c75517e5e7226e76b71fd64e834dcacc88fcaaa92a9a00999bc0afc4fb93b7304b068000f14653c05ff03dd7baef3f225c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
559ff144c30d6a7102ec298fb7c261c4

SHA1
badecb08f9a6c849ce5b30c348156b45ac9120b9

SHA256
5444032cb994b90287c0262f2fba16f38e339073fd89aa3ab2592dfebc3e6f10

SHA512
3a45661fc29e312aa643a12447bffdab83128fe5124077a870090081af6aaa4cf0bd021889ab1df5cd40f44adb055b1394b31313515c2929f714824c89fd0f04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
17KB

MD5
5774b4354acd5b10936bb1dcbf784ac2

SHA1
acc0b8c69023e5808b78640eb9922ddea1a22b55

SHA256
ad1ff714a988e29feb4544818cf82cd02db5bb914ed40e3099735ae4ce4e8329

SHA512
f49ed23f75d15813e3b5549cdd32680ea451ba741564e17e811462ccf3aac027811387db0af4c956572522e10046fe99faaa1bb848d18a855ccfe6f3254e646f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000048

Filesize
62KB

MD5
afa112736305128e0b7e82ac3e520c2c

SHA1
50902f644a226754b0c6ac75598a40751dd8daaa

SHA256
dd7244eca564f02062c546fb66f697373f6d03c449cd3f58ff3242c8b95196fd

SHA512
29494339fd9b921369cd4c84cca5ff8d8ecab908150c088365485fb15eadc55dbfcda248653c07ab96680377eb8244321737bb8bd5d9cbbe783aa28a671aac3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007c

Filesize
27KB

MD5
c38d86a2b5eea9e823662c4ced969527

SHA1
d9d42845ac4f59b9ac28ba5380a8ec02646efe3d

SHA256
8731878e6c79b29f4e6e52a6c3a6a023de6d85026a965cf994b71e0851abca9b

SHA512
9178e814ca9bdbbee0ffd0d2d4faafbf06f693b5b0f48f18f40550e92ef9151859c1d8b605c0d29e4470917deedc96ead59ed853e37e4628b5327637d8a88c38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000085

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
4KB

MD5
577c23e41b48045f8f7c4ef69aad3e54

SHA1
2228dc31e135cd95f323c265701944c958a77f15

SHA256
660bea8daccbad5ae9c54720a399300e9e6907bfb788f2f15318c119c1e03ab1

SHA512
19ce711cbdac1a0690b14a337af9cd67fd9420901605123c2b8f3a762d00b557f4df8463b2ba3a76e4f6144dcbf6d7653e44f48831a30d09a30391962e8630ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
f328cff2c067e4bd2dfd128343092d22

SHA1
d24da3b6c807a6fd549e0fde6e5e477261388762

SHA256
7e29f9ce411c36eff0fdb33e419a739b62710c8be274fbd4eca9e85dfab37588

SHA512
056e6aa98fd3efe1836ae8cf4236607336b5f976a383bcdaa0cff91583a1564c9d80e9bd59ec7cd9a37a16d76c88f29653b2dfab5689949a7e5926c1b7eb102b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
af5e3e81431ad071547664fe069fb98b

SHA1
53f3cea57d715b1f4380b12ad6a265e5f19f5a20

SHA256
2769fc07ce2dab9b7ff93a5d4256ce9d6b64363d941aaaf47ae5776f77a753b6

SHA512
833881ba68c6238a4c6e4a0de8f255ecacbf6a11f7089f4d240867ac763fb208738f8987104767a4678cff91cbedfedc39004faee981af14804450518a431d62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
e540b20fc0223b485128ac5086f1a017

SHA1
fb25d9511e2cf5213b57ba71d93404905aba48c8

SHA256
e62c695f45141dde24fd6f0dbd2748db86c31741c2f3f09ab0132028e41a4efb

SHA512
0447db7186a82da143679d9aefdd4aa85c4fc4b66521216233385c7799f65d1fc7ee9d496606b4460b2b959a386a4406591d9df3970b82eb446650910228c22c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
60ee49f6e01f604d013b9ab15a38e361

SHA1
5939608180b4ec365fe5a616687dc6689bd1c04e

SHA256
a232fcf5d1b310cfea447d45617404d81964b6d688b6bb1f7a6f8de6c8e954f2

SHA512
3f1910b7c1f7a2d00cf3ac07aa2faeb39e6a08961288eb6d15387c07e5c18de9fd146dc387abde99a3ef83eb6fd9a1e53a24a5e75bc3bf51ca4e088ecd7409f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
70605d22dca3d3593236460bc196e5d6

SHA1
8b352454eacb9e4bf880fcc8f5999b1ee4cffe83

SHA256
88e37c1657db098980f5252adf8761a303209d2c5901fdd147e20712ae9ceda9

SHA512
0c9e06b916818b9cce02c0ac531d927167b2e8aac8b4aadc6f1c24f40f87c8436161db148c13da56e893584c00e86bee20b85a2f93ee399598a49a8edefe9ff7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.cointr.pro_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.cointr.pro_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4aac4d650270d151d3b4aed215daf16f

SHA1
0ee271e7838a162dbaaafb79fc66236a4daee7b9

SHA256
7aed85d1ccbdffc7ca27f732028059dd78970217d5bd146a63b5bf150a07492b

SHA512
7d14df929913d1c08d231cdbd563fe51116ddff5e45583e4ffacbc67a8321bf7d1ff901c05a0c0b7fffc389b49f572facd97027339983d08c27c5efb811a6018

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
15KB

MD5
56b8587ee01a07bc65a00b5957ea5c38

SHA1
15f1f883ec1d7b9093bff4737a04e1f3cd276fb1

SHA256
105d8217b316513f7a52c8091f0b5cac91cc5a14e9ad094a85884906250a7d2e

SHA512
afaa4f144cfc6bfff502921f110db24cf035e1283f8d4464a1e8c5236119f8d01e44ee8f1dcd011e9bda04c157cc84da1921fe12843fe4de7360b5afaf0c11b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
15KB

MD5
30c569019699e52bcefc04c95232c592

SHA1
a1294f9ffb6f878047ef24a8a944b1bae69fcdca

SHA256
ee7a4763b783c525698250fce2c0e04cad55be67500e2a4d76d05f8ce80f07d1

SHA512
1a96abe4adab3984adcc48e6dd5da63ec39b5707e1042342e9204ac96d5fc28d27c25b97fcb3acf7626064c03e210f066d32449894b467a0b523a93a2d8a9522

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4c437e8af10fcc6bda8d106513fd84b0

SHA1
713d48bbbcb9709e494bd0e113f623fb733a93a8

SHA256
a5381f76cfa2e8b4847271cbf34264d03d9862799f873c7d486bb68343837930

SHA512
8a857276bebd9486d537dc5f2420103356efb6fbe6181880e3a1ac8c02ed8e2bf4daf98d781f41add26290ee00ef14a6e78defd7d70027bd51510dd6eccc61d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
fa69c50bb8491c3a927f1aded7416d29

SHA1
e52ebd0d35659a408a19d5a8e7cddde17f0e85f6

SHA256
781daed42763d7ad753319fc8b50eeddd634397d6e3c544962a58a51809038ef

SHA512
761bd2a1e7e5714adf2f00a7e25b7378ea0c9e81c86f72d32f5847da014785cc38d0216dc62130a935ce271c7e2fd32025bb920ec17d398ca8679759127d8dbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
9e7af91636d1c60cdf580b393431e58d

SHA1
5b9b881059beda8fb6629622693a21e2d1be7b66

SHA256
54bac56d51ad35a496607862c8e000b45c90c2a6ea35c9ee14a4554af2768cf6

SHA512
7442fbe47f7ff4cf1b174d2d1eb9b6ef93bd157f90a98e8a7a4b8c0634ec5c2b3480f2fa427355e947e07bfa874626b60c6d8e9bae63c75b17c1e26563f0c375

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ede691d8c2458524fecfbf7392b954f1

SHA1
fda70b3345b56d366a9d8d05801a626082e0da42

SHA256
54e72d8ad1ab05d6992d57ec40aaf7980784d257638658784c449172facf90b8

SHA512
a77c7b607804c0b3a30d1aaede965b26b627efb87608b5a337f413747a518ff5749161c817d473df9a9056c2d90575b354450cde6c8ea623156178e028aee406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
048142333e94e97ff59c459065c3734d

SHA1
df7e3ac27083600c8e66795ceb49a45027976571

SHA256
2b5cdb646bb9f386da2807a81c28185effecda770b373d1edd2e0f23586fcdd6

SHA512
b388ff8dda6a99f626192cb00e6ac15b74451996a91681c457c4bb2784109733da142c4af1e1e9ec2c97d0761ad938d2323e202483d751d63775838dc6abebd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
b887701f2f78056ec30009f7666800e9

SHA1
79b598440c782bf96c1bc324e6ae78a38d344918

SHA256
f75d4b0a5669bdf88f8dd93f4784c6d8648a380c7256bbc1579695ecb2daa854

SHA512
d74af568cd2246eb787872ffb2d096e74037fae79937211984bc9a8c9e11edb23d43bab90d632fa866059088fad38e1b9c4566ea8805f090bcfce6d1452a6230

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8f0a0156e6d2d3783bbcea885df410b5

SHA1
5206dcb18c8590995034940582a7f184556d00c4

SHA256
06cec3985c0cd74d8363b77b03b2eb49c3fa0b2ab55983a7e674071991e87e54

SHA512
29d39c065daae5fbedb0aa63e953a0df9b111e83cd805418fca46a894cbf55ca68b9d9b7302b63d22dc413678e904df570e9ebe843b269daa16161ae95b541e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
76271064a0daddd91df646727a8d21f0

SHA1
49f3dd866bdc6e4faf052cba1079b07a3b7e0d3d

SHA256
e3fc6666a9f9936998d9a0e91c43aa2773f1583614dde5e29e76047fd5fe8141

SHA512
67ad38bc02e8dfe06bc7dbee3d1fcfba4ba472dd17a6c4c7e8a6f351fc5d8131a7f2ab1280ade0d2c3b4b161225b7648d6d33038a0d746f2e6c32ae24def6417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
7b4c1d698adb98dcf9b211801b503c38

SHA1
6e7d6d286c8dd8ac234742042b3f0c933c2988c2

SHA256
2230828d4f4af10fb27b6b697410656c427c50b2e4e94e80ba51796df5761942

SHA512
5aa759c0ed0fb5c9355f300fd1ad7c2c7f0b790c578ab71bf770b190f68b23a34a5a6b62af8352427e81634283c7d5f30639b5e7081a4e736b5254ad3aef5402

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
16ed3ed87d9bddbdac4095f9da7cfd17

SHA1
551adb9e3cfc3a01ba484c32c96ab5bd55fbf354

SHA256
fc3ab47d878302ba08d100db9a01bf4e0d47dea99a20ece5251fbc0893e7853c

SHA512
a313d9b08f903c30c0587a118f8b66b5aefd3d22b67320479cc7978c4a5655df0c46e69034c2d671c6c5878c448799cc9b6f31816d51d795a0e612528d861a07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
39cbb0b113cf8b2050c898fb3bb1867d

SHA1
f23dd850f4bd0951018cdcf9bcc320c3db3f5065

SHA256
b254d17acf5f9cdf32135b1bd1e177cdeea0505a02af1b9221e8c4d77407ecd7

SHA512
f60dc2b21bc33ca1ad87596243ea8684c69d9a280389b12d81dee663bdcffb40f7c77d49809569357aa48bd867b40abfbba7005515f0003917ebbed7bf315cfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
aed01cfc3eb84d474ea765a332708a12

SHA1
a6f0210aa2f9154f6197e3ac914339d6eccee2a5

SHA256
712d8787685a55bdb0ab7a7cb185ea3e8cc4a195cacc0985eb4ead5230836356

SHA512
7f7792d34b246f67bcddb5e1ab9c6ee1ac7d65b7b262a3974fa2701ed95e74a3aaa24d0e05f0c78aeee2b2e6f1c3319a1075981fa5faeccd7617d9376543fa61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
040ae5bea30c34da48b6c9f3e5cb9aaa

SHA1
f67de2df93d04885a80dba94af36393aa5366f19

SHA256
2fa84ce6121cbe3ec36893b9be6f082c3322562991522960ea24969be9bf62d7

SHA512
fc809e17229c1f8d239ab06d48b1c0ec31306258a6d19c786b8ac362a4f0b62fd02ff7f111b573bd3525a026d88be1a24f8f24172a3e668e0a5be1b3cb597bed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1f1e194fde777e972329b597c94d6908

SHA1
1cd6cb2ac20ef45d02bf128404f747d7307ad1eb

SHA256
923a7d7eaecda34f9013c270a87d29d950e4f61bff8cc9cb49ab8d8b789bcaf9

SHA512
fd623769cc85d7f57631c85b60efd47a705a6e8669dde776b05c03983c6df8fd19d1703444ee603e92b60d8f1b43c2939f541ced3dbe023ac12a2db6a82c47cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
d80134f4a36672e559f79836abab1723

SHA1
4a78bcefe0fee2182e3475fbca6657e969f21a17

SHA256
66523f3bd92322037226436ff675563ca94dc9d389047abc32028cedfb595a76

SHA512
467f142a21a60265ea2f26854669493bb6dd3448b171ef7f0450a96093f36b1ab846216f7ddf208d7a6e0dc8c1eb35dfa349878ff414920f9751a7d033176e6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0b7b3fd3bf570d485328c85bc4f97db8

SHA1
6b5ef2dc289cba38031dddf7babe1ffe2658461b

SHA256
d3be6b3fac4c0dec906930aa472ff5d9235ade1e96a0b4ead2c7788bc90cf6b8

SHA512
8fa85dbb0bcb46b750713d9ec7ea099a38d1ef26c005f13355895db441d384f9f02d8f7f4d2c549bf57e94141572af9dd82c00a4b7fb727fe90886177c8aaa9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b98299d3816e2dffdcdddae904bd453c

SHA1
07235183e7122391d11ba0c6fe446f6961710373

SHA256
79c7da0ff436c2f54fb12cb6a69203dc2571a8e8f375b654e8446d5394e5f272

SHA512
c31d7c1d16211f05541d5fae0013e58b9eb950292954d46acaf0ec9c1b7374b80dee58cc26f34633d2f4f66eb748346969ec8cdfbd8a3b4a44147db6be74e801

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
df2bfae0cd205a8ea911a1f7c54032d8

SHA1
2426c99531f6525fe70fbb8c27544cbd35a5e2ad

SHA256
42ea8245d23d1ec54f8b9f80c5432d2a899666b0adc4f0053f8940d52c07f9a6

SHA512
fd349edd2c4d2bb84103b8796c6153871eb8b32f6881d3051e29e4f1033eaa9810e30d75a5f0e14e00363309a13055fca60ea6ca2d33eea573fb724b7d2f46a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
057f3a7b66bb84115c343a22cede2311

SHA1
83f5bf479ca48cfedccc972a5343a38f6a9517d6

SHA256
a92c7de39506349b03a27a9e2d49a1518e443d1c1423953f7941677246ccb7d8

SHA512
566ede43440d75503525c68accdf372d0795f3231ea09abfb84521bd8854e637a5f8f3e6ef5ede3ed30d17c713b00ddc6a79bbf1d8ba47f946f9a0b7e94fce3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
5d7986361c288a4d5197fcca0f611207

SHA1
d964510309b897c4d04161e23f84620f727aa15b

SHA256
f381d2568868a6ada5b885dfec915178e45635ac0dcf2a35cdac9c3f1a5f5f89

SHA512
7cbb66b74246f575d166c95546e0b6aee96cda8c281d32fa85e5fb0c10b908a59ab9e87e62520cbd53eaf423c3a760ca0f08da5feb93c568d16608d38f00d61a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
d936fb99e4677911d98739780cfd9ce2

SHA1
935d62fb42efbe612b910ffbcd34eca7c3b3c832

SHA256
e9d35f50988e41218ff0728b6427d46088f321fc12e1a20a039ce9d934384a9c

SHA512
b0691b4f20691b43412df0b9f1801325d4c98054af6ced9762083161df01bd6606a72adc7dab42769b4a168bbac8f4767820e6856243e6eb8286bca61778c079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
7f68ca05eb016f20a4c8dd219e1a73a4

SHA1
5d368b921c69480b7b9b0b94f1092d7f79a2c1fc

SHA256
4be0a92c59c9c4e895102e69fda62176e991908be19a228f3a6336f852399e39

SHA512
1ae36e8e4514fdfb151b39a3eddba1a92e80063538c27a2787fc2c13eed283244ddac5d252c6f450494bc52c1ef403cefe0d6973df8e8930402806dcc83ced8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
59d9e79b51eba474a0a2c4ed98766cd5

SHA1
e38fd9eaabb7232c2023c90d21a878aea0d45b0f

SHA256
7d45263ebc71550ae98b9c83c736f707a50447c387eda4298640879cda83d564

SHA512
4437af3e6e5107b93847b07ab641af48f5f26712b35aa27fa2f0d30f2fdf188faeaef0c354cead4be31bbef4fccb6fd725cd8e8946fb3d5a22ce267e184a9077

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
cce3f11bf5d89d5de99f5fea016cb11b

SHA1
d0ecfc832dbded0d4acaa184456633325604fc8b

SHA256
dac59c11fe4c7cccd969f6ade5b2ff63d42c371840af49831ec073f435d16461

SHA512
98604c3ecf8b6c18842398cc4d7a88c071e2d6dcdacc9510bcef8e12024599d0a22b9f810cded3ef21e2276c9ca3223912d8f9fcf516cd0e2e9707f41cb281f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d31b5131b58a9ffd0e9a2b6913ed8ee9

SHA1
c5f520690097af3531fa3d8d1deb5adb0e8a868b

SHA256
2e2ba865c81891ee1c17f59f64c5f23efcda265bc9912569cc7abf1a54ccd1b8

SHA512
bb0f467cb6170d1a74e8c9305d52a966e1ae8f693727ec7acc54ea8a7123dfb87ba2c0760062f81582cbcac0ece234b0d419bfcf11882a6f78583ccae77459f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5b3f7bfe2355fb50294dae819b3aa921

SHA1
84095a9af7ca3b63d5dd29fdd10717b05ceed42b

SHA256
9bdc300d89b8a2c2a7b909531f2747612c66b7ef221cb37492d7216016fbfd7f

SHA512
79a0c70af0bdab49bd3eccf9afdfb1f230f53508523e6cfc42ba90ae130ec1ff726c3dd89b46c4a3c429660485a18e91dd776edb216c1bfa71e9b1e0553c28bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
5d773873d830ef8fe4b4ab9f59076104

SHA1
40a5074539fff578d78a7e83fa45421206ee9b6e

SHA256
3034660607dfcaca32bed87f411b81988401287a705b927874b842cc8e754031

SHA512
375665effa978de6943a4367c06621894ef9e84424978d02e377a7a061b2654e621a4ac2cefdcea38d55767466ddd05c79aa93a74a42bc760193482869779ca4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
c211c160f0e8028fdf40f0a96eb02ead

SHA1
280f12c2a1042e90466d6ac54edd7f855fbd54ec

SHA256
d08e101b2deebe4a6937127bd5fcb202ae296f131bd4293aca9c2d7e2025c0ac

SHA512
42a19eedb99bc06964417fd1a73bbcf80c01aa85f0168b83b567a6cc46527dad090341750f8293089140a24bf00f1a8d2653f0e6002a01ee0d9abef16cd2c479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b3281ef3a3f444920736e9ccfff4d9a4

SHA1
039c4a9cd146eb4077e29e728611b9432715efbf

SHA256
ee3069883058f7759d768e49fb64e919ca203b93b429d8682b4cc48025bee5cc

SHA512
5e0950a7f04568a4af50bf5a1b813ded95805ecda6b2a2af0ba795fc8a7ee88b6ce01fcdadd2c65f23ccbbb4f59a3b16725e29e14fba7915adf0e5ed03aa5756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
769386142216338de3022eccaeded788

SHA1
1694af9d5d6de1bc42eb892e5d29ad4c3223e961

SHA256
7bebd4c0606301788a2d493f5946e6d19a154072e73dd437b952d21c29188df6

SHA512
c7b180fc4d142298ec9e846849d0d4cce3cd35452fd707be164b5cd9190cba8a3dbe9c55aa2d4966a838b0f0ff044d283f104e4c1f46a6092873ae75431c139e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
c36ad6254d1c9caeaee2a800b9941800

SHA1
313c85a67d3357184cdc240e311508b8da5fceda

SHA256
622f4d377262dffc8f74905d789e1b20722c392997ded0a805d42eb9cb14f503

SHA512
4efca018e79d03adc4aed4caeb66f3e9ee5d803b13aa35be043182eb2f07ff4a79ac9a43cd805fee868051190072a7a2facc11dd0d9d389d4c707343ab169d7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
edc7d858a4714866ef5bd7c1d43d280c

SHA1
69e456b6eb350f6ba0efde73c72972fb19599aba

SHA256
5c036b74d30bef0b6b535d1d2bd0a5e3d0f1edbdaa97ea89b09730c3000c1ff8

SHA512
97982768dbff2e94e5d6ce40befb20878fde08c0f8ae2a281b575a566c2aedd383d225388b36baa16d7b09077eeecd7a2fbc1c4a5e7b23432448cb46d7936acd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c65262f39048d7eac341b298a0f8cdcf

SHA1
f35cb8b493fbe3dd5f3e1d9c14f9e9a680304d19

SHA256
a9f43b854f499f04b6059c4d97c1c97d2595ac5671720e25f566790b69de1f3f

SHA512
e184b233a374c6ec15ee0f3058a4f6899c0cee67340cc3dde2f8f5b41f1ba8d230314b005e25fdd38ce6aaae6a89a7cd7bd8ef4e2fd93ea4594b1b27ca1a67af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
7ce9a5ce28dbccad1fed03ae5a9e356f

SHA1
1dcf54cd5abd534043f0871d82876949789aec8e

SHA256
f1974dda08fb62848cb3411573e14a88c15a781450d58bc06e8311edea03db4c

SHA512
8566dd1f6b5ca7135f5dc4da7a737f00d4709b63cb46b2418239554c740e265c18c5d340f5ef8686dc6346b8ea12a05ce716cec4c3490c9fdd5c5d03afdafd9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588b14.TMP

Filesize
1KB

MD5
12b640a1ea1073aa9473dea7739f4c2f

SHA1
e64beb0ee1dd97343e8247d2000956adb988724b

SHA256
eb0ab9936ce2486e96644b2f3658732db3159c9037a02efb94f3681f22c7917e

SHA512
d1c00d8a1f49d2373645bac0424e9fb55ec2801f054fd89cbcd61f9ce67db8c745ab6b4a0e5f5e8725d9faa1be07880b5a53bb577787a1eb303d09d6f18654c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b890c6cb-d0e7-405b-8571-2651ab230c4d.tmp

Filesize
6KB

MD5
a3afffc68b459730bcecb4a8f0b91daa

SHA1
2a3604c3d2f0a201a40b9a177a49f6a6be4aabcf

SHA256
85ac6c485eafba81260747d6b24dc363a9002dfbfc7114fd9edeabfc83adcc59

SHA512
cb94905aee3d0bc1ddd3712eaa76d05b74c5ca0381f4932c4385cd66f23ac56ae5c80d02d1aef666b5ae4df37177aabaca90615acb72259ba418d41026c512bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
71873e7aa237633461b067bbca913505

SHA1
68bfd343c8d3974032e32b0524dba8587f584615

SHA256
8833a0fb3fa09d887e0901ab88f93979fe4e26d07a1288f79f052db6c891056d

SHA512
f7455bb990a05d30aaf51556491da5016968c168382825217bf53d2e4abe66e68dc9560b15ddb7ae798408d234b8655e93082f0679575e713cec8a01fd2d7ef8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b32578baa83a451ecff745086490c3c8

SHA1
f6e0715110722a34e5b63969c8c1f00f3bb35605

SHA256
61122c497d214998e6d2359e53c6b1af4f3560dbd0966b189377d196397bcedf

SHA512
44ac91dccd4cdb0bd6ddbbfa6169eea74e4e769e9dcf1f92821e216816bad0d7bc2f314dc000e4721826108acde83334b671dc888f67daeced10e762c629ce16

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
f0be01b860cd435b483a414402b2f456

SHA1
52489b0282f3aca71d73948da080fcc5b9cabe23

SHA256
879ae8360d496d9dd2a1a642095ef64edccb2bd7aac27dce73928a1980337022

SHA512
e762f9f0776446fcf88f8ad0d7352370e81f2650ad76de4ef1986a9c79a66b20253737b2fdcd19ee69bc1f1476b6d6841c5d3f25da86e3e2f2e93cb21aa1987f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
7e22345d77e988e0ae2cd794bd65d257

SHA1
3bb0e078b33bae69794ef7be4f54ec6761f6b2a4

SHA256
4501caabe55c0e2baa39491c1aa6ae939628d73797f1433d6c8ab2d1ae435067

SHA512
0755c253bdb3cc734d5c2b26479d87b6304ee96f09031c42b2c73b73b24de6b19c3a807d9196e13cd2a379225b5cfeef032697e7692036583f069eba04e7600b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
416c330d5f84ee58ebddb9c9843f6437

SHA1
69ed7b30f0494123049fb408917884ca169d149a

SHA256
af9a64bab9e4f0908723c555322df62ca77f6e54f8f8b24612ab9e1492a589c8

SHA512
dff271592e013770218b2ab99639fcc6809b81cd19d9e80a34815fe2d6b743fcfce3292a1356a7965dbd1f415a9317e53538794f42512828e825020e83eda51f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
f5c25ba20d9898d0e167cdc3f0f21305

SHA1
0ba7d813b9f230a4ae682255bc233fb8ef9ba89b

SHA256
532c50f0547e631a847e0adde224d578f9a21c8914a7a2b8654a5226bbe1cdf7

SHA512
0338c9309b56f5239299fb6ea9378d4d65d08cbadc3da8b937cdafb9081fd602cea91b58c4257ae346e38244ee1d4872cb0a9845eed6368b7b39a06a09a30f51

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
88f2cf900d563f84715553cdb27af623

SHA1
49a6774ef0486d05a0f04f0d6ba8433a9559d213

SHA256
a38d49487de3f2e5406c8a7c30fb0a6302e7955ddabf4ef44fbdbfd43ca0dd18

SHA512
48072cc36baee9ae3f570987ec93b3f9cdc720083153a78cb1631bd273f1b2bfdac916cb0e09bbed1e4220a37d40405569e0c0d16275e94efdebf2d2a40b4d1b

Download Submit