hxxps://pastebin[.]com/gU4Zj4SD

Resubmissions

07/05/2024, 19:43

240507-yfk6qsfa24 7

07/05/2024, 19:40

07/05/2024, 19:35

07/05/2024, 19:31

07/05/2024, 19:26

07/05/2024, 19:21

07/05/2024, 19:16

07/05/2024, 19:14

Analysis

max time kernel
297s
max time network
301s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
07/05/2024, 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pastebin.com/gU4Zj4SD

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	pastebin.com
5	pastebin.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-891789021-684472942-1795878712-1000\{224A569B-DCB7-45C5-8211-CF67265F93DD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
8	msedge.exe
8	msedge.exe
4604	msedge.exe
4604	msedge.exe
4492	identity_helper.exe
4492	identity_helper.exe
3048	msedge.exe
3048	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 2480	8	msedge.exe	80
PID 8 wrote to memory of 2480	8	msedge.exe	80
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 384	8	msedge.exe	81
PID 8 wrote to memory of 2328	8	msedge.exe	82
PID 8 wrote to memory of 2328	8	msedge.exe	82
PID 8 wrote to memory of 2832	8	msedge.exe	83
PID 8 wrote to memory of 2832	8	msedge.exe	83
PID 8 wrote to memory of 2832	8	msedge.exe	83
PID 8 wrote to memory of 2832	8	msedge.exe	83
PID 8 wrote to memory of 2832	8	msedge.exe	83
PID 8 wrote to memory of 2832	8	msedge.exe	83
PID 8 wrote to memory of 2832	8	msedge.exe	83
PID 8 wrote to memory of 2832	8	msedge.exe	83
PID 8 wrote to memory of 2832	8	msedge.exe	83
PID 8 wrote to memory of 2832	8	msedge.exe	83
PID 8 wrote to memory of 2832	8	msedge.exe	83
PID 8 wrote to memory of 2832	8	msedge.exe	83
PID 8 wrote to memory of 2832	8	msedge.exe	83
PID 8 wrote to memory of 2832	8	msedge.exe	83
PID 8 wrote to memory of 2832	8	msedge.exe	83
PID 8 wrote to memory of 2832	8	msedge.exe	83
PID 8 wrote to memory of 2832	8	msedge.exe	83
PID 8 wrote to memory of 2832	8	msedge.exe	83
PID 8 wrote to memory of 2832	8	msedge.exe	83
PID 8 wrote to memory of 2832	8	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pastebin.com/gU4Zj4SD
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe71233cb8,0x7ffe71233cc8,0x7ffe71233cd8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4552 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18440254913734992191,1156932972751875842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:1420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3292

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004D0
1⤵
PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6e498afe43878690d3c18fab2dd375a5

SHA1
b53f3ccbfe03a300e6b76a7c453bacb8ca9e13bd

SHA256
beb39e9a246495e9dd2971224d23c511b565a72a6f02315c9f9bf1dcfae7df78

SHA512
3bf8a2dd797e7f41377267ad26bde717b5b3839b835fe7b196e748fec775ffd39346dba154bb5d8bda4e6568133daaa7fefa3a0d2a05e035c7210bb3c60041a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8b53ef336be1e3589ad68ef93bbe3a7

SHA1
dec5c310225cab7d871fe036a6ed0e7fc323cf56

SHA256
fe5c2fb328310d7621d8f5af5af142c9ce10c80f127c4ab63171738ad34749e1

SHA512
a9081a5a909d9608adfc2177d304950b700b654e397cf648ed90ecac8ac44b860b2cf55a6d65e4dfa84ef79811543abf7cb7f6368fd3914e138dfdd7a9c09537

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
67KB

MD5
d2d55f8057f8b03c94a81f3839b348b9

SHA1
37c399584539734ff679e3c66309498c8b2dd4d9

SHA256
6e273f3491917d37f4dbb6c3f4d3f862cada25c20a36b245ea7c6bd860fb400c

SHA512
7bcdbb9e8d005a532ec12485a9c4b777ddec4aee66333757cdae3f84811099a574e719d45eb4487072d0162fa4654349dd73705a8d1913834535b1a3e2247dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
37KB

MD5
c912655c8d691e1a190dbec03d14e653

SHA1
a90a6ea007e121441a0d9c48ea4073a635085f6b

SHA256
35e5f055ba3fc9eb6c89884d533f5484fcb335d0e226145d7ea7a6a1e2da6fae

SHA512
c606bf2711a2be266c69a702d60bbc0d66dc6655c88dd669932f9c3954941a44d6a09e25bf60272ba5e0ba09ee65f4a3d8bd33a215ed2eb76ed601f06fa984d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
1.2MB

MD5
25a7f8dea0207366b4b9d77569ff6f78

SHA1
57a20ac66704e6b2766c6946fafdec22f47ee79d

SHA256
502a9f82d39ef6fca4b4fc1bfd046b9736d8e232c8b1562eed0ca62d149bbfed

SHA512
db300662a1a49ae8417fb013462fc62ab20351c9c458cb60b0b22ec89c1cba410ae03301cefa6464dc58ed332ceb8a2d67eb6b8078c7f2127729594126133024

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
33KB

MD5
3cd0f2f60ab620c7be0c2c3dbf2cda97

SHA1
47fad82bfa9a32d578c0c84aed2840c55bd27bfb

SHA256
29a3b99e23b07099e1d2a3c0b4cff458a2eba2519f4654c26cf22d03f149e36b

SHA512
ef6e3bbd7e03be8e514936bcb0b5a59b4cf4e677ad24d6d2dfca8c1ec95f134ae37f2042d8bf9a0e343b68bff98a0fd748503f35d5e9d42cdaa1dc283dec89fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
75KB

MD5
cf989be758e8dab43e0a5bc0798c71e0

SHA1
97537516ffd3621ffdd0219ede2a0771a9d1e01d

SHA256
beeca69af7bea038faf8f688bf2f10fda22dee6d9d9429306d379a7a4be0c615

SHA512
f8a88edb6bcd029ad02cba25cae57fdf9bbc7fa17c26e7d03f09040eb0559bc27bd4db11025706190ae548363a1d3b3f95519b9740e562bb9531c4d51e3ca2b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
6df4fd41d790a227d17c3b327a6a08d8

SHA1
099529958d436c9bd127270ded5e07193d350f70

SHA256
52cb7d207d862607e5948470ec0b24cf18dc991bfbc16da879fb59e53851297d

SHA512
510105e40e6c213ab5836bd01d1aad3475cb5441b6d3cdbd91487e743a062cb442d6640a9ddfa09b02dfeedc4ffc4b0b87220f7568a7873fc317ec6423d5bf5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
ab0c583db0846784fde6d165fb7d64e8

SHA1
8e8a3dfdbd60dfa93a94fceee92991672e9fd1a6

SHA256
dbe884937d65e088fe3a68d50b4b23dac3e65d51cf359ffd66e40ec1b9467da6

SHA512
0a889f9642d3407a2c4dc6a6c25c5afeda2b1f22c1c270111b57da6225984ef91e1b97152f6bb83f199c0c0fe12f8b11dcb849479df22674e3e15cd09c05daee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
fadc296a203fc31c8f455bb4ae3c5414

SHA1
27f302f6ae1efb80a07f04b8cbe0f099a04c1f7f

SHA256
a662a45748b3b91c99e4878440c4d37797476681c9910982aca2cd913efcb0a2

SHA512
db9ec9cf289809036f6a20c0836dd52219c597579291a01348fb3ae9385fe09c4075073f210ab7fab56876d59b80edf6933e74ae18dfd78881deecb93ab8ceff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6161c5152481e768bcf5f981197656f4

SHA1
16fc4ab4fb6a0d6079bb4b42a4dfeed731183741

SHA256
54f8b187bb9aaefc941378e7503e75841ebef0d09a2ae252c0ead7f8d38775b8

SHA512
f6a9136ab163a623d1415ff7a7ab267d2e3ee669f55d28aa3c9bbf971ed5675fa181feb1ad2415c5243b5bbf950649f1753ae6b2ce7b81d7e918ef43452ffabe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
cb75132b9368c1cd1f3f27fa449b9b98

SHA1
c93605a273ec72dedd308320e9b1d4a2bf665cd3

SHA256
545d87c9237f147beffa0279c2b0476c43478a1bd27a177b54f49001deebd4d3

SHA512
36a64fb833eb66ac0e8a48ebfc1894c4ff26c03b085e66b51eb876f9a17bf81dbc9406754c193c312915ab4a43b63121d1aae8c7f58e95e4a3812561576a1a43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
297ee0cf4224b2e7fcb563da3f30ce9c

SHA1
7a73ca3518041e183cea937fcbcd5e0b5e33e53a

SHA256
72bc139fd21807fcd95a019a6a20bc8c2acaa48f3030306bc3da40bd2815f769

SHA512
9881282568543471b27704ee98efa4d94fee481f6de435732b7744cc503621e2084aee800be169d6b3cacfa117de840ca2eefe711d555da5c88ee0e3436b40e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4bc1dd560577734913e22673c866afc0

SHA1
3f7413399cbd62500dc78b2e4b0d3a3a9f1aec67

SHA256
15f912679b6521c2f47e77cf93eb48396ea8940c07f9118353d8204fe0ac48ba

SHA512
c4944c26911069e79a74efc82f45945b2b8234e5e3c74dd88cd6f3556c4737ccf38af9480fb900fb092b4f8028cd83a3f993bab8d2cc5d7dccff713023510456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fee331a0a946f0a6cc456a3ee4c2857e

SHA1
5c9208344d4aa906377c7fc9be8de9e04a9f184f

SHA256
46b8c504c2a0fd00e89a19f3145befba7ecca568069da9042cfd1b717a20af43

SHA512
19fb38474970dc3ab727021dfd4739ffd66b943525dfcbc785bd7c53b9af84084b5dec01280a321cc889f91db068800a4637c91988607de77d55512b0d3cb0b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
35b8d138551cb2d59f5b810215132231

SHA1
cb897ce9e3cb30b0201f098690f5c9bd41399da3

SHA256
39cf17ca57679226d56ccce829fdd39c3270ee4fdd63967e392cc0672727239e

SHA512
9abb55658eb37621b3cd033e3fa0bba072aa58fa078a0717ddc0044e4fb8fb73ed860b1141873aa667b76cb95ef7bf97067f402c46de3f47e011639ba5f71ca5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a31acfd8692cb066fef3b3010636b6fe

SHA1
1c1a1ae57c97815feb42ad92a81a2b2cb1ea6e14

SHA256
fd815567cf670983c56adde02b8d6c65406564a7bb08aa032c466c019e4a0405

SHA512
bbc42728eb1eec96cae02ef1f69d61fbd65c5a4874b5f78d4ed6147f8c8799697660811d119f95202434f313bcabc38f577f5279c6bec5e67969cd7fac128334

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f6ed7c382934b4ab5d620540ceb7fa2b

SHA1
b746d3d711de6dbc173fdb5e4ca75d0b70cd14f2

SHA256
fe7eb55340dc13374fd2857943ff60c842e70b5f69a831247e33af0eb34ffee2

SHA512
40d50a62eb16b35e7a458bd7b00b639cbd3c80399feb73f409e7f25298716c777049d871b89498cdd497fc8c5c449c54bb35f6f3b1a207f3aca7cc3e891c4160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
678be4abf6b447cc9bd218726900c7b0

SHA1
6f346123b9972362d928f84109bd21ede3f9d448

SHA256
60930ad05cf41b7890f27da72dd0c34e993bc53f0d1ea5785617b9ba1122f771

SHA512
2e9f5bf42f466943ea21a7da13b99fa6fc7772f9f95a94953b1448575fccadbef862590f48c7c62345456e5d735a88d4deb409067e709debe9de1d1843076898

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
864f59892a7ea20600142a7fc54248e0

SHA1
c1b3f221f1b1c098096a8b90c6c7a0a6cd60ce41

SHA256
f927de4bf7767350067b0c32fca6869bfb65b9c512d66d1f4ffad88a8fd7691a

SHA512
f5150efe5858b5f3785fe7abe5543898b70b826848b0d7b7a2e85c4f82f9178ce3178b63b4817f0734bcf87c7965122e42052eea7ee85794d2524665b8329618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3b64a9efd783c98b0eaca61140d42d18

SHA1
16f56f635f797bfeacab5e0b3c07bfd98a27e99e

SHA256
b44b2d9b7d98667b84bab8aa44199075ac9b7b1e92a38cd0ff11d9e70a933448

SHA512
ba63dc42365ebe14b6f564629bee719750ad3ac77c4ef04bd2eedef533c4a2bdfd9b3aec67a9145bbe1e5f11fd759d5816387527ab945e074e31992b91ef9e3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0dc7a9b9bd5396b2f6c684417fd9b567

SHA1
d2351435dd6034c4dcaaf80f4d00c69a12426bc7

SHA256
5f0930b67d1cfe7fe8c4afd2871c2690918a559008cd59fcb6c632138bdb1011

SHA512
0b826f92c7b09dd944a3be7672683c9fc1bf73d60ccda99e02228e9bd9961382a8b8731b92613953005471bad76dbdda011d94ab383d9ba749f9ffb0656db337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
98900ca1140bfb48b2c68f0a73eb5fa9

SHA1
3f9ded04c4c4c008d31668b13f70592066da02de

SHA256
cc85aae8044c51d0e3f03c54abde23b95938516c43d1b0f3d359984c7fc39001

SHA512
eeebf5743ecf813e29343f29fa862d8d81d5d0299193e08ff63ae9ef653669e99153d24292cec7480e2a28a48887aa651b5dd1c8913a5058893e7dcfaec17f0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
f28cfe66c8ce1e096fb06cf12bffc1c7

SHA1
5311ea3820bf559c319eb8fac04b91252ffd232b

SHA256
77bfbfd21141fa70eb25e1e7cbab7ca657aac7ac16e210591af04cf40450af17

SHA512
d3f314f08bce41c479426a4a5b8eee3003d8e3597f4fce0738fa78a1d6ccbb741b2d2f8e0126c98a2fda038ba842da1b752fbc7d0151f70f0a1fc5c031817b19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
64f01aca007ba88f5130265015981a4f

SHA1
e6b6771422c9bc9ac2719bbbd5c0c7b24fd6eeb6

SHA256
e99f3b3fb6f33416e26be1811dc77a77b0b1c36aabcc89b93cd2dac2128b91ad

SHA512
ecd5f72fb2bafe7077b7410f2ea837c4ec7f027244db429d30921e6af6fa6c985baadebb916557c02bb6fc20c1e0d78d50a9492a369f40f2e18207940caf4df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57af89.TMP

Filesize
203B

MD5
e6ddf95de5acd7c55617ac97e57e4298

SHA1
d7f3b7c0b4437a55616f9d67cfa039772e31b53d

SHA256
f04ad7bf75b28e70fb2b7242f03aaa338c43e819c4c424cc487019578b3029e3

SHA512
893400618fdf305b937e21b7b9501e7d0aec8bcc13cbd489c3f73d3b921ebf29fc4491d62cab2eaf633cf7aaac11a97d75148c1dbd679a552225143042cbc3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a7b54174-b614-4476-a2df-0c05b8489f3e.tmp

Filesize
6KB

MD5
5513cc1e2bddc1cfc9c2f5e9a9ce05b4

SHA1
f2881aa2a3e62481d0fbbd459cfeb16bf212a2a0

SHA256
d5dd3d5c1797872b3c48e4ed7035ba7c537d4cb3243172471f1781595f6081be

SHA512
2461bd5ec844cf376b873c0ecbb9882f095a8f8ea8ba0fd4ac965791dca77859514663ef8c9c67ef57141906f5c4cce1ba1a09fca2d6864fe97670fcca95a22c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
12c633789b0b1e7067514f49490e1636

SHA1
b2c200e4ebfb5335d803274383f4ea7acf0b2d2b

SHA256
70f00ef51874d15d42f17424ab6cd071c203602ec452e143d70ef0d89f90cf84

SHA512
81a20b6bd97f1ef80194c5e57bf63301d24eb6f971f6b5fd85accebe2490fe3cb80342a0c156501e19788ba37c1159c92d166e0c4ae52c226034381144824c8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f6a4d4ebcbf14246d6dd5754dc8e0874

SHA1
7d3ac383c273577fc6b93bb55dea139c3cb5be94

SHA256
f7f36bc4875da5e1107d8fb879401549e23743ec78250a0f9b949fc59f43ae26

SHA512
b58c8545e94e79aad9577b399c60b297b318d63ac7a150554a47a5cfdd717073b3c3d5e756bfd87d03ec5e25bde1085ab495c07b9b944f5b403ef64c55c76da5

Download Submit