hxxps://edworking[.]com/share/workspace/clw51tkc20e1jhfwlylweomvh

Resubmissions

14/05/2024, 15:32

240514-symvdsda58 1

14/05/2024, 15:29

240514-swwdrace9z 1

Analysis

max time kernel
480s
max time network
512s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://edworking.com/share/workspace/clw51tkc20e1jhfwlylweomvh

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
1784	msedge.exe
1784	msedge.exe
2324	identity_helper.exe
2324	identity_helper.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 1856	1784	msedge.exe	83
PID 1784 wrote to memory of 1856	1784	msedge.exe	83
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 4964	1784	msedge.exe	84
PID 1784 wrote to memory of 2788	1784	msedge.exe	85
PID 1784 wrote to memory of 2788	1784	msedge.exe	85
PID 1784 wrote to memory of 628	1784	msedge.exe	86
PID 1784 wrote to memory of 628	1784	msedge.exe	86
PID 1784 wrote to memory of 628	1784	msedge.exe	86
PID 1784 wrote to memory of 628	1784	msedge.exe	86
PID 1784 wrote to memory of 628	1784	msedge.exe	86
PID 1784 wrote to memory of 628	1784	msedge.exe	86
PID 1784 wrote to memory of 628	1784	msedge.exe	86
PID 1784 wrote to memory of 628	1784	msedge.exe	86
PID 1784 wrote to memory of 628	1784	msedge.exe	86
PID 1784 wrote to memory of 628	1784	msedge.exe	86
PID 1784 wrote to memory of 628	1784	msedge.exe	86
PID 1784 wrote to memory of 628	1784	msedge.exe	86
PID 1784 wrote to memory of 628	1784	msedge.exe	86
PID 1784 wrote to memory of 628	1784	msedge.exe	86
PID 1784 wrote to memory of 628	1784	msedge.exe	86
PID 1784 wrote to memory of 628	1784	msedge.exe	86
PID 1784 wrote to memory of 628	1784	msedge.exe	86
PID 1784 wrote to memory of 628	1784	msedge.exe	86
PID 1784 wrote to memory of 628	1784	msedge.exe	86
PID 1784 wrote to memory of 628	1784	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://edworking.com/share/workspace/clw51tkc20e1jhfwlylweomvh
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ff97d9546f8,0x7ff97d954708,0x7ff97d954718
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,3702204712123114253,12634010074266036082,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,3702204712123114253,12634010074266036082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,3702204712123114253,12634010074266036082,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3702204712123114253,12634010074266036082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3702204712123114253,12634010074266036082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,3702204712123114253,12634010074266036082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,3702204712123114253,12634010074266036082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3702204712123114253,12634010074266036082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3702204712123114253,12634010074266036082,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3702204712123114253,12634010074266036082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3702204712123114253,12634010074266036082,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3702204712123114253,12634010074266036082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3702204712123114253,12634010074266036082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3702204712123114253,12634010074266036082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2180,3702204712123114253,12634010074266036082,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3702204712123114253,12634010074266036082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3702204712123114253,12634010074266036082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,3702204712123114253,12634010074266036082,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4248

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x430 0x2ec
1⤵
PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
30KB

MD5
ca6e0dcaf6fe11e3b4d4d299ecbab7a6

SHA1
a637b13aff3baacc733eb221226c36b71a3d3a7b

SHA256
f4a93cf3834c5f3bbbab2ba619425fb1415050a847f5bc12cd6b0bab5e68074e

SHA512
fa037f9ac77644d641bb6cd1b18722be3cd7d039738f8770d6a09cf7e5829b1602a772ab643ce8cd683a0d11e62c5ccabbd555fff25f77c39034793510543ed9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
502KB

MD5
add520996e437bff5d081315da187fbf

SHA1
2e489fe16f3712bf36df00b03a8a5af8fa8d4b42

SHA256
922b951591d52d44aa7015ebc95cab08192aa435b64f9016673ac5da1124a8b4

SHA512
2220fa232537d339784d7cd999b1f617100acdea7184073e6a64ea4e55db629f85bfa70ffda1dc2fd32bdc254f5856eeeb87d969476a2e36b5973d2f0eb86497

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
27KB

MD5
a4bca6c95fed0d0c5cc46cf07710dcec

SHA1
73b56e33b82b42921db8702a33efd0f2b2ec9794

SHA256
5a51d246af54d903f67f07f2bd820ce77736f8d08c5f1602db07469d96dbf77f

SHA512
60a058b20fcb4f63d02e89225a49226ccd7758c21d9162d1b2f4b53bba951b1c51d3d74c562029f417d97f1fca93f25fdd2bc0501f215e3c1ef076810b54dd06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
35KB

MD5
496b7bbde91c7dc7cf9bbabbb3921da8

SHA1
2bd3c406a715ab52dad84c803c55bf4a6e66a924

SHA256
ae40a04f95df12b0c364f26ab691dc0c391d394a28bcdb4aeacfaca325d0a798

SHA512
e02b40fea8f77292b379d7d792d9142b32dfcb887655a2d1781441227dd968589bfc5c00691b92e824f7edb47d11eba325ade67ad08a4af31a3b0ddf4bb8b967

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
35KB

MD5
a69e9ab8afdd7486ec0749c551051ff2

SHA1
c34e6aa327b536fb48d1fe03577a47c7ee2231b8

SHA256
fd78a1913db912221b8ead1e62fad47d1ff0a9fa6cd88d3b128a721ad91d2faf

SHA512
9a0e4297282542b8813f9cc85b2ccb09663ce281f64503f9a5284631881da9aacf7649553bf1423d941f01b97e6bc3ba50ab13e55e4b7b61c5aa0a4adf4d390f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
42KB

MD5
2a05e9e5572abc320b2b7ea38a70dcc1

SHA1
d5fa2a856d5632c2469e42436159375117ef3c35

SHA256
3efcb941aaddaf4aea08dab3fb97d3e904aa1b83264e64b4d5bda53bc7c798ec

SHA512
785ab5585b8a9ed762d70578bf13a6a69342441e679698fd946e3616ef5688485f099f3dc472975ef5d9248afaad6da6779813b88aa1db60abe2cc065f47eb5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
27KB

MD5
17081510f3a6f2f619ec8c6f244523c7

SHA1
87f34b2a1532c50f2a424c345d03fe028db35635

SHA256
2c7292014e2ef00374aeb63691d9f23159a010455784ee0b274ba7db2bcca956

SHA512
e27976f77797ad93160af35714d733fd9e729a9981d8a6f555807981d08d8175e02692aa5ea6e59cebd33895f5f6a3575692565fdd75667630dab158627a1005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
91KB

MD5
bcd7983ea5aa57c55f6758b4977983cb

SHA1
ef3a009e205229e07fb0ec8569e669b11c378ef1

SHA256
6528a0bf9a836a53dfd8536e1786ba6831c9d1faa74967126fddf5b2081b858c

SHA512
e868a2702ca3b99e1abbcbd40b1c90b42a9d26086a434f1cbae79dfc072216f2f990fec6265a801bc4f96db0431e8f0b99eb0129b2ee7505b3fdfd9bb9bafe90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

Filesize
29KB

MD5
210433a8774859368f3a7b86d125a2a7

SHA1
408bacddc39f12cad285579c102fe4a629862d88

SHA256
9c6addfc339ce1c1d262290ab4cc2de8d38d4b54b11a8e85afd44fbb0acc2561

SHA512
6cbf6492bba0734ece1b595743b7a251d3c98425a36d5bf87ebfad17be979a23adee556fb074ef6d284052f6412aceda4e179fb7dfa0ba1103610cc01113a1a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

Filesize
69KB

MD5
f70ff06d19498d80b130ec78176fd3ff

SHA1
9d8a3b74c5164ff7ae2c7930b6d7b14707b404fc

SHA256
df6dbab5251e56b405e48aaf57d3cd4188f073ffba71131fa6cd26e6742923ae

SHA512
543151693c3751a7e6b1b6a9ea77b83cfd049bc320ee75b666514076f4c0218e9dc23da5e6c932b2b8670aa1be1d4e9a91a889f5c6f0d7b9f9c9fe6694609b31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

Filesize
48KB

MD5
db783743cd246ff4d77f4a3694285989

SHA1
b9466716904457641b7831868b47162d8d378d41

SHA256
5913b1ec0fc58ab2bec576804b9e9b566a584ea3d21a1bf74a7b40051a447fdc

SHA512
e6f36c52996b6bf8b07c7a102def2d555a1d35fa12f1a2016edd8f3c86c33dd3545513b436ab6b4ef1d1cad8a5ca5d352ba587eee605638640b258c3976d9033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
e11e0f709c982a62ce250d39e555ccb7

SHA1
3f38f4da729984211428ddb43406e1e9ce44bfbb

SHA256
3b68cc891926aa9f95f3d72c2aa70b4a63ee42b46efc28e9c67a66dee94ad689

SHA512
c0644c0377be20ed6cc08cadb529e859402f5c74e449a56c7272c93f41660c564d352598fe8c6b71a4d07542a0f684677381b086be05ed2b5e4476897beaf74e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
a108120aec6c3f9a18a319d52083c6f5

SHA1
a9c498f6eca0f3cac2118b5273e1292d2fe2fbc9

SHA256
fd42f64c317ce990e2d02a2bdd1040037dd2902d458aff5b865f279e5e8f435c

SHA512
fe841aafe9887b139f2d98e9bb3ec45170691fa04c6982e5d4d41493dd3b63ee4b81e3e9450268add418bcb04bc6ebbeca7ea401a1f276fc19e91e25754b79d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
da960a1a50d828682947f182874263b0

SHA1
9c6bdf2f42a9ddf33fc6627fc2b70f483a7ff666

SHA256
96aacd7b56087ce5c1bb1ef2a16154e239cc03cb8926a318acf556e4967da107

SHA512
fb0d24a3f8b84842b857390703c10774997f1a8015af18a8864bf4cfce9781fa0365a35e5f6d9cc8a3827193a514c1ee4013aac59ec60d709e069e461e3b47b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ed9b71d8c02c233f542c07026a213b2e

SHA1
eb5b8dc7c9800a8863f67fbc0a7b2d7bf7c8754b

SHA256
0fc06878801753aebfed68b1ea328786414112442f9da18b04813595520a8b2b

SHA512
4f62750341668814a6c50f0196c780b28c913c4ea8bb6e684493ad125c07791691f9487e4798597a8c3749b82eecd58c2f3fd9af858a3071c7969c970422f8cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
927ee7703c5e256f4b8de626720e0161

SHA1
0ab1c468cb0786659727878a75adb80824444683

SHA256
00057c336e33307202103dea2443fa26782644085378e04ef65767505da6a7d8

SHA512
6802e1e661dd24a1e67cbf766b6653f358c7523f8300017df6653ac9c3e49022a0214930f5110ef5c8c7ef5bc40fdb7e8276d97e8d191e35cdef482dfd8eda65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f06aa5164bcc788c79013063a69c8b4e

SHA1
b6104baf48d9b2e28dc62f0106513f82032353e5

SHA256
4ca86754beb6af74d3ddcb692a1226c1a468c58d0ef4b23d1d6fb63bf16a932a

SHA512
82787a24638a4de5c03fae1b0feb828c322088302be7d256e9f301dbf490a936cfcd434db57c33f8e3edfe44e1cb5eef850189bd86e966a9195cd9ca4d20541f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3547c1aaec80f679eaea9f6694d49272

SHA1
f46e5dfd92da60ba7a0e0eb6adbda5a577241135

SHA256
751d5e8cbca432919d7dd2995849e45ec151d36bfe9d9a5eb4d585eacfa4dbeb

SHA512
ae17d90b624d1f9f22ab61dbdce51aafc1db564f751358f21a29f7c5699f042e6f01b966a3bcf827844d9b8da4dde2780bf88c7cdcfbefff5d48eff8d329fa9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6b281dd509e894fb2e430c13eb4bf824

SHA1
f3f67d79d0e64ba3e9757ea96ae8b549d7aa5ad3

SHA256
16b2c9a4be1b80f0cfc9059fce1f060219207d12143f4a2742280c1d2e76f7d1

SHA512
f649ed62ed7f5dbfe0e58c7d948369092b00ce18ab1068297e2ecf1c507aee9e13d942b1a8d4d61d2a8208203914d623931561108dadde8cd8350e5c20248c02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3c1556c05ae47b0b853f8c90f02c37d6

SHA1
2b777780a4efdb0225e6abccbec2b471cf201c45

SHA256
594403995d74958d4d837b98aac2c0ebbec5d1176c3303c74fa4b00324f719ce

SHA512
a6968445291e8f1946c909da842055aa4c49530c3d7e39c4eb069388179822442bf9ac771c3e3f25caf2c01417acd4c4f3909ff7438a5d88f7a91cb1f1942e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4430a2a8bd7f1e7deec457003d17ce5a

SHA1
ddc2a2d93a4895b165f3cb7c58c072a60f449513

SHA256
61da3ec6c0fe7045f74748768c777616f774932d91fab6df55a6aa77b869f303

SHA512
5ce6aab5653a475c0be70f3e2f5c940a5db95cc6610f0cfc742ab41adbe41f16a48538306482e2c66c099960dd1aa6f6456eac0424b20f21bf70aebf060f7b79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a393.TMP

Filesize
2KB

MD5
c0feae686808e9b77487a0310a8a04bb

SHA1
023ba4fdbfdddadf03a9b06b37a883d9d17a49ad

SHA256
8c8473b1a437a57583082e5c83cb58bc22270df9f45fe8ac6a10e043be94bfe2

SHA512
f1f511a0000d0ce734500536539cadec76a1f7424d3df1faa37b5599fe66e48fcd133bc061ef778ad10a82eb746ce412499ef56fd151923c763a94e6b9b4a192

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fa3fbf1f0064d8ecb6b83731aaae9428

SHA1
45badb25daf7f8aef79e732abb4dda6c9ed7bfd3

SHA256
af0e052e89355884e824ca4efc1c2419bea299f1d13af86ad9a29f3c63718081

SHA512
fe12959a32c7078864a18f5266e02e6836232eadd6b085ebdbf7e3c2791696a437a4008fb789e2c253d727066802b1b883c674272dcf8fdcb5a77499ee4b6f5a

Download Submit