hxxp://kekma[.]net

Analysis

max time kernel
43s
max time network
44s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://kekma.net

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4940	msedge.exe
4940	msedge.exe
4224	identity_helper.exe
4224	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	844	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	844	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 2392	4940	msedge.exe	82
PID 4940 wrote to memory of 2392	4940	msedge.exe	82
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4456	4940	msedge.exe	83
PID 4940 wrote to memory of 4632	4940	msedge.exe	84
PID 4940 wrote to memory of 4632	4940	msedge.exe	84
PID 4940 wrote to memory of 1128	4940	msedge.exe	85
PID 4940 wrote to memory of 1128	4940	msedge.exe	85
PID 4940 wrote to memory of 1128	4940	msedge.exe	85
PID 4940 wrote to memory of 1128	4940	msedge.exe	85
PID 4940 wrote to memory of 1128	4940	msedge.exe	85
PID 4940 wrote to memory of 1128	4940	msedge.exe	85
PID 4940 wrote to memory of 1128	4940	msedge.exe	85
PID 4940 wrote to memory of 1128	4940	msedge.exe	85
PID 4940 wrote to memory of 1128	4940	msedge.exe	85
PID 4940 wrote to memory of 1128	4940	msedge.exe	85
PID 4940 wrote to memory of 1128	4940	msedge.exe	85
PID 4940 wrote to memory of 1128	4940	msedge.exe	85
PID 4940 wrote to memory of 1128	4940	msedge.exe	85
PID 4940 wrote to memory of 1128	4940	msedge.exe	85
PID 4940 wrote to memory of 1128	4940	msedge.exe	85
PID 4940 wrote to memory of 1128	4940	msedge.exe	85
PID 4940 wrote to memory of 1128	4940	msedge.exe	85
PID 4940 wrote to memory of 1128	4940	msedge.exe	85
PID 4940 wrote to memory of 1128	4940	msedge.exe	85
PID 4940 wrote to memory of 1128	4940	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://kekma.net
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0a6a46f8,0x7fff0a6a4708,0x7fff0a6a4718
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,18226773165706765578,5391065780129049575,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,18226773165706765578,5391065780129049575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,18226773165706765578,5391065780129049575,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,18226773165706765578,5391065780129049575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,18226773165706765578,5391065780129049575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2052,18226773165706765578,5391065780129049575,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4020 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,18226773165706765578,5391065780129049575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,18226773165706765578,5391065780129049575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,18226773165706765578,5391065780129049575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,18226773165706765578,5391065780129049575,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,18226773165706765578,5391065780129049575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,18226773165706765578,5391065780129049575,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,18226773165706765578,5391065780129049575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:5580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1492

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x300 0x304
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
705KB

MD5
6c3c8234a3df344771fd64604a87b8f4

SHA1
cc1f7ea087a7808c504f0bc2b6f712a52c2b9310

SHA256
adccea30e4e07dd7b37bb92d64d032a8ceebc4866fd721b29f9019361eb3555a

SHA512
f409a045fec299070f28e243df5b91de0b267deac7ce4abcf3c21f2df79076511bac0396aae515fab2ba24d49db8931e9ea9d32040409dba8fc8513e3188dc15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
10d342d32d5648d922336d5ffed5f5cb

SHA1
9a23d941ac76a1ac23a96e7796fc5f0c718d5f6f

SHA256
38b7fade63ac1180ae9cef7c3199f655e4e938d48f9eff76932e0c33b8314455

SHA512
c5e503c9fd7d1ee13bdec4240110bac9afb6c82cb51bae85b694a790a02b8e166f59bee3c7420979b534522d9c5200c11b3e97ca5eba164a0aaf45b81ce71844

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
148a5da1258079b1930557596bd7defb

SHA1
2f577dceb753ba3ef86e4baa116d932432b2be2e

SHA256
8c2dd8098cc4d7338961541d6ac92552327841a3d2ea7129d9e2b683f1e35fb8

SHA512
dc62dad033d58e9bb78f9ad739a779855ca373f8afc42f9487148cb134d371bd6290654e8d9370c24d9b42f6586d794fef05d4351f79d26fd4117720e416329d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3d26ff6c343f9a5d8149704d5b98ca44

SHA1
6f129017deb57c41ce3bd2afffd4f5002b1bff55

SHA256
18cc8eea7eac0223ec5177c7491732a868392fd5aa31c97e3d2b55bf8be6bc86

SHA512
2f46b4946279537b4ca6cd8d219925cd2faf70f5b57ac0351ecd6c4f420d714487ec0b4b117841510d1072f4201bb78669bce963440aedace8df2e168880ffea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1dfc764e765361ae47e508aa1bae35f2

SHA1
0a510855c8fa68980fcd19f91fd573a6c23dcd38

SHA256
cfbc75796ee1c7db7c4bfb2a6921d035a44762793591121f0385841520381c72

SHA512
db48138111ae0bbfc17ff22d2b52c108c528a7fd0751cc0201f603cdec5c5e12a126b6578e6fc9024a38ef7547c269cbbd4dc7a6e72704dac57b5b318205ab77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\331b2f96fa7e13f557421be906b694c5dd9e7334\05ddc7a3-2fee-4a6c-bef8-ac0d828cb472\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\331b2f96fa7e13f557421be906b694c5dd9e7334\31cc3419-7d51-42a3-8bc2-32336eea3864\index-dir\the-real-index

Filesize
48B

MD5
9972cdfd058c86cd3e4ec01370086b9a

SHA1
02e03fea530df00a54fe986e47d613b40edf9a4e

SHA256
cd0866676d36af22f1b60b59d34503346562273f12e1bdb2349c43d509600c0b

SHA512
8265f6ed1de9b11e4617cf747417d1b195a00a2d31169d94aa37727d53aa88331b8aca3355a44512eeb570b515788b4803fbcb0a5bde402d47e3772cc1ed4633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\331b2f96fa7e13f557421be906b694c5dd9e7334\index.txt

Filesize
113B

MD5
bf6a3f53db471de8b7ddc4bbfc7a703e

SHA1
83140d72113ca81a3e40c89d58017d0b062753e0

SHA256
0431336322c58b4f19b8c01997d802940031df79d51463e3766eaa9e7dcad02e

SHA512
58f519c03f8a655f2846346e65c5ff25bd705fab15b2dfec5ecaf4e8f90daf67f60c1745fe344eb65d992500a3552ee705a821f51d4971100c4e2f7a7ddb1d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\331b2f96fa7e13f557421be906b694c5dd9e7334\index.txt

Filesize
240B

MD5
6a7591cc65fac25afe6ceee8db50a011

SHA1
cb699bc83362e7d5fb744e6ca81e0336cbb319b3

SHA256
0c34ad26f7f7858c420f97cc6480474a6cb3653c3ab6965a0021c9381327b22f

SHA512
8d4c36cac5bcb4fe9eb177dddad8ebb3133891b96cee7cc14bea4183130ea9dbe4470c71cf71aba05c54e724c3aa39d2268080b86e25895fa9bf434b1cf8803b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\331b2f96fa7e13f557421be906b694c5dd9e7334\index.txt

Filesize
367B

MD5
ce2f141162f176635b5a045f807a8f58

SHA1
435f3482a0d890d6f555b0274c6f476e329af352

SHA256
f0b2bdc779f27ef18c217ca0b26cd54681e3b3819893f6ac2990fbca7e3e2557

SHA512
a6fc43dfb1d8f1bc3de10c953ab85c86fdc797cb45ebcee3246e4314a0c5d0c56a33250ab549d872bc107f518dd082018a800130c545fc3db95855bb38f11277

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\331b2f96fa7e13f557421be906b694c5dd9e7334\index.txt

Filesize
495B

MD5
b265c6b41b72da7d5a1c4ed7c19e33bf

SHA1
49566e8d01142ed58d01cfb97108297502c6e2df

SHA256
cdc60387f6d69e78610044eaa7a2075feab270bd7e818e76db155ef8653579ad

SHA512
dab82fb96a678da34b97753d3656f812ff11c3dbf2c643070e5751e202ebf86d153093814bdb489e3a84bb563a6372be8eda81bf9aa55876251a8d62808d8263

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\331b2f96fa7e13f557421be906b694c5dd9e7334\index.txt

Filesize
625B

MD5
83eeb1a1865552427f63eeb328df1da2

SHA1
a4740fa797c1ea6e400334ad6a006937e057076c

SHA256
81bd3bcc8f4a6c61c4b2a5b22e9bf216ff995170b55985d1cfbbd94ed8c4e826

SHA512
15b770173f372ddaf71a6ae90b6edcd35e6445206bcd184aab7d1a3d2533bee856506e29ad12f9dbfceda97737c75b7e7ea0de352c31c79f6d71ad8910ad9b68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d474f78c6f2d3e39227b4dc891a099f6

SHA1
d6d738384dcd79f6fa14078c699b5872e61683dd

SHA256
dc8a941480ed9f4ec20793ed78bf2150d800a9aa75570d563093c0261f5fa820

SHA512
e8d338e64b3ab381f50ea9e60937416de11303cb0d14f44831e6a5fe47282f01f0dd57685fac7b17fb7b6efa2674d71a9090286681718436ded3337f4ab7c70d

Download Submit