hxxp://ww25[.]screter[.]info

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
22-05-2024 23:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://ww25.screter.info

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
5044	msedge.exe
5044	msedge.exe
3716	msedge.exe
3716	msedge.exe
1076	identity_helper.exe
1076	identity_helper.exe
2772	msedge.exe
2772	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3716 wrote to memory of 416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 416	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4688	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 5044	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 5044	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4460	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4460	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4460	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4460	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4460	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4460	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4460	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4460	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4460	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4460	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4460	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4460	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4460	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4460	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4460	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4460	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4460	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4460	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4460	3716	msedge.exe	msedge.exe
PID 3716 wrote to memory of 4460	3716	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ww25.screter.info
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd156c3cb8,0x7ffd156c3cc8,0x7ffd156c3cd8
2⤵
PID:416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,3083388605608820098,14142132744017264406,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
2⤵
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,3083388605608820098,14142132744017264406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,3083388605608820098,14142132744017264406,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
2⤵
PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3083388605608820098,14142132744017264406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
2⤵
PID:1972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3083388605608820098,14142132744017264406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
2⤵
PID:968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3083388605608820098,14142132744017264406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
2⤵
PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,3083388605608820098,14142132744017264406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,3083388605608820098,14142132744017264406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3083388605608820098,14142132744017264406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
2⤵
PID:4076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3083388605608820098,14142132744017264406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
2⤵
PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1904,3083388605608820098,14142132744017264406,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6140 /prefetch:8
2⤵
PID:836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3083388605608820098,14142132744017264406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
2⤵
PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3083388605608820098,14142132744017264406,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
2⤵
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3083388605608820098,14142132744017264406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
2⤵
PID:3332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3083388605608820098,14142132744017264406,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
2⤵
PID:1104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,3083388605608820098,14142132744017264406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
2⤵
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,3083388605608820098,14142132744017264406,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6536 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:964

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004E0
1⤵
PID:3460

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Filesize
330B

MD5
ee29fa295c4ee4f8a196ef6b202bd389

SHA1
3508df367563a40294d91e915dab692fadc77934

SHA256
b4cf7eb548f24fa17e62e4aae07759c8b6cf3235649989f715d98ec89ae0a192

SHA512
1a76b80d71f3fdb58ece28bb49c34a3a88b13ccdff9967b31a6e78dbe62a5639bb43336daff39c11227ccc632a3850bc5d7da4059e91fed25fe989672efc09a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0d84d1490aa9f725b68407eab8f0030e

SHA1
83964574467b7422e160af34ef024d1821d6d1c3

SHA256
40c09bb0248add089873d1117aadefb46c1b4e23241ba4621f707312de9c829e

SHA512
f84552335ff96b5b4841ec26e222c24af79b6d0271d27ad05a9dfcee254a7b9e9019e7fac0def1245a74754fae81f7126499bf1001615073284052aaa949fa00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0c705388d79c00418e5c1751159353e3

SHA1
aaeafebce5483626ef82813d286511c1f353f861

SHA256
697bd270be634688c48210bee7c5111d7897fd71a6af0bbb2141cefd2f8e4a4d

SHA512
c1614e79650ab9822c4e175ba528ea4efadc7a6313204e4e69b4a9bd06327fb92f56fba95f2595885b1604ca8d8f6b282ab542988995c674d89901da2bc4186f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Filesize
23KB

MD5
04542d6e9db2e7e33c3f38ac74acf998

SHA1
07f7dc7743970977a44cfdb99c1978a12950fdb0

SHA256
034ab71247dbdc331366aca83145bc2bff549f2cd7ce3b2ce1500e799d0aaa39

SHA512
70b025f9672becf8e8401bb148662744b870ef4e0e02a5bb92c57cdbccb19306a5322d1b9068fe04bed18c32443d783e147985da0083c944ba7b7bf0d0017c4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Filesize
42KB

MD5
8f71d1cddcb0ee2521002fcb4623e36f

SHA1
3830dc49a8bbdc854d448c325da30418982fbe6e

SHA256
5b9692b6614733543444eafd6ba9d77ee140fbda064b1497b3daf13f047cf730

SHA512
ea8dbdc8ce35f365f726df9ba0858a3ae0476f2488c85d83594de453d117097e60366ce7b2d0afc225ddff9facd4e2153925d77df56cca20cfd0feff17c9335c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Filesize
45KB

MD5
b1ec0389504501541be1deff3225e38f

SHA1
fe54ec9ef93c754890d44ebfffee7143c9330e27

SHA256
f509cd6f1213471b34e2752c9e83d40cb74d34921aff2e72bab7b7e141d89ca9

SHA512
ac0ae43cf75b9ceacc6e1b7e04bc512b2edc278529565d8154db7c7aa097e5728f63f2de24c92f3c4f50aea38dd634ed7bd95e2f732d87f13f8a9b3bf6d90a20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013
Filesize
24KB

MD5
9661f391f69ddbf1e8bbf879c1c69660

SHA1
60e78567cd82d5dec158be4ae4d365f45412fb36

SHA256
59fe3fa5daacb2b18c734a563d4e8e9df1f51eb24672249ca4962f3132149191

SHA512
dd61b2a9827be092d779b36dc1c4f3983e78cd42f3b6bb07d61758502ef0eedc2fa562ec028374d072e1ace9d82c2c816d2bbb742523f43cf5a6371b79064722

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
9bbecde01b58e03654e454da295a71f5

SHA1
c4f3298806ed9f1a652559906e50c1af7f6dfe53

SHA256
dd28f2d10883af2a213704541abffcf46d95399a539b13d29c2ec6d82e4dea1a

SHA512
6ec87ac265cec42e97304590fd9a8605c718f649f3699471fe2dbcdee94ba827294230ab14fb69479c7bd29760e0c483f6f613157ef90abcaff4b3a398e6993e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
9107c48373c77ac4a561f080af2f8f23

SHA1
14ab4cbaffdefd3c7c9b2ba291c3b22757426264

SHA256
4e7fee32483afcfc87b18c71195b4e053900dd656fbfd18a94d615dbc958dcee

SHA512
0ab8c0a63adaefa69cf383b4fcf837c4795d5c9bf4f72e5f28d3b92035fb38bc4af380dfbecfbd86c8818da2fe3971275ad6eccb00c106b1b369b56bcddb5654

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
4KB

MD5
e6c0a0bf2f9d12f29822ca39a112acd8

SHA1
e45d84daa54a9f611adad1f58b8018402315b407

SHA256
73e60ae6dd73e856319b6cdc3147bb5c042486743aaa3e0af8002301f7da4ef1

SHA512
14fa64dd0589cb69c44dd5a523faf1a43171c6bbc65c1454e38aeffbe8c98dfe33e5aef9b8db84aed9cb852120d3985f895cc2e6b5ee2f20d3eecc750b630fb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
4KB

MD5
0317012824e8bb93df7098cc3ad7eb3b

SHA1
b3ce54451a694370ba540d0896b878b414d7f44c

SHA256
e3799cdb1bb1aa43bdfa2faa8f96899594dfda3f998cd7d4708cd088db5c10df

SHA512
79cd44a9f2a1cf2041146e225c62e735e3862eeceed9475af5d218bc3b42054d39ee19a8332efb204918cb15010c2377deec430bd94b00577ee984cceaadac29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
3728dedc72f1f3208e3402e26dd23085

SHA1
bc0f6f364960eec745eac66ee167be0a0ebf2b83

SHA256
7a8047c09157b19c8cb12671efde934934f93b25fed32d335a455ee0b57c44fb

SHA512
9fadd8b0cff9ad8ea625867be79e28ccb785fb17d7ae7d14cc749a281760931004f64641336c318614f9165d6476e5912b9615b5e832cdd7472138924e2f2080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
509ff1274eb3f50cdf7c29b269e3aac1

SHA1
025e971e45411a7c83bb1c46f8976c530accb49b

SHA256
9655097c5890c0d4268cd60d4d0bd73d21f2bab5c979556474b613f037c1d272

SHA512
0f0a4b77a3ebfc81e11921fc0377c6c8f5d1a992f40289b0ad64b98002eb828c825a8dcd99af09d7556975ec02a25df36cc9b1147c34adad03f4101eb8fc8489

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
9f153bf8775d3777bf3cf4e246a03cd5

SHA1
efd35a859b45b2205e5d7bde63383c23e3c79ae7

SHA256
9b52cf8a97e9f2b7ca2ce6c96b961b56cb69c40106e7172aa07c34eb8240aa6b

SHA512
f45ade649adb0763c680d617b9f3622a67e30075ab39613ce203ea5f7d64d71302958513f31b931ddd6408632238b8ea1a354d46b5c4a1e37df5e7ae554ab4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
56838ff20c0a05efcb3c929c41e4cade

SHA1
e8806caae85e87183023ab451848a6e00ec59e27

SHA256
4fa1d5698692f03f0bbddb776c49b773753eafbc82be38293f65f543c1f6cf6e

SHA512
f91f6f5b9f2a9d4b1b7c86031e3087d0e3b40df153635286fe194349bf94fb6227397dd6c393b70d68459baa86814d30abd082140255721fbc3f1ec936920217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
ad771878fdd195fc184bad3a0ddf9130

SHA1
ea8dbbe843fc614040ef52eeb66a5e7b75719900

SHA256
6c598f9055a196392d31bc9452f04e6debc64f450f26254f7b744abb072764c9

SHA512
40e96438027187037af692e879a9b9938fdce6efe04a402c03be63b618e398279c485da73593139a64f23b62269810ee34203defd7cbbf5166306b57a28b9a1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
413018669694e5607fec350c355bdb32

SHA1
655d0335c20d14bda9fc14a2b732418702057fe5

SHA256
d9fec5111dae1c906625d65db0d7fea4aecb89e88dc4745cba53dfe20cb994ef

SHA512
12a04f64bab1dc4d7df038b19470da5230d0eccc659d7e20b18f461c236e6a0fe41c1358a67c3a5393c22ba0296a8d9ed8d6cccb619dab7680296d73f95916b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
98f94f9371b3981b6166abaf7c2cafaf

SHA1
c3889ed86c1b12122e5788a90bd3e5cb9269fa52

SHA256
de832073aa5fb005b415d9440ba0953a0123aab2548af5bbc71844e32848fdf3

SHA512
2c1dd63a37a0d00e35db97116151717e7861f10ffc1665ac67d1271efbd91cf17d2af31838e7430d0e1a42f78669582da6e60979f0e960859bd108180ef1a5f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
558737be0690cf7e8e44b079e2fc9b67

SHA1
890db1a35d59a554ade084b651472cc05041b89a

SHA256
e5b49079a8a80ebb822fbca47ed020caac2e55461a55143b931e3274470ef1a9

SHA512
f19ad3de8b9ad37ebae99039e1f8130ee9e630aa20adfc8373486752958cf1907dcb73dfd3b8ca0486e4c0e9d2140471dacf6759c40739cbe49f8af6cc49bd94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
67a503264154240eda0cd0997834bfb8

SHA1
585536582e6fca121cc4c59c47bfb19e33fc9c1b

SHA256
ce0862ef340616604ee12744b8b27e6563c0549d5de9cc926bc7a46574b2d74e

SHA512
99cfda2d478341ec1928e477167f6654d9d23b122768b7c2207031c245a85f803336c2e5195c47f83b2138fc9e744b38ff13cd7ce85c80872949da4eb13d1381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
290f978e97d1b572e8811e122286f700

SHA1
b24874993571df373c905d216dc043f965f49890

SHA256
5d3ad81f41ab34a63d603e06923686ab859327ef1c1e33654a481f6033b3230f

SHA512
c2ba34402fac9149edf435fac7fd770750eac644bf5dd67e492f91dcd64f39b3f58c0f1b372068097bc9ba273b492478fbfc77c5975de4e76b5253dd216c5bea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
6c988d4d5e90aecb5f322d8a4b19d9da

SHA1
13e1274c2c9068a16b70dd3f1d45345305c61f65

SHA256
5a82a5d83b8881e011800ba19a67278e7227a70c8dc89ac2dcd305897fd713d5

SHA512
056f2268496f54ade50dd5262dba6b9cf6d4c5b5fcea631183f42be0ce39bd0d9573f79c2c6edc48fa1c32073648070eaf5bc5237dcdfcc80e8f1de84297f209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
a5004cf2eec8e2e729cdf011a04e74df

SHA1
5c4e7e8404919c6d711897ed7cc5fa50592f3a96

SHA256
a4c5fb7435d74905e3334da9fa68d33e7ad8e34494e80d89373f36247cc43b3d

SHA512
14660cc644cea3ad55f36307dc0575ce4e5e99c013d4046843acf5df4bb76d17da46b7f3fe340861ee86aa7b0823e9bf05a3807623fc66c040a4fed7dbe12b4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582a86.TMP
Filesize
1KB

MD5
b1593a9cc9e00f2aa1ada58fb3323a5a

SHA1
95aaf8d886cf48a3fbd76dc9b6dac23bab3fe02b

SHA256
ba045990fce422134e2c97d933487fb891f4bc229440439be355a814e8a4d617

SHA512
f665bd5ff0f46bebc81e03e7ad46edf2ea8c7065bf56d0a9f1f0e30fcdef14b09cf810ce8bae650fa0dfb5cc30b09026647055ad4839bb4d37bd2139937740b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
aae1794ec0b33279cc75fc23b0471355

SHA1
67ad940b26827863cc0925affa610c59d6ac634f

SHA256
b03298aeca09e0488a16affa5568e372bb3dae2488df20b8c35f97c7160cba6d

SHA512
fe2b475375a22b6a8c7cff49a655c33cfe32bd33bfbe41cb4c681e6b4599d0a085d8fb80a9e938d921ef77a34b207f8b51171301393751e6a70e545f8275a145

Download Submit
\??\pipe\LOCAL\crashpad_3716_YRVARHPTQZVCPVSM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit