hxxp://instagram[.]com

Analysis

max time kernel
840s
max time network
871s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://instagram.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540404634-651139247-2967210625-1000\{5F0B0B26-824F-4B23-91A8-E317B13FD05C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5112	msedge.exe
5112	msedge.exe
1820	msedge.exe
1820	msedge.exe
3960	identity_helper.exe
3960	identity_helper.exe
4044	msedge.exe
4044	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 4904	1820	msedge.exe	82
PID 1820 wrote to memory of 4904	1820	msedge.exe	82
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 3704	1820	msedge.exe	83
PID 1820 wrote to memory of 5112	1820	msedge.exe	84
PID 1820 wrote to memory of 5112	1820	msedge.exe	84
PID 1820 wrote to memory of 2736	1820	msedge.exe	85
PID 1820 wrote to memory of 2736	1820	msedge.exe	85
PID 1820 wrote to memory of 2736	1820	msedge.exe	85
PID 1820 wrote to memory of 2736	1820	msedge.exe	85
PID 1820 wrote to memory of 2736	1820	msedge.exe	85
PID 1820 wrote to memory of 2736	1820	msedge.exe	85
PID 1820 wrote to memory of 2736	1820	msedge.exe	85
PID 1820 wrote to memory of 2736	1820	msedge.exe	85
PID 1820 wrote to memory of 2736	1820	msedge.exe	85
PID 1820 wrote to memory of 2736	1820	msedge.exe	85
PID 1820 wrote to memory of 2736	1820	msedge.exe	85
PID 1820 wrote to memory of 2736	1820	msedge.exe	85
PID 1820 wrote to memory of 2736	1820	msedge.exe	85
PID 1820 wrote to memory of 2736	1820	msedge.exe	85
PID 1820 wrote to memory of 2736	1820	msedge.exe	85
PID 1820 wrote to memory of 2736	1820	msedge.exe	85
PID 1820 wrote to memory of 2736	1820	msedge.exe	85
PID 1820 wrote to memory of 2736	1820	msedge.exe	85
PID 1820 wrote to memory of 2736	1820	msedge.exe	85
PID 1820 wrote to memory of 2736	1820	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://instagram.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffdc046f8,0x7ffffdc04708,0x7ffffdc04718
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1700 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3388 /prefetch:8
  2⤵
  PID:600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3304 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1868 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2164 /prefetch:1
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1368 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7049628764539339628,14814234670172607120,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3940 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
68KB

MD5
0ef4e0ff1523be10a15abca02572955d

SHA1
f855a1b51dff2292f18ef2ac604a656ee75557bf

SHA256
cc98587bb2cf1a0a6d2ab81b36d0d1384f5bee1dc7a6b73d6f3fefd853dfefda

SHA512
fa560cc7502dd6fbe38283c9366b20b94c022feb4acbccaddcfd21ce32820058c0eb79087ec6621e7babb3df21fd4573fc66cc1971514ab9670bc5d9a7e2d2f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
29KB

MD5
0ce9a7855890bf0c9d3d5cf5e89fdc7f

SHA1
da6b7e2727eb8007d96a77d81005844f322610c2

SHA256
3dd1ec287849a086dcb9050182571fbd7fa36959af312a8363e9c0cd6a2a2cd6

SHA512
d1659a326a263cd614d581d006e3d418907bbd89684e99c802bb6f00074e24aa77710283268ff0fa90efb0a7a5611dc966033d67f9ba974daa394968ffc91338

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
6KB

MD5
fd5b16a0fba01bfae552d7977d588c99

SHA1
509d9253850a658d7b471a3271892787ff031684

SHA256
08ff91b09afc27b8746df67709d3ae7a7cdaef89d55d6dfc130d7ff1cb56c491

SHA512
895e0583e01711b907cf9ff6bb55b22f011e52a3af04cb79c6c173c9330f857e822788a326a1d4c6652b0b1f9a45416ffead5326be68c5f9383e9dcfb4e5c101

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
273254a5738f2ec71d37bc43f23fc5b3

SHA1
6f611e2fd7c9c18f2d313944738b5689cee3349c

SHA256
5c222e41505f9837cb83ccc54672ec17264a95bc8d8e4be2257f1b70afab563f

SHA512
77fcdfca8886b65f413207794e4d2d2bdb0c55f33be20ee1536b39d0ee1f1c4a0492257cd810068010f42b4849a040c26ab73550753d689f12d74ef8c9e25c78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
65c218b9b09ddca7a173a489f86fe173

SHA1
7fd574827e2db576053099979810979446ece9ea

SHA256
1477f310a30bc5d46abc5aeb98695ffe1d0999eca8474598e15fd37a9b778abd

SHA512
d222a563c4011d7f62a18d758c09c319579d0a14f639711568f783a7bf18393fd9eef799a0585ef871ea54d773d280307c680d6110f06c2e6b8c73f378c7cf43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
21298ce06654cfc3e5b671d441fe01d8

SHA1
a5eeef360d2571df2c5f72a89df24d1f7a867cdb

SHA256
73b6584eb6dc8b2534a894ab576ef4631ebff3221c6bdfe1e5b5a5c45050deef

SHA512
3d2a85e664a38af9643cee06e2a99dbdb9fbaf8e44d8d73e2f5f7c088cd031a84e4c01b2dfbe7fae30d437aa8e1472a91f6fdc5c194a25016e6b6d933d597a21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
33f8119702871ad6d214b4bf11034d1e

SHA1
982465fa3802ae1cbcec393f8a50854e4c1c4b11

SHA256
d73a447a084647f434d3f49ba3b39c9dd5e986f9575134947f9defcc0fe5f331

SHA512
133bd7dfc8b07bac2bac577107cae1893e49f820df8c475a5d2d7ea0653fa1980592dd2c57d48a03c6d60b862a5559fe689a2f46feeda7d0b1c97f3f702927e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.instagram.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ec2ce8ffc1930df646922c436555f2d5

SHA1
514371b49aa3690eefd535614cf9a72ec34fb1ba

SHA256
c1ae922b5220060234f89f834cc4eccf5cd334a590af244ff525314143996868

SHA512
62255c0a320965a0b5940a8694ddb6590015d07c0e3dcfa6a86aa66a37da9f1c78460c6b100abc3ac287f3710cc0a18ec375885c3e844cb053fe062be82b4a7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6b205d6b662b83fbf7200b394d973438

SHA1
43de6bb3bbd8ddb60ce6b1772254be8018147716

SHA256
a99dd2deac2a715767f38c33c101fed7393021b3eabdb2735657804f0105a0bd

SHA512
57708ac42258c59f4adcc426a44a440008e25cfc75c22437587413f18fa9ead908d4cd0947f8a129c85f3b751020925d7adcf1d922702aa97e7e7613890ebdba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4c3842f88d4bddc0292546bfe87776b3

SHA1
bc60ad51d915167aa1f6b47e7d14062642fc9b75

SHA256
b3ae2bf9ab6e1c34c295a4596a4a529148cc19d37c29046a2e9b6da0fcb1f532

SHA512
85b27e61d270283ecd385bccf5ce2cd7d19492bd7b20c563a8502a8eda478a73f9e30a9db89f163b1215c1a4beacf155ef7ab496b637215b9ec4ae841e3eeab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
420f03f6078d38365a6c265d49cb27fc

SHA1
f0b7a776592b539457b0aeeff2bc110419f69347

SHA256
5fcab1267cb5351061325979c8eadf0b88a7e0e3a834982fcf32e1a1c04c8501

SHA512
c9fa77b2ea65c55c71604c11b1890d883ccc8784c66ee681aa9db9741d57b89bee63a1abad92c082050cdeb5499848639fdc1077104152a533cbc97072c0c111

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bfe416bd2fb1fde630596726e099ee4e

SHA1
af2a53e45bf2057f23ba005e670f30c3ce4d8910

SHA256
1dad31ebefd5cf1af1e18e283dc3624efe731c4f04f0d3923f00abb65ac8c95f

SHA512
e1530c5023762e09e69fa99dccd31aa0038a3dc915e4b143e07eaa61c0a92e158474367945f29022d595e2991198e7e5b6bed10ff87f31ded9cf185fc8e1cfc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
962aea2d9ac25899acf73d7a94f7defc

SHA1
39e4d5ccc4d8c55047cab6862bbc3123339a9f20

SHA256
a649104478d623a029b729738baa147d269b755df442200546f05358999398cc

SHA512
7f725d4d324df754dbef31cdc7f9d1d72e7b6546182af12a0b4e1228c7328e325d17aaecdfb06cdf98298b388952150d0a9d37a7892fd050dd6503b16d579913

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
82bed0f00baedce0f6910d40fafe3b45

SHA1
03780567ebde616b0dda4b65ead5d139f849f541

SHA256
bcf015e42f03ef336bf4bf075882992c99ec4ce57269ed73477ab0253c9d2796

SHA512
640a19a2fae008267cca67db7cc06892ccebd4243fd0b6f4f0831a6b8ecf4ed798f38fca9ab82bee9f45c34172546b48a54bf713d2096f75f1ebe5e5452f11e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\7bbeb5d6-616a-488c-93ae-34099fc61bbb\index-dir\the-real-index

Filesize
72B

MD5
1337e32992ae2de7a695e12def342ffa

SHA1
d6ad1f7b2d12a993dfc50baff0d6aaf7039e5610

SHA256
c86b54daac8733ec3edb759d03416c566948f802865213bce0a59f4932397a74

SHA512
12acb8567e33e0b3b7e81b6d7fbb427179ca395fb4fce9064a2c7cbf912a23928bcb620186202bea07a7b1e72b8ef43a35035cc42080f7e7889a7c5800861dbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\7bbeb5d6-616a-488c-93ae-34099fc61bbb\index-dir\the-real-index~RFe584b2d.TMP

Filesize
48B

MD5
255bc292dc9859027f19fe21034e11e6

SHA1
9f44d1ad1f4bcff2d443fbf6d474fb43007b8b70

SHA256
7bfa56e55bc5812e09197bd1a309667526b12fa80d8cf37c2c9bacf1bd7e02b5

SHA512
533320fc8b37b166bf3cfa06c9159aef8ecb95c9d4a131d59b79da22973438a1ce7e34613f212c0b00fa14c592c8e58fe0b15e117aea667d76e5abc126d0a51a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\aee316a9-94f3-479b-ae00-eb1a6ab3926d\index-dir\the-real-index

Filesize
72B

MD5
df403ae2cefdccec346b3c0346895d56

SHA1
18b6db86a659809283f39e17e3c3e5f6b2db35c4

SHA256
263dabdf638c23066951a05f1b21a2ab0099726b66385325ebdcf8b7addce3a9

SHA512
22a3c19612e78ff3a04178af170684b0bff8382f115af6e0048de8656298733b0f1dd1d9069efd439915952d9aaff75aa0899ef621ce635a20a9e71aaed73735

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\aee316a9-94f3-479b-ae00-eb1a6ab3926d\index-dir\the-real-index~RFe584b3d.TMP

Filesize
48B

MD5
30cd5a70ae6adc39f9812fe44409f1af

SHA1
01e31db9400f5a03c489190a6efc4dd48dc88689

SHA256
08d2e1126b95cce7b9144bea8d03a99607497ff863b895b0fd60f98935a32895

SHA512
f907e1014249d15097d3f12a599fc765881434858ac75736137fd71e18c22b1f27965a26f74e3f4a42d16606e86cb2b7a408e8c999743c4e2cd85271dfd2ffb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\index.txt

Filesize
155B

MD5
5b1da1df834bdc655d960b01534e694f

SHA1
87bc2bee11df63cddb0f227ff8852ed540f586a8

SHA256
44d738fe9fdc230680952e795191bed0f225ff125562fea7c050bb3f870d3808

SHA512
9cca33be297957e46dc6890ca831919d7e1bba6a4d3e564ab6d41b2b6a3ef8c1a5f5d9c83585c88c04b0369b235daa2934a4175347da27d8aaf8cbe611e8fd0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\index.txt

Filesize
160B

MD5
5a6b4f29d07d294fb680d6053d5a1171

SHA1
cfcecb2e6799b573cea9e4c3910e3ced87d553c4

SHA256
838a7a97f7eddfe25cfcc554a31e917d1d891f4fc1da18eb1a72f47b4c5cf179

SHA512
91619c4f01f445a217bce22ee8fa3b161f8e96f9d20810712b7b42c1abd21b778b32122c78a9a92513eee0431d228523def7bc294b603e5a7018d6104e6978ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\index.txt~RFe57fc71.TMP

Filesize
95B

MD5
e6532e143c05100cd90d1e4c4ad2fd97

SHA1
aee61b49dfe854b55b4b3c8c2f88f9f75eae603e

SHA256
6ce8e68bd70549b1296b429ee472034645303eb4ef37b58c7fceb8edf287c6a1

SHA512
4ec8601c23d67031582355598932a1c3a12c154dea57bde3991376993d2a8cf77c42d8fc73f5d7a157f6a76881abd3d9414f93f372a8cad1c7e95a898209f0b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
0efc54af4839f9e85a4d26abff5989f3

SHA1
89587899735320fe99a7329e82c5028641fe8b69

SHA256
8fcaa063c9b5693f8233b68473aeea91a5ec8364a5004766730cffda76e76127

SHA512
095b223480aa937c52a0ff9782bca2c2e024c2b7995820a231867c95bac857c727d98261eb37a59b340ad8e0692507d809bff839842602701a1fdd952cc0a6e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584f54.TMP

Filesize
48B

MD5
d054c7dfc90a5ad86c99c2a2f75ca47e

SHA1
3e9f08382305673da43852b4f337bbb696a812f4

SHA256
b43d887fc7b0e1e59e881e7e2d283aac93eaa37a8f813c91d99618c8894fa997

SHA512
2c8450ce9f69f8a5eb5f203f2281dac0800e3b31d9ca8ab5a402525c25b068c0c1e19b4360587fc0f299dee14b4aaedf904b05e54c3aadbfa43785dab9445680

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8cb5e70ff422bc615f1e723f19bf2489

SHA1
966825c74a4a278d740711388a603dc5199dbaa3

SHA256
a66d3c85c75b43d43535a68f7dac1ddd52acdafa57ae9f685ed96f6c3f012745

SHA512
17349e0dfbc40587f05833ea0c8916b23e10f7af53b1e3c227f3529997e435a9a64faa66015f87c6e635571d71e11c2ba41ca15fbe6b4d780d9f4d5997ea6de7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
224f865792c8f0554565a44aa4bcd66d

SHA1
44d3576b7338f9c822f947f1dd210186bdc805ac

SHA256
eba789dd7c8aa2c0455eb555759ec5d833a49c26f633187eac733c11e90f9f40

SHA512
224e267fd92ec94cddd93ffe13216791fb84e496ee8d9efd9f5ffafe6a91a9e46225c98eb2c7a82ec2bc676ec632908217723dc7c63447c6bcd5b127f5b7b3ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
014ac863bce31392e177f89e4f121d07

SHA1
a639a837e67d12ee4198f42b84521c6185e8f2d3

SHA256
b0e1e26c92b5aaf07d5f4086042271c089c99d0f9d2b462907dbdf41563a8b27

SHA512
31c837598ba7e6a7246ad6c9858b41af8c1e529e0d728379e5434e8a28e4dff3f3d4052f16987dfc6e8bf62e3a10aa8f1245bba0c93d101e3604bb069f6266cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5b134bc5f245b92b6787ed4012e9213d

SHA1
77cb5db815b9ac3152ba0cced35d62968d007540

SHA256
7cb54e867c7ac54b5a7d53a995a1235816f0f1d0523bb45ad31e172cb5662f0f

SHA512
882f1c2fd22c5ce1bc79d92171f344fc2be264150cb8d9ae339c4e344716d8e462735dd430ed29fa99fb07b2896e620e9b28ab72e9928ec2a16129350e9df5bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
13cbeb06c2287e5cb14ea92a85095fdc

SHA1
fc538e0e155929c1b16041ff5367538ab6757fdd

SHA256
27008845a1a3d96343ffe2937708bfb981833e2ebd8067dca65cf09a920bf47a

SHA512
f4de8fc2061de643aa3f1fc68bee2d46d793e1d368a9a9a09f810ee8dee415efd999a761ec6d3c699f337a8b0c420e845240c27109b71a67f503645a40ef025c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
90e9afb7375a453f878f282573401f4c

SHA1
c56897926a08cbb831086d612775319aad172d34

SHA256
2b2da1a5d11eda7b276926ee0da55b5db374388a4c6cd7ca070194cbc4f1a65d

SHA512
e1b7be0b19b38502aa96de33c50f395827950fcc3919b60288cf2398d0204e7a1fe3b47fde4b0c7677e77583678d7ab85a4bc03ec4755732eff53518f3fbe0ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2648ea21c073725193a7e45add865d0a

SHA1
ada7b3e4b411ff3d2abdc0a8adb054b525425193

SHA256
c53b495a35d048cab60469b830dd1cc44d13bec86d4092a7d693cebe77648639

SHA512
6a038a3b6539cd381fd430804c53e9987ed5b55dc58fbf6db9230f0fee6111a8df24c504f0e60d6c730aac921b3c65daa3142f72225251e02d88f76f5036fed0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
588b11b05f30917d9e8a8f73f39a9c23

SHA1
930dd2cbc3a6f05234cd864e8e759ba0337f60d4

SHA256
d47903d19ab9e696446695c3d909035f832d8bdc1bb43f497350d5cce0f52efa

SHA512
27b779dbe6833907e7c13b3b6021715a1084eb3662bdbab91546f2a93dab347aca341cab4e65b7fcad84d803198e6ffd0db5cf6c071f1c7850a2eec826044aad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
07418d4813367ce642c82d43addc7d97

SHA1
a9b3d6cda760cea70edbbd990bc483a42eb4c1eb

SHA256
22c4e3daeea7731ef20e2e6ec8977a81dc33357260a14e12bf49cc8bdbd895d9

SHA512
7d5350cb894272993c8675a5c5ba7df0aa04bfa262c8f9a40a0d2704c47bb2959941058cc32324699fcc6278ed1ec698160a05d444b0c08841dd658d2dc630ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6521b8ddb4fad591af7d053587521680

SHA1
b205c7a729ed82227de8f1b4e3d5b2c9fa2554c5

SHA256
446f06a12a8d7a4d051daf2ceda8ae700abf1ad5cac067c8a5f6e69ab387ad08

SHA512
f9d94146675568c63bfe55784134bf4f5944b166fda3fc54ce1fe98127dd62e639968bc5b1779848267bab229eeed009ac9ad378c36da6fc1535697fe1ea7e77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f1cbac7882938920786d94caeba81a3d

SHA1
12e618815df61af3479b5be0ca3ffe87857dcbc8

SHA256
d5c16346776206858a964bae5492a93e46c89f876dcaf8c10657c4a32c0587cc

SHA512
5c6acc2d5dc95778f56efd5a573f3be0b6aff629f3cec6103dbe6f051e447746e3948bebe0a09e869574e2c57ae496b8085230af09ce89e758fa71011a62e04e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
68793cc92e8e9097410787e95418b9b6

SHA1
becfdb8382ec24cc5450cef6442b6134833202e2

SHA256
3f67881278fbbbbd602d5a2408165e999e806888250abd92dec1f2a88509e5e3

SHA512
432e8ace9d7ffd8be4cfc2c0d32dfc23263f1696ce6ffed551eafe1896cd8119c5dddb5c8c87b5b2fd3b70a86abf51d4c4007e41dfe186fd6e6db3af741d8b5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
03c34b8963de657f8ff29e844f9d35ab

SHA1
1dd2fc1d67ec00e6ec055c46bc5ca0b5fe5891ca

SHA256
63c59affdcb0ba86af6a924a19b84038e24813e94536a1b7652482a36722faad

SHA512
7fb354afb1641c6b480473abca6cebcb4b589daa2977cdcdc1df90bc64c96be1a48da947469001536f37776336289509365cd6beefb08e5ac46004b81c2ac544

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
9535ef0c80aed3c0c350ee4b74425e37

SHA1
f6bc7fd3ed32584933d8df80faf9f4e249e41961

SHA256
28ffbabb00734b9f9fc3fbd8bfba24cc554334d8fa845b824745527a2ffca27d

SHA512
3448de75b6b9664af4a0d007538b4814f35db182ca1103975623befa70d11e0ff57a55d88f2c1b82f0636f6a60b67fb20885a20efcb551f78f89a48667eaa421

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
75fbb263c07953f8a3a8725479a44991

SHA1
6547e6ca80375c54cb8fe3b7b02d16007e594cf3

SHA256
c9b1379804c4ac28a9b29e2caafe0827280ae26a35da3738a0276946c182b37d

SHA512
a7d03b9513f7376eed17951d7512d88541147d01753eaaa0df5dacd6ed620111b6badcb9b40f962dc45b7f49f386440a654a2b5443094937613ef95f23ac2595

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
47d9a62c77ca6c8043a5f3715845f872

SHA1
f010b8478f44d8f5da46e0e3898d2fd5ff734b45

SHA256
e81824670639f9672dda7f02d179fdac32caace3787a7c1451f20fac18d28ff9

SHA512
acf03e08f8f4c050debc255db4d67a5b0e276f853055ec8a94c3c818df7f6f63e6e415ea337976d2a0c59d9b0c38407970de4dfdd53b820d82658f6af4367a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7b5eef7334650f45146a0562b06c7021

SHA1
f6f353e1dd3c58b5328326e79205ca6487bd6181

SHA256
8fc713c2ad0f239deaf11961b7e80ad375da76e7303cf677bb0f168c7f0a27db

SHA512
9a1122edc0f4f223ae88a989be8ea5d26004b333382692442d067aa6cd0365daa38c9b31ecd8ae3f221cfc95d6919cec617581ddcc906e7ee48463d3ad31acff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5981790bd12b31a21883cec5f4637471

SHA1
2383bf60cd4c3465c9e07a4829376c48a7406efc

SHA256
b583ffc6d129bf1b5f2c9f125354de2a8eba6d4dfb884770ec5c18914dad2dff

SHA512
0482754433429e797720e887a304817974a71be633aa0baa75e27bf33ee4b34969e6511e6fc2c0ec93e2db91af145baac4b6f3783e15b9188fa2bcc97f5f1c8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7b6b96ece3da7049ac193dff79e9ada1

SHA1
5d72466b6ca4e77295340f106f8ba4a0512029ca

SHA256
8942c10571cd4c99a774f3b2e9d054bfcde81736a88c94087c2aa0481ffe021e

SHA512
3013afcc7345bc59fc233574bd7c8d77bfdf1657b2e9bd74bf1bfde3b1737a23e03bbedd10ce2fd2ee37de3eabf1ef8a62090f2df812f401152a69225d80882d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
189f4029f7dce546f087508f9e5404c5

SHA1
346f9c769d3c0aebc4a0292e56ddaed4ec1aec81

SHA256
2318729926def04447f1ba357a29b893e056fc32533dab82fbad6d62c1fa597f

SHA512
545a567ec71881cc74f303bd876a0f1fa8e00e12843ae7437e7bbedf6ce4b17473e3ec8512960ed1f020f98a6ba72d9e5479562c6702504500e9b59e8f6dfdf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57af4b.TMP

Filesize
873B

MD5
e5051f493416e5e262fa610e90375025

SHA1
238a53d24c9edbc96c1dd0ef3b424786f051f190

SHA256
e2f17fc917e785c716d2c19c3cf94f2ccc2e6d2a90e21829e6e8d5ae27f1e293

SHA512
05961714d931a012358be1c7fe0be11ad767fecbd753c8b5e0f95d8cadbe59dc9496aa57b6a5cf2707a5a6289a9b08332bc145ab82b72d262f0de8e6c412f37f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d08ee97b3722c7257b8db581983748c0

SHA1
c9bce729d9bbb345c9b100419d191be0b6d5aaf6

SHA256
4b9d8a0644ca7e68bb95df016b10c51ee0320c605f95906a417d0416c96dcdb6

SHA512
2ffdfe38537669dd0bedb98d56a731881ce20022296854ce86682f03751f795c6a51b97549e41c6b4f1af3749de6c8a3a81b9697f2aebfafec15a345f1bfddbe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit