hxxps://delta-executor[.]com/delta-executor-pc/

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 06:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://delta-executor.com/delta-executor-pc/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3348	msedge.exe
3348	msedge.exe
1572	msedge.exe
1572	msedge.exe
3092	identity_helper.exe
3092	identity_helper.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 4652	1572	msedge.exe	81
PID 1572 wrote to memory of 4652	1572	msedge.exe	81
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3296	1572	msedge.exe	83
PID 1572 wrote to memory of 3348	1572	msedge.exe	84
PID 1572 wrote to memory of 3348	1572	msedge.exe	84
PID 1572 wrote to memory of 404	1572	msedge.exe	85
PID 1572 wrote to memory of 404	1572	msedge.exe	85
PID 1572 wrote to memory of 404	1572	msedge.exe	85
PID 1572 wrote to memory of 404	1572	msedge.exe	85
PID 1572 wrote to memory of 404	1572	msedge.exe	85
PID 1572 wrote to memory of 404	1572	msedge.exe	85
PID 1572 wrote to memory of 404	1572	msedge.exe	85
PID 1572 wrote to memory of 404	1572	msedge.exe	85
PID 1572 wrote to memory of 404	1572	msedge.exe	85
PID 1572 wrote to memory of 404	1572	msedge.exe	85
PID 1572 wrote to memory of 404	1572	msedge.exe	85
PID 1572 wrote to memory of 404	1572	msedge.exe	85
PID 1572 wrote to memory of 404	1572	msedge.exe	85
PID 1572 wrote to memory of 404	1572	msedge.exe	85
PID 1572 wrote to memory of 404	1572	msedge.exe	85
PID 1572 wrote to memory of 404	1572	msedge.exe	85
PID 1572 wrote to memory of 404	1572	msedge.exe	85
PID 1572 wrote to memory of 404	1572	msedge.exe	85
PID 1572 wrote to memory of 404	1572	msedge.exe	85
PID 1572 wrote to memory of 404	1572	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://delta-executor.com/delta-executor-pc/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff201c46f8,0x7fff201c4708,0x7fff201c4718
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,3513287064035065313,18172508244128021939,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,3513287064035065313,18172508244128021939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,3513287064035065313,18172508244128021939,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3513287064035065313,18172508244128021939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3513287064035065313,18172508244128021939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3513287064035065313,18172508244128021939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3513287064035065313,18172508244128021939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3513287064035065313,18172508244128021939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,3513287064035065313,18172508244128021939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,3513287064035065313,18172508244128021939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3513287064035065313,18172508244128021939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3513287064035065313,18172508244128021939,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3513287064035065313,18172508244128021939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3513287064035065313,18172508244128021939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3513287064035065313,18172508244128021939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3513287064035065313,18172508244128021939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3513287064035065313,18172508244128021939,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3513287064035065313,18172508244128021939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,3513287064035065313,18172508244128021939,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4796

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
64KB

MD5
8b37bb42b1577b08892393df19f534c8

SHA1
e12eaa944bff9ccd0687ac54811a3ada4a5d21e9

SHA256
6cc9e87df3ba27d6dd288a0593a4f70a17ecb0bf5cac0a591ff72f355a9f454b

SHA512
9dba0d070832cecab4c2aa922bd07395b7493845926a5bed5c5f86d61c3b2fff1f6fa12069b7b7abe4f15cd58775ffa238aa36c47e100d7ca544abb3bc1a29b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
19KB

MD5
e3bcc4d955bf08ccfffa51b0cc058788

SHA1
0b57e52d9a02516ee63100049eebd6596a5c0393

SHA256
856be9b267e08caeaaf2d75649d6d3023960a0365559adeadc230dbe48faccd6

SHA512
8ab0db93688aa184ea07914080a55dc57006414288ce4fdca43f2bd124dc9601d7c00e8399d0098db3b2f4c0fd890e186df19735e24d09d3672d236ca5ff1193

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
20KB

MD5
9a1a0b71ad14ff0187b5999422dfa906

SHA1
64cf9c68041fee1912f334ab26319f06c4505720

SHA256
aa661ba82db84cc445a4051c6ecf0d809312d3d84a4fd9ef50fd9e67b24200f7

SHA512
baa54f3bbbe625b01ecd16a3ed9d0603391b469ff8d15f44db81b7513b53821485d14faf24e78537699cbca0c3f6b4d247caacb796a979ccebdab3552be3e479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
19KB

MD5
ce1093c800c0933d7c9674eda75790d8

SHA1
371c2dcde092f51b18852e2617bc6c0c176f5873

SHA256
57781a723db9a2483067bcbc89d1f30f7e2f22ae2d18aab1e45ad894d8cdab89

SHA512
fdbb31c607cc9a4bd75c42cbc552fb40d82e53804d156244ed2daa124c75e1680b908589f7a3ad8888b9b03ebfd1f4b3e83e19f84e3a746cf210d0b8a1678533

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
18KB

MD5
fe25151fad2965222d7894dfede59e7a

SHA1
5bbba86e9fe710d80c150e05d780d4bc4b88d1e6

SHA256
ff0a4097bc0c1f877a59efb3d6be2a4df8895a8227f48022a70d60e33b7b81f2

SHA512
895402dae22248c884a0eb553298405190d3dee1a7efe997631c194720f8c76bf7a16f8c0503bf0b43377a582b05c05fa15deb1a84f600b8d2fd72cb860cec50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a44b10701ac1235d_0

Filesize
53KB

MD5
ea9db86d5fe92a632d99357fa5b854f3

SHA1
35b497e71d3d32bc5ead3eeba760b518c25fd2fa

SHA256
4ad3095c316c254162f52870c1c3853eedef3381eef055da7e1fe550d01e348d

SHA512
161e0d7e83903c3301565997bdeb68bc013d32c1ad4c95a214a0c70e46a3bbceffc7c2ca10039c3862dd85db9b3338958e98b379082d56e12aa7802916bf0e88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d313aaaf2cb995d90017f3baf0eccf1f

SHA1
5915b9d370b706efcb28c162a86605565ff7cdc6

SHA256
02cf265c560627e849bca854792b102ca0ac140f70928be8cea3e0b579e4aa3c

SHA512
4466263b0f6d64b92c7ae3384746bb38ba9975d0b5ebfbd88d7d5b9667f776853a6471ee1b13758161fe16d298d00da7b39b3cf710cb3ef69a883688ddb4e3d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
314ce15cf8e6ae79ad950f20c58d8b5d

SHA1
3e5919e4bcba6e77c04f1dedbb47adb486f50d02

SHA256
cc93d864a6106c1b651cf1faef4ad761257350faaf37487d68b0997e7105f8af

SHA512
3dd773d990b781482f4c188927d73aa3dc0079270330bc37bf66924f87e32644a5880acb612171bcca9088e1304e1b2df31f1489d1b108d32bb28a4124120623

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
56e9007e1409046c73c679a6d4d4b10b

SHA1
8b8e6c270865e7ed0e13ff8343856fe9865249cd

SHA256
a7faeaa07cb8af8bc5974942014ef7e27c1ce3654378f64c2f5bbd82307b8800

SHA512
126e759bea6e9e62449911244069fc93d245525e924e418bd545345f00600d341e03a6bdc994737ecbe46e4974cae3f707ba304cdef0d100de63690165564534

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
bf7dfd16542d31b0d0a4e6d8fc3a3326

SHA1
90f99184a9bd5f144311715684e6e74bc7443428

SHA256
c086fb8e7aeb6857a540c8573985b70d4029d0ab03fd27d6554a0f550e848d78

SHA512
ee93883332883d4b44d5ce47b6c2b5d5b98e27ffca56ff52c1586e04ad97b6dc99807122466ff3bd9b15e2c65db51b8e6b2967e036a6fb64b6fa3acf7afdc96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ffe92022d08104b490684f7de5e59f7e

SHA1
bbf660a2f487b7717b24d648b8827614c6b915c2

SHA256
f227c79e1aa066a66d62d85ad440886ea48cb5c4abba2b72a70a28a9826a4ba7

SHA512
16dd14c65720c28b0c0472e2b43590b55d88c27c3049cd7149d759e491f5302a59eb68ca2de242d317732fda3675614aee8016d4313aeaeb856cdbe90cb21f29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
47a938b7cb84952e81bf0f126363056a

SHA1
056257b41055a9c7247df582402422d94dbecd5b

SHA256
48720bb7fd20e23a118f5c06781135d71a39edca7148b4ff987eb694435062d3

SHA512
2911533adf49361301644b4825b72524a018afdee7341261ed18d637487fdcdf9ef27e74dcd6c2e53034c7a2262f64cdf884e42164da2514747df12dab1f4b39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0df42a65ebeed73b9101732d1b9e994b

SHA1
ecac9dd4789d6408b507a4d6ad8e574aaa6eaa12

SHA256
8179c54d2e217cd6b512819c03f3bbe437468b41a1548b0f09bbc19846a1d2c0

SHA512
3401a572c44db33392328776be06bc2c1efa6c23e04a8faa593acc9cbbcb35bdc845ec1000ae87e7800356a4fb1a77bedad3f119425a1909ce6bfab825b34a35

Download Submit