hxxps://bit[.]ly/4ebMbZF

Resubmissions

16/06/2024, 11:18

240616-nenkcs1end 1

16/06/2024, 11:17

240616-nd39esvfjj 1

16/06/2024, 11:13

240616-nbtl7s1dng 1

16/06/2024, 11:10

240616-m93gbs1djc 4

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 11:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bit.ly/4ebMbZF

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1708	msedge.exe
1708	msedge.exe
3768	msedge.exe
3768	msedge.exe
4440	identity_helper.exe
4440	identity_helper.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 1556	3768	msedge.exe	85
PID 3768 wrote to memory of 1556	3768	msedge.exe	85
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1840	3768	msedge.exe	86
PID 3768 wrote to memory of 1708	3768	msedge.exe	87
PID 3768 wrote to memory of 1708	3768	msedge.exe	87
PID 3768 wrote to memory of 3780	3768	msedge.exe	88
PID 3768 wrote to memory of 3780	3768	msedge.exe	88
PID 3768 wrote to memory of 3780	3768	msedge.exe	88
PID 3768 wrote to memory of 3780	3768	msedge.exe	88
PID 3768 wrote to memory of 3780	3768	msedge.exe	88
PID 3768 wrote to memory of 3780	3768	msedge.exe	88
PID 3768 wrote to memory of 3780	3768	msedge.exe	88
PID 3768 wrote to memory of 3780	3768	msedge.exe	88
PID 3768 wrote to memory of 3780	3768	msedge.exe	88
PID 3768 wrote to memory of 3780	3768	msedge.exe	88
PID 3768 wrote to memory of 3780	3768	msedge.exe	88
PID 3768 wrote to memory of 3780	3768	msedge.exe	88
PID 3768 wrote to memory of 3780	3768	msedge.exe	88
PID 3768 wrote to memory of 3780	3768	msedge.exe	88
PID 3768 wrote to memory of 3780	3768	msedge.exe	88
PID 3768 wrote to memory of 3780	3768	msedge.exe	88
PID 3768 wrote to memory of 3780	3768	msedge.exe	88
PID 3768 wrote to memory of 3780	3768	msedge.exe	88
PID 3768 wrote to memory of 3780	3768	msedge.exe	88
PID 3768 wrote to memory of 3780	3768	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bit.ly/4ebMbZF
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffce4746f8,0x7fffce474708,0x7fffce474718
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1720 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,13992088475761813982,2226681313149774399,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4756 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
97KB

MD5
aed84a320fbfbc09b1bd21b6b600c654

SHA1
0eb6c6debe0c73c7eab83ac7245d6c0f893dc327

SHA256
fe0346f774c7363703bb08305a9c2254632b3e879d966a5ec1e4da8fca767f0f

SHA512
7cb7969ea9e7d77e36af570c83fc2557d6f6ebe68af056ece68f901009391941dacaeb57bc9916824d96d5cb02e98c9374a017ec7777509c801a0ce4904a2117

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
74KB

MD5
a4618cb4837ace59d6e796c6375344df

SHA1
be7c1789ab600623f0ecd468a89aeb852f002ea2

SHA256
c0e1bed7a1ae97342732651c422512f10d708f1722f1c683ebf33247d5a0414d

SHA512
c3c026aa68d77453dbf98b09f3c57f111dfd5ebe9f96028a9ac2ad28097ede8b86338c639c9d31a82baf3cbf2da307c03fee61da8c9bae279e3c80cf25f04892

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3e35ae0a457b764a_0

Filesize
277B

MD5
4c759475c4d4f2c58ad010ed22e14fa6

SHA1
6c56125f723344711e3b5def28bed4393fe13f56

SHA256
fa7bd34bcc1ba80aab2c4720940d355229329237f691fcd7de4ba17644e1a436

SHA512
adabe395adafb5673cad2b59b44ea4a48a33e8c2ebf1a2e1501dbbb2e19dc6cdf437d2c37a0e097fc1034091caed3bce256886c3493ebe01b06a5da1838f6e42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be893429907b75b0_0

Filesize
26KB

MD5
c58e4434113be22ec344dc376ec919fe

SHA1
142a49c0009e917708509f58498435343dfd8ff1

SHA256
2f96ab47199f6f53e2750ec57f5bfbbce8de36f1cb58f35ebdcecb58146674c8

SHA512
43840e60befe302a1367daa8500cacfeb331df95e21caa93dcb9cd6a13723acbfcb6c019e2bcffac79db298c834470dab0113b5a5b1d0849c39d93ca44456050

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c4ad3e991fc727e3_0

Filesize
277B

MD5
c0fff6a7a0a5f3360b97ed1c8cdb702a

SHA1
d5b5629187706f23a85489c500f225dbb022e36e

SHA256
129e974db17543eabb87e696323fbe4c717e53d21d4978e10059b523a4473e02

SHA512
b589771f7fd3bee2d38c6b46b8f881a5aaf1f7f57d63cbdc37ff91a378cd83b0532a83221dfff56e272933b16d36156007f00359e7c99f1c017de43cdfbb114b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e7e7abc7242abde3_0

Filesize
468KB

MD5
c7b04bcd8e71ed3695f34a226d2bca4f

SHA1
dca620b1730f9af5680fd8142ab260b3a2d77ae8

SHA256
2d0ac207139c86e705f747cf6b696036a3400056e1306e949d82edb00bfecabc

SHA512
d87b9e4771b3fe7f67c85fefdf3d5ef6eb298c49dbf6c9e87826d804c2c7bff8fdf087f59eada67401ab4892ce498acb66315131dc9ef5cf9d5d0065e0b52e1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fe0c4471d175dfeb_0

Filesize
256KB

MD5
7bb242b2342d4432e8ab0855616a5a65

SHA1
64eac814c4da20eb59081d38119c413748011a70

SHA256
d24cc18c655420a8904024c78f9c3338ee79e7147f072d67d67a9bdc8f830092

SHA512
7324ceb24e229bda9ffbe6b02af4e9a82dde0ca626ec1dcf7b0d867f37665b0a74807021820d863d7cff8a99ffde2fe8678ee4ffcd0bc205bed3dc7df0592e59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
be3c08cb737620b29104e94524bf3d24

SHA1
8f1cd3d1704092d16fd31ee8a7b10189743a45ec

SHA256
fa687266fd8b2eae935d8e34f1562578efb3236307c84c250df09a8d42a8d01b

SHA512
c4d32ee3bef8466faac601eaabfebd112c4aca03feac0a314de5fb2e84e54207a94ef107a5b2f706b3e54185db7e768050ea09d634c578ad89a4b8cf170b7458

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
3fea7207ef944fd98176fe51f04e1e39

SHA1
fc36d6f4dee41a80d7ce19dc3a90be9fa1351ea7

SHA256
fcc57ce5f0bc62b4a686d0e0ccd91a5e3a2568406243c35e10bda0fa87ecd5be

SHA512
0cde97ae1a737dda268cdf520bf8d0119d09d8fe2f8168434ac705915bd7a9a213bcddb32269d41485f484350e4778e8be133cf50e4a399256e66a5dc07fe305

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0eab24a1e41f37048dbda747bc36fd0d

SHA1
2344fe96997a6640e38c18ce116cd0447c8e19dd

SHA256
950acdeefad5ef160265f2657d0b6a2df84e9f89a4306fea08eb8806407d16f2

SHA512
dc893d5380013a661609b3e38fa605243973126de0abffe4d8ed23a1a752184b46b9ec905d2d21bee639d9e4240ca9b71e712de4de18178efc9c41fab03d6457

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
90e58557bd72740e79e5adf27b894207

SHA1
0e7946eea7683dadc3b503d827a666b118b1258e

SHA256
2f3a542868f48158f8b6459250e70825240c0f0ef89aa3e4cd276eaaa7b37925

SHA512
49629413f58f53f0566d457cf1443af675be52696b3d844cf3f97c91254a24e1cfbdd848b259b84f40fdf49f756c62697fd4907384fe2c6d134eae715c98b072

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
e5be40a4516ffbdf902fc5364f08c51a

SHA1
d75214dff6c4f90581bc6a6dcb6334a3fc0d64c3

SHA256
2651b6295a831412ee30f57f40eed6dc862879c65996beb0901383b7317d593d

SHA512
001be732116965cf6f084b2fb3531d0fd15baec4f0843fc1c42bf8d57396287ed1fc89e512e7fe6e5e8bc0cbf55e27ddb365102e88f84a3a3dda33104fec1e19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
1191b5262ae3359378f1a32b62169ef5

SHA1
d03d790cf9a31e98f2926871436711456a46595f

SHA256
74c816591ab4e6f5524da3a9ef6a747a3da48842c25096352e76fc33af46972b

SHA512
3d680f60bf3898a359eeb921c2ad44468fdcc3fcb62633bf977cf62d85c545a43ed04cf1fa3b51ccac7f99c3226259c50f4b26aeea659557e4cba8db0aec7f78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea3fb2ec10e00fdcd5fa511b59ced35c

SHA1
f8b61bad4df1831a409c7af470364cfd8eccfa13

SHA256
cc48cf54bef6f50464ab95a49c4af9b61eed4d3957e22f928a1fb278e5916ba6

SHA512
aae51169eec58b5f9d89b22a4aee457ff0063f3ac361fc19bf8b183cb3672289c4850b0caec07c84e87395108ce576f28626cb11b2b521d2e17221f91a0777f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1f5da8fe0156931e8c91608e9c4016e8

SHA1
311c52173f417866b7df65bec057e4c3d32d1443

SHA256
44cf11edb290ae2d9916958e0cc9142ea0b8711531cf5b79a67e6b769d0737a0

SHA512
e4aeec6b338b3edc550e891f34d13ed58d48759762680bd914e7b87f1ad750c5832b2d612db56a67afe0e1c3c7bbabc6ca9f48a3169b7d648b9912dee395562f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f76598d6dad5e65c0ced558ce407de1d

SHA1
df29986c2706f78fcbf79082765f079947df2ae1

SHA256
91993d3c1cd3ff13d096e24f9bb655f0f20ee173c43f6a50db4864fe2c67c3cd

SHA512
72ab299518f7cf3999322486e1d6428a8f1c988fba913919caae13e02beb7eb9b14469aa3d74c3b6ccb8f69fc7843de153d2c75cb1fc3f8f25b5255cd610f7de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
6cbf5ff4e5f0466c161ad4e7b83dcacd

SHA1
23262563893c26e5348ad8bbcc3c5407058b4a0a

SHA256
860e92a3abf5fda265843f624b116fda764148ea8af1e29d9f6cc9717870a6a0

SHA512
81fd9e3df5089a34e36e6f2103d645648a28b79c3e6510923561caf5205eabf5d099b7cbe39bbb1b31eab64e0b50fba00bfbdb7c196a71960de15af9910fc80d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
589d6a3d414d65ec3561a8038c3a3c88

SHA1
feb3672933a5d9a768c6068b927c1c5d4878ee11

SHA256
5f9a0293248f980dd657737e8095119ec3d2eb8d74c3e40c1c576116d71688d8

SHA512
a00903c8348e1641d8b42e424e41660bfb384f75638da8bb97e1c1300a0d58aba2e101c176f74ac4c0844f9748079f67d46ffa2cae99c71d59114fc50229b789

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
cd8a6542f3baf86d146c3f8174d57632

SHA1
51d9aab40256221ceb01371ec4592430db68c1f9

SHA256
afe6b4ac5cebaf2c46564bea2f5eaee563907deab8030bbcd217fdba2ec793fa

SHA512
e2a166688f199fd315149da79cacda76039a18d9028681d0044c0b1c57f37e5cd42991e3fc4ea8ea92f05b7830f594d31a8f7fcfce2996070ca7045800bcc31f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9cb4738526c803c7a78f23585d57b635

SHA1
ca31f6ff0a52d8f65fd5c0d9e6867aafacc327f7

SHA256
37eefb9764c94ab22ca0e22b253683f2baab0bc5c9df01aac622aed3456faf65

SHA512
8a2c07d946031705d10f43f8b3a318eab61972cc735ad48f9e46ce85bd879d1e81d5ffad063ecc71d89797794fd83406f81c099794ebb430fcd6becfa7f190da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
020fbc500d8f4d55878b3c7197af391d

SHA1
46f72e54ea895c1d72bac0474f1d508a542d019e

SHA256
91fdca7f20069de3259dcd5c788714464518c4263c33271b5d33564ea623b740

SHA512
ea6b8f4ebad94400ad4d05e85bf439fd9552556678d38d263a6af3e987ec790b9eb25d193eb87f67795fc773d7db471b49cb6dcfbf44c4537bb6533acb092e2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
182ef133d93d965d6ecb4373edc0a8ab

SHA1
6cf670fb2acc41a6debfd799a0336e06a636b030

SHA256
42db9d86023ac668c9b388eda3d2c7c7e8991e8b82fbc5af3960e5a4fe0d448c

SHA512
72c24455929f68c8aadb21b6b963dc402e4b05049f3578dfc55fed4d0092d5a81921f371d1c7bf73379866c9ac101698e3d200dc4932163e0eda37525a335f8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f7870f258677dbb411e1d1e663242d4e

SHA1
59d9e8b5d85b958ee3c73d745c064e3fd030eef8

SHA256
a138fd6a21c8670aa4b21e587d4ad931ff817cfce98f13040e4ec2ce4a647fd9

SHA512
056efd2fc5e0f5789435b7c91d9baf38c78a27403f08b567b88e180e46d253414a578c6f096438d83ba651d6989537e2f529ca847ebbbb4ca8d07f1cbc8e3753

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6ac1e022f5bb4a3c82c2db891786a8e2

SHA1
c7b0bc21cbe61096830041cdfd3846fdebdaef00

SHA256
d9a55c812315d4819ff82553e70ecd713b9a9a1f07c98fdfa206e59f39a28846

SHA512
3b1517c971590ba81687fadb0493cac2e688358bde6501e6e41454cf3b1735c925711c2b7897d3c8033f880982721da1a31b92ded3b98fdba3aa6f6b9c350226

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2b6686fb21be399e401f2ea3f576f172

SHA1
5cc204474903fbb7fc38cba82988d293190f26ec

SHA256
d618ccdac7f91990aa5334bb38c39a980dea1ebb6a87b2fb147a5443df9e9241

SHA512
ac4b5f996ad1b6b7edf83bb7cbf3b179d5d5349f25cf5e0119120ac4ce38648a305973771663e72df987ba3461880be247c6e3fdcaef74c877dca152a85a800a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
23310e934c0c34e6d865f619f4c17e6a

SHA1
047c4e246f74db3b9d0d497731fcc627b31fed8d

SHA256
2985030083f2689467ff13b0390168ce621e986c324d68c017175307d36ea08a

SHA512
14c4ab594905be4cdfd3b957842d9919d73813a0cf15c50d0d98f4764cf4aca1fff1b4b1a9bb289c12fcddfd416871c826e53376d287b5554d2ed7e35e0524be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b064.TMP

Filesize
872B

MD5
46720c6cf5bc532a433d249005c5cebe

SHA1
c2515701535d0923b30d245f3fe91ce24036e344

SHA256
b95b674936edb5ea40f61627c9177eed1a95057594c1f45aef31aefe882fa986

SHA512
c32fba2561be764abc0c1471c222bcf78ac21ae86869001fe35dc6fc36df8ec614ec73c1dfe947ac8ee09003fae4691677b42145c52898c2a154c3f08e61a6bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6ec466c5a956f29860495ed076408ea1

SHA1
729b3615bc00b7d3f5f4cd6ecd360879c00ff863

SHA256
4acead0f5c0efd75bbad009c31836feb6b68ebf7d1092438a5b5b254866892e5

SHA512
77d677b11f5986a8a385b0455591fa0b833902adffe4a508f39ebcf98367452c4c3ada2b8bccc5731da71120f1b225033ed092e3a255147524b4e318396d98ca

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit