hxxps://github[.]com/Lachine1/xmrig-scripts/raw/main/linux[.]sh

Analysis

max time kernel
2040s
max time network
2045s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
25/06/2024, 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Lachine1/xmrig-scripts/raw/main/linux.sh

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
23	raw.githubusercontent.com
24	raw.githubusercontent.com
25	raw.githubusercontent.com
38	raw.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3107365284-1576850094-161165143-1000\{F9F1565E-2DBE-4920-9DB4-6B8B49475F97}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4048	msedge.exe
4048	msedge.exe
4040	identity_helper.exe
4040	identity_helper.exe
3976	msedge.exe
3976	msedge.exe
4004	msedge.exe
4004	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 4944	4048	msedge.exe	77
PID 4048 wrote to memory of 4944	4048	msedge.exe	77
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4608	4048	msedge.exe	78
PID 4048 wrote to memory of 4024	4048	msedge.exe	79
PID 4048 wrote to memory of 4024	4048	msedge.exe	79
PID 4048 wrote to memory of 4036	4048	msedge.exe	80
PID 4048 wrote to memory of 4036	4048	msedge.exe	80
PID 4048 wrote to memory of 4036	4048	msedge.exe	80
PID 4048 wrote to memory of 4036	4048	msedge.exe	80
PID 4048 wrote to memory of 4036	4048	msedge.exe	80
PID 4048 wrote to memory of 4036	4048	msedge.exe	80
PID 4048 wrote to memory of 4036	4048	msedge.exe	80
PID 4048 wrote to memory of 4036	4048	msedge.exe	80
PID 4048 wrote to memory of 4036	4048	msedge.exe	80
PID 4048 wrote to memory of 4036	4048	msedge.exe	80
PID 4048 wrote to memory of 4036	4048	msedge.exe	80
PID 4048 wrote to memory of 4036	4048	msedge.exe	80
PID 4048 wrote to memory of 4036	4048	msedge.exe	80
PID 4048 wrote to memory of 4036	4048	msedge.exe	80
PID 4048 wrote to memory of 4036	4048	msedge.exe	80
PID 4048 wrote to memory of 4036	4048	msedge.exe	80
PID 4048 wrote to memory of 4036	4048	msedge.exe	80
PID 4048 wrote to memory of 4036	4048	msedge.exe	80
PID 4048 wrote to memory of 4036	4048	msedge.exe	80
PID 4048 wrote to memory of 4036	4048	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Lachine1/xmrig-scripts/raw/main/linux.sh
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1cc83cb8,0x7ffe1cc83cc8,0x7ffe1cc83cd8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3348 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2384 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,10745332464969791937,2578401617340631434,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4064 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6876cbd342d4d6b236f44f52c50f780f

SHA1
a215cf6a499bfb67a3266d211844ec4c82128d83

SHA256
ca5a6320d94ee74db11e55893a42a52c56c8f067cba35594d507b593d993451e

SHA512
dff3675753b6b733ffa2da73d28a250a52ab29620935960673d77fe2f90d37a273c8c6afdf87db959bdb49f31b69b41f7aa4febac5bbdd43a9706a4dd9705039

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1c7e2f451eb3836d23007799bc21d5f

SHA1
11a25f6055210aa7f99d77346b0d4f1dc123ce79

SHA256
429a870d582c77c8a661c8cc3f4afa424ed5faf64ce722f51a6a74f66b21c800

SHA512
2ca40bbbe76488dff4b10cca78a81ecf2e97d75cd65f301da4414d93e08e33f231171d455b0dbf012b2d4735428e835bf3631f678f0ab203383e315da2d23a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2506e1a1-105a-47bb-be30-f4d83172d5cc.tmp

Filesize
5KB

MD5
e213645058d3f91911789a0c21a6f268

SHA1
6b9959cf024b2358221adfef2ddc029c5574fca1

SHA256
64dc2acd2b019147d736e89d1ccee51e5df83ff1be38f95f39d79d9e8d20fa5d

SHA512
3781f4bb92e4018d485b117f52946b399fd9d94fb9090ffbc4b0ca2ef67fa07baf58e5cb863b82c6114280a243baac0c0dd788a8cdeecd2f59d11edd5162a313

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ffaadd88210dfc7cc0488675c403303f

SHA1
32ebde0347a5171df6834e42824fdb60a09bbe12

SHA256
897f08d73b90e986da7e66d51aa91abd1d7a0ec21d0242f8637f975c4217b6f0

SHA512
9d5099451b6309e3edbe953ede79f827299dd531db62f0770f2874bf5d5150a9bf497861827b7904d62d65986e6541a734a63b0fcc981e705ffbb63596a8d990

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
916B

MD5
e78b6607df30cddd91c43092fb317bed

SHA1
b833156be7a171cb470679a664ad2c819c54a78e

SHA256
6ad951886fd90318601ebddd7836da775d9e6f810830d6d92183ea3b42af9d87

SHA512
350d585581de444f0b54c9a0526c5f22a7123c6d8af605ee106dd3bc0c0675687c8bd1a1d346617b17e83880571c89e3c6ba75c70b3467710b2eebbf816ae42e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7f941fdff8a16ad6fda6c82d2c719094

SHA1
1bd69beb0cf2b0ed1e609f4fe9d5251d49c069cd

SHA256
3bf1424e43bb95db795d458711d8e08d4691f0571ca4c100a9d7fa8bdcec87f1

SHA512
c09cbad3c9bbe233c8302c9a84c2258f342462bea28323b4d89c9b9403298a2522736a6780865a791a53439a8031d62143a8e4179f4bf449be7839e330e85659

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f23027d89b6a13b0e74da4985e244b8f

SHA1
067077b7548632a9248f6ef1d73d5e39fa6dd38b

SHA256
35220f4b2249bf21a6ba7e7b2cb929b1b4c7b5139953467a7adb99f2e4ec05c5

SHA512
711b0ce12e2d3dcabb0ba6bc5a310f96a759c5e02772a663e6c5841d448689ffd33c55180494b878a91fbd3b9d0e7b6330424ca83b01e55650c3cf2552324851

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
701B

MD5
f784c1da2d9744dbeb3ebf63c7c6eaa6

SHA1
3e07e169f67229a0a6df5e1652ec4da3febbf60b

SHA256
6af2b55cb52e75b1b604490b3fc03bda59c1e02420a53d3d48eaab2d7638827b

SHA512
31148690df428998df4c27e14d380b8717166f3e783543732b17c896cab2e6a1cc4e0b97ef4bc4d514ebc629508af70317c583d8982c508a894d5c36eb0896c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581cf9.TMP

Filesize
201B

MD5
c0ef5004f7414ce250eedde8b3e075bc

SHA1
4d12a39e26f393b81512faabbc2d7840b6975bbd

SHA256
b4c7d773b45465bc3ab3a47592fb3945fb4acb5cecb24c2739d4f904f1b9bd1c

SHA512
c03ee6d531efeff1907ee68b4c34b616cc15f2166ebde18311daef62f8db2c771732a52004893550ed2c7c5313b856c246197cbbcc49acf17e6fa65274e67745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
dfadc2b804f97a967525f5fbfb8b1589

SHA1
239d6bc06d960a6977faa1ad80926edf15320618

SHA256
b0ddf7fd2a15d8db7574420cf91f105643576aec107c667198593375c71e5990

SHA512
18087d5b24ba5ebff94ea745b9f5543dfd53b134d02b2caaad3cfdb0726e4b7a26f0e3d306d61a83af13e30509d9f00897080d13229ef7d93ef2fc569a9a4dc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0ba286214f97c9f688228057a55287e8

SHA1
d1a5111cd9d4dfd674e84ea313013ea33c886e05

SHA256
7fe04a5eae91a357a7740f160a922888a8b8f3a747c73c20433df8b8cccc6726

SHA512
9757c86f8ec2b903c2003d5cc8b5c648beff775b14c348b6cad96bf2d168980c0192f08e689093c34a7e5b5b6b36881881cd84f139fa08163faeffa55dbe77d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
3b547797f879d503222157b511e96754

SHA1
06293e8b9760f312c8ec5123cf021ee3ed80a1f5

SHA256
af1a5f2f9ba519a186d010706ee6c8792ae58dec0d0e65c07b8b2bbf28b01200

SHA512
34d0c69bd461c27a2da9f2a9d93bb72be28d0356916ae0cf39f523e90ad8ca9762350c6bb66e72cd4581fb0a355bff94ff84d5b5ac76fc8c85fc97eaca3e3255

Download Submit