hxxps://www[.]mediafire[.]com/file/4d7vjgsz8ovcp70/UBHERN_ATS+V+1[.]32[.]4[.]1s++17+DLCs[.]rar/file

Analysis

max time kernel
119s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/4d7vjgsz8ovcp70/UBHERN_ATS+V+1.32.4.1s++17+DLCs.rar/file

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4500	msedge.exe
4500	msedge.exe
1452	identity_helper.exe
1452	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 1048	4500	msedge.exe	84
PID 4500 wrote to memory of 1048	4500	msedge.exe	84
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 3412	4500	msedge.exe	85
PID 4500 wrote to memory of 4748	4500	msedge.exe	86
PID 4500 wrote to memory of 4748	4500	msedge.exe	86
PID 4500 wrote to memory of 3408	4500	msedge.exe	87
PID 4500 wrote to memory of 3408	4500	msedge.exe	87
PID 4500 wrote to memory of 3408	4500	msedge.exe	87
PID 4500 wrote to memory of 3408	4500	msedge.exe	87
PID 4500 wrote to memory of 3408	4500	msedge.exe	87
PID 4500 wrote to memory of 3408	4500	msedge.exe	87
PID 4500 wrote to memory of 3408	4500	msedge.exe	87
PID 4500 wrote to memory of 3408	4500	msedge.exe	87
PID 4500 wrote to memory of 3408	4500	msedge.exe	87
PID 4500 wrote to memory of 3408	4500	msedge.exe	87
PID 4500 wrote to memory of 3408	4500	msedge.exe	87
PID 4500 wrote to memory of 3408	4500	msedge.exe	87
PID 4500 wrote to memory of 3408	4500	msedge.exe	87
PID 4500 wrote to memory of 3408	4500	msedge.exe	87
PID 4500 wrote to memory of 3408	4500	msedge.exe	87
PID 4500 wrote to memory of 3408	4500	msedge.exe	87
PID 4500 wrote to memory of 3408	4500	msedge.exe	87
PID 4500 wrote to memory of 3408	4500	msedge.exe	87
PID 4500 wrote to memory of 3408	4500	msedge.exe	87
PID 4500 wrote to memory of 3408	4500	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/4d7vjgsz8ovcp70/UBHERN_ATS+V+1.32.4.1s++17+DLCs.rar/file
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff5e1646f8,0x7fff5e164708,0x7fff5e164718
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1260 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7252 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14184949486982498891,932023652681818464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7236 /prefetch:1
  2⤵
  PID:3744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
62KB

MD5
6b04ab52540bdc8a646d6e42255a6c4b

SHA1
4cdfc59b5b62dafa3b20d23a165716b5218aa646

SHA256
33353d2328ea91f6abf5fb5c5f3899853dcc724a993b9086cab92d880da99f4d

SHA512
4f3b417c77c65936486388b618a7c047c84fb2e2dd8a470f7fe4ffec1ad6699d02fa9c1bbd551414eef0f2e6747a9ee59ca87198b20f9f4a9a01394ae69fa730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
31KB

MD5
c03ff64e7985603de96e7f84ec7dd438

SHA1
dfc067c6cb07b81281561fdfe995aca09c18d0e9

SHA256
0db8e9f0a185bd5dd2ec4259db0a0e89363afa953069f5238a0537671de6f526

SHA512
bb0fd94c5a8944a99f792f336bb8a840f23f6f0f1cb9661b156511a9984f0bb6c96baf05b7c1cf0efb83f43a224ecea52740432e3cfc85e0799428765eefb692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
06d68c61667ee7f65d36d7d2c927ad3f

SHA1
4c30f2d58d278d3492169fb822bca987eb422bc4

SHA256
746205b2b020ad7d6276955b2035f802191c7ac18b4f25240da97fbbfbf64588

SHA512
a10edf4fc26554a30a809ef2fac410523446b650af8fe9a2f1c795cd232fb1560666cae29b1e6a16b0fefaecd2d71352c1ebea977d577a7b34155fbe666156af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cad2ddd1f1f302cac38830ce4880383a

SHA1
470354057c2591fe850aa4f6443727c6e5df8205

SHA256
a1833e41ef25838b3007782d8148f55b9428d694e31296c6b34e9340443464f7

SHA512
5d49f1aa41cbc92bfc64477fe3dfc6551e7583e43847ea8d0ec0d07012b4a0dfb447a31493fd54852805bc5a563a2464b08f509ba68ed0c933f9a016a6b8e7f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
f0776e8cb351226e57b6affca3111491

SHA1
41d6c92ead9cde8b3827f33ba8d3e9feb7d55dfb

SHA256
19040a7f13ab45f2cea1d115ffbfc606891aafe5ac467e518d5eddf892b5d15d

SHA512
57f2d53aa41b40dec876e52d8e4db7de175e15dc35dd43a0d9b957451deeef7a6d76e75709fc6354ae198e88fc6bdd62c8aa7fde2ff5617e075e2a1a51d0424c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e5c4a11cf8002289910e6d7fcb4423fd

SHA1
920bf681e2a76b0bfbf748da0f86c463753137a8

SHA256
024b07b16a23a94b35befb0d4bcef4f43d101d2fe28a4fec8ecdede5b537012f

SHA512
6b6b5d176e85d63a8d378b697b29e4998b447422142984f35f38ad2990e39429bddabfa940f38c3e390e5f88dbee7969fca752cddf285389d79a524aed1b2279

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0ca50f91d8e14ae915c4005164b356e1

SHA1
bbecc43905f4172539ccd240f1b060061a50575c

SHA256
9f10db16b4e459f09bc9f26172417c8cdf7ec1b77e9599a9b6c3e093d1aac022

SHA512
9958245cc532a4ec143f91ea83d05f1d01525f22efe8f858df13a89c2b3563da13664ea0e343e9255e725d594319894bc8d536c21c95f8c416b00effbef1d856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
17107f7973df77548ebcdc4243774286

SHA1
0b3931003f0f15a9d14a5333f3695a976ee4a361

SHA256
8aa3eff93b386caeb2315f05104a17b15fbb4fd218c492774ead7753232c9415

SHA512
355aa47086aba52a1656852386cf1d824231548c877cb44de408523355e698bbcc8daf33250b91c7f16933145e4cf640d6da372b861f9e5b83a277240e9b4dd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
daafe2d69084ccd4af95ef6358b8f037

SHA1
028a595178d5140b4f36c1b653bedbb15acc1061

SHA256
c60ae7c3d6cf65920021090cb3511f59c92c437f6f1a7abf707a3a70ee693151

SHA512
5c154d3467ff94a0172e1a5b5a85242778d1f17dcc1f3457c1b675170ced28d7e1178994af6ca73b0ac1eb17e1a133b72cfa8ca2b272010bdb74fdf04345edf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
9c29440edc1c50d72912ccbafa01c6f6

SHA1
9a3dedaf3c45dbc71882c94e28c6d976a97d7f88

SHA256
aac6792708b144b123f2af2680ef79ad2da347856fcbc3015ae0cce4eb4db101

SHA512
0a3d23fbb38c62d04cc048071fac407cb01d1d967b152a12ee00a254999ae06b03aca1c46e6a3a290409c1e680c9bb7af9fa1a76dc4b2fcf644e073f3d8da1e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2ce0850899c9022169c230bbdbef0ae4

SHA1
179ed505d25d572d2c76d66591e27a8b37e9e89a

SHA256
86940ea25f9d96037ad4c8aa9d476ca91d077429b7008c691ff8fbb9f074beb6

SHA512
990b44565eb92f9466f57256b49bebd632f5340e189f4a2f0d6456740f021a235ff51f4ce987e7a1acf45fea62f35c8f7af9cc9e7daee2ba4d60c651aa1b459c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe593241.TMP

Filesize
534B

MD5
c3b1ff8f2cca164f632a7a271a31a79f

SHA1
05949682a3dff562f05e662c23e429b149b08a19

SHA256
b66a30b15c482c910bbd862177bdeb1c807084b8d63971e695ee5df0cab44237

SHA512
77950e39ad987cc90bb550a3f72535a0d83d7db3c81574ecadc67acffdc54d956020953917c2e9c5277d3da45ffc24db5b2e25b04be375a855e2b9e849e0695f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7c2667c6d7ce100b7f981c9f8e68a156

SHA1
afe9d2f154f7c0dc698cc9c6bf0811a3ad30f5ea

SHA256
6f0df36fe0d95882a6a61ebeec6c0980b7144f0c03d80a42382b52f8d619077c

SHA512
4abb3d52645428a400d3e3ec32a21f27cafa1e2cef2c9e66c1afa7c574bb8e349cd6c2248a6e7663ba5d1fb2f09c77421bda8d0530a4708a6996a73a86c7b60a

Download Submit