hxxps://bazaar[.]abuse[.]ch/download/a8a0cf33ed7a0a1977826010e0c96b0d85ba5d042bb0035d900a8df329d4de7a/

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bazaar.abuse.ch/download/a8a0cf33ed7a0a1977826010e0c96b0d85ba5d042bb0035d900a8df329d4de7a/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
2028	msedge.exe
2028	msedge.exe
4072	identity_helper.exe
4072	identity_helper.exe
5452	msedge.exe
5452	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1728	2028	msedge.exe	84
PID 2028 wrote to memory of 1728	2028	msedge.exe	84
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 1932	2028	msedge.exe	85
PID 2028 wrote to memory of 436	2028	msedge.exe	86
PID 2028 wrote to memory of 436	2028	msedge.exe	86
PID 2028 wrote to memory of 3980	2028	msedge.exe	87
PID 2028 wrote to memory of 3980	2028	msedge.exe	87
PID 2028 wrote to memory of 3980	2028	msedge.exe	87
PID 2028 wrote to memory of 3980	2028	msedge.exe	87
PID 2028 wrote to memory of 3980	2028	msedge.exe	87
PID 2028 wrote to memory of 3980	2028	msedge.exe	87
PID 2028 wrote to memory of 3980	2028	msedge.exe	87
PID 2028 wrote to memory of 3980	2028	msedge.exe	87
PID 2028 wrote to memory of 3980	2028	msedge.exe	87
PID 2028 wrote to memory of 3980	2028	msedge.exe	87
PID 2028 wrote to memory of 3980	2028	msedge.exe	87
PID 2028 wrote to memory of 3980	2028	msedge.exe	87
PID 2028 wrote to memory of 3980	2028	msedge.exe	87
PID 2028 wrote to memory of 3980	2028	msedge.exe	87
PID 2028 wrote to memory of 3980	2028	msedge.exe	87
PID 2028 wrote to memory of 3980	2028	msedge.exe	87
PID 2028 wrote to memory of 3980	2028	msedge.exe	87
PID 2028 wrote to memory of 3980	2028	msedge.exe	87
PID 2028 wrote to memory of 3980	2028	msedge.exe	87
PID 2028 wrote to memory of 3980	2028	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bazaar.abuse.ch/download/a8a0cf33ed7a0a1977826010e0c96b0d85ba5d042bb0035d900a8df329d4de7a/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff00a146f8,0x7fff00a14708,0x7fff00a14718
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,5540298036064369307,7405876464630556510,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,5540298036064369307,7405876464630556510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,5540298036064369307,7405876464630556510,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5540298036064369307,7405876464630556510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5540298036064369307,7405876464630556510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5540298036064369307,7405876464630556510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5540298036064369307,7405876464630556510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,5540298036064369307,7405876464630556510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,5540298036064369307,7405876464630556510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5540298036064369307,7405876464630556510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5540298036064369307,7405876464630556510,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5540298036064369307,7405876464630556510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5540298036064369307,7405876464630556510,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,5540298036064369307,7405876464630556510,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3956 /prefetch:8
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5540298036064369307,7405876464630556510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,5540298036064369307,7405876464630556510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5540298036064369307,7405876464630556510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5540298036064369307,7405876464630556510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,5540298036064369307,7405876464630556510,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5116 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:824

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7f3fe201-4cd0-45a1-8290-a0f611b3e17b.tmp

Filesize
12KB

MD5
84b8ca118ea5baf0b9fa3bbbcf8ff61d

SHA1
cfa5b000f732e64cf5f1f68d52f22bf5b9f10ef0

SHA256
075bec8969f274f106721ddbe7c811426a99d5901b172c37cb88cd8f675c188c

SHA512
c0a24ab40cc554a6ab965d7baf81a69b5aca36bf86bf3a6ba689e6ad4e9ea6e701e305a7fc664d6697d593443adfe00d96b920a5ebdecf1a7dd117fa48e41db2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\93617b54-ae7b-4c65-9b4e-f53f38d3d193.tmp

Filesize
11KB

MD5
c2c753ef9b071c52009a43ab99b197c7

SHA1
7961b3e6364e773a7c654b9545004fdbc174b3ea

SHA256
806422d0aaf40d8901e2e02d5acefb143d67a72b58cc81a84b4755cf068a932d

SHA512
adbb24dbbcdf3d736605de66c1984fc747da19f3c5c232852956e1e1f9a3040a0ddc56f7a975de73c4609af9c90c682b43fd74db0fd8069b50b30d7d9c6be093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaaad45aced1889a90a8aa4c39f92659

SHA1
5c0130d9e8d1a64c97924090d9a5258b8a31b83c

SHA256
5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b

SHA512
0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3ee50fb26a9d3f096c47ff8696c24321

SHA1
a8c83e798d2a8b31fec0820560525e80dfa4fe66

SHA256
d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f

SHA512
479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
22KB

MD5
3b5537dce96f57098998e410b0202920

SHA1
7732b57e4e3bbc122d63f67078efa7cf5f975448

SHA256
a1c54426705d6cef00e0ae98f5ad1615735a31a4e200c3a5835b44266a4a3f88

SHA512
c038c334db3a467a710c624704eb5884fd40314cd57bd2fd154806a59c0be954c414727628d50e41cdfd86f5334ceefcf1363d641b2681c1137651cbbb4fd55d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
94KB

MD5
ff88ea986a4f6a6eb9c9eb8e4265e858

SHA1
cf48e6318c6ab02fc7c6f887c7da72e5db67be3c

SHA256
d855cfb930366b7af6e9d32388ea19f22254c71f07d887b37a77c76056f523ea

SHA512
3096097bfbd14187ce6fb45a31094fa06fb0d8bb5709c7b72aff107ae5f13d6f85bbbe85ca3b0c073157a64c28273b8fba247116df40b84b7e573c82123d8699

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
210KB

MD5
5ac828ee8e3812a5b225161caf6c61da

SHA1
86e65f22356c55c21147ce97903f5dbdf363649f

SHA256
b70465f707e42b41529b4e6d592f136d9eb307c39d040d147ad3c42842b723e7

SHA512
87472912277ae0201c2a41edc228720809b8a94599c54b06a9c509ff3b4a616fcdd10484b679fa0d436e472a8fc062f4b9cf7f4fa274dde6d10f77d378c06aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
0304d5120f5c778b06cb282138accadb

SHA1
5932a50795e909c130fb048fd9c25a8f36197f06

SHA256
f5b92dca6dc3084a6cdbe055ba8435a3f8fd78928eb2fa39b90e20447c848481

SHA512
3a026b99e0fa2f35197f5e4930b7a4554bf96f93eca6f253b5b7f8700c33bc5e34793314b95fa1a80184e9953b626c7aebce861c1b4aea5a24c302829f652c59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
aab80165725f9a88ead6a0f223bc2a5d

SHA1
ac6c91f2b0758909786c013862800288e23102fb

SHA256
ec70acec774b7cad6a9021c260614adaddf5f81eb945b26a43d8a2bfe3034aa2

SHA512
76e5a3e47b4dae0d0c22eaeccfa8d5db24e86d7f79668901e82a16fc25ca75f98db1aa8e3b9f56c82994dc66034c14496460cfff4a63e9ee583b1ce3d7911c30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3c9c8cc4c69571e6122ff6057b91c597

SHA1
33237fe445301e26a3349ff5936ca58593c6b14f

SHA256
cec3241fc1dd12b389dafaf0100bd56b009e8ce53a3ca8e41582d2fcfc3144bc

SHA512
603aac5de8ef425d1eb459143330ac75df514870c26967e08e08b7aba829ee8c2137fa1d18f26d2792b6afeebe438753c53e04023f289bf7def9967c0733e929

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7217b5a1a77314dbb29d503870c8ced7

SHA1
079679a00b506f428a45a71b3c030fb7d034feb9

SHA256
ddf74e7e1fdf5bc8722a634d4e7051356a24d71bbbde84a48bc2a5240c89717a

SHA512
f7689e65c4f12d9280ab8c276e1e101bf185bb899ce0702fa5f2a62a2436b73a83d66a17ff03f9dec13010a2d1ec46ca0d436ec02b67f4af4abd452f7b290e0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0c573be44fe87c93d63f6bbc9ee63af6

SHA1
4c992e3b4e4ace3911c8bbeed9b8c77775d9f4c8

SHA256
bbb4d5c428cafc72771e395ed5c1d9ee5be1e15fb7e2df40a20e22eecf19ac07

SHA512
a0d004e4597dcb6dde6a57c8b566b1f93bc06c155982f1445206e72d2381a046495e75a6f994a981f6d36dbdc85db92cc870716fbe6eaa13fcc8f17f46a6acb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1671c7d4ce1f713e07b4a4bb393b56be

SHA1
f79b7813e277789333952018ccf03b6d267a43b9

SHA256
695c391334e8c4453639c419ee02516687edabb467560934291acdf77a455ee1

SHA512
99a454d3c10296f7fc63f0a2c2800c813a38288d4e840d5e396d7c7b0eeb1f02c64f1f03aea9ca95b57495517fe26134e2f3ff811c641c1bb6004352668e3b9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
41a1ad1eeb8b6844622fa759a9f3b12c

SHA1
108e14e72bdc5c360989f0b3e4a96d0f47e85d9a

SHA256
efbcf8d2280ddfbc29b13ed4142b6f1207becc05259088072f9127403ac5fce0

SHA512
63db78f99f76a82d1d9e7d3733346b642fc422832739a73304dc5b1028ff85bf29a636ec26125d19f939e209b9fafaa469c1eba88104002b6dd6c8c8dc4e7e12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
ba6bea68ec5523779cf8a9450fcf4ae3

SHA1
070a6dcc603af2e3e65ce072846cd9bb1f5f720f

SHA256
9142e14f9d25e30610a4ab24bdd97292926e8d7702ef02d5b186c8b427c01a14

SHA512
6a9b1cabfccc7f618c13d961471967f20b6c2174148d23d95784d03a523cce66dc57df2d59a0ff38bf0c9d721334439671b23005cd535bfd141de83457c3986b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
4d702c2316e901e247ec9617aef461a6

SHA1
3feed26f728db114a0c0f00ab3eadcb10c37d600

SHA256
91c34f6e27e8280a3849b554b7c1f3be579db28c5c1fafc36afb8d65786952dc

SHA512
ed3437a957c41b3ea4a84c1cfd311e3b730fa3915599a91da59c9f6cb2643bc9ac000a3b0a72996075fcfc8e2cc22fbaad5184feca28bfff44e50d7d185c8072

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57efee.TMP

Filesize
366B

MD5
346739cdac295cca155575fd169dc8b2

SHA1
6d825365bf5409f54040de774619317786d998d8

SHA256
6ddc2e72037026398c79f37863fec4e5745ef77d30ff0932e16b0f78c586fe65

SHA512
3d936165aa5d393da4363e23afa881c00706974ccbaef39e0148d6cff045cdf724e88c05f83deab08e079913bf0bdf13c84f7f4e2b8da279d6480f0950da6a5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6ceed4cd6bcccdd26aedd049d216216b

SHA1
0c4635f1146821f9300419f0be9c0136fcca56a2

SHA256
2613912d9febda222575f61871146b9878ee3e4cd1fabfda4fffb2cc87db3779

SHA512
735f71859ac829c76d57dd6276c11d65886b684a58be707828ceb6fcb4f4c980a5c401bd95cecd3b89991319d4af6116e9a46a822d947228318ee65701963f32

Download Submit
C:\Users\Admin\Downloads\a8a0cf33ed7a0a1977826010e0c96b0d85ba5d042bb0035d900a8df329d4de7a.zip

Filesize
52KB

MD5
3b1a5c86d7148454f9a93febf6f36f82

SHA1
cabb47306aa2954c59dc8380b6013d3bcc9a91eb

SHA256
9f46592bd3ba03abbf082cd2ea4a492606521e3cade0de8baf3f20e574410752

SHA512
1b7586cdc891067e0dfa24cee35266a395831b8446ef149824645bc7df0c218b80d04f78a6453174aa03227b753ef5c70ace561ee664768b7c3012647c1f39bb

Download Submit