hxxp://zadenbibliotheeknederland[.]nl

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://zadenbibliotheeknederland.nl

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3560	msedge.exe
3560	msedge.exe
3644	msedge.exe
3644	msedge.exe
2976	identity_helper.exe
2976	identity_helper.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 3808 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 3808 AUDIODG.EXE

description	pid	process
Token: 33	3808	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3808	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe

pid	process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3644 wrote to memory of 4860	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 4860	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 2444	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3560	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 3560	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 940	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 940	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 940	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 940	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 940	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 940	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 940	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 940	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 940	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 940	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 940	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 940	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 940	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 940	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 940	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 940	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 940	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 940	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 940	3644	msedge.exe	msedge.exe
PID 3644 wrote to memory of 940	3644	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://zadenbibliotheeknederland.nl
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd928d46f8,0x7ffd928d4708,0x7ffd928d4718
2⤵
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,12863168770594619563,15226014290078265927,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
2⤵
PID:2444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,12863168770594619563,15226014290078265927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,12863168770594619563,15226014290078265927,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
2⤵
PID:940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12863168770594619563,15226014290078265927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
2⤵
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12863168770594619563,15226014290078265927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
2⤵
PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12863168770594619563,15226014290078265927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
2⤵
PID:3372

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12863168770594619563,15226014290078265927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
2⤵
PID:2000

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12863168770594619563,15226014290078265927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12863168770594619563,15226014290078265927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
2⤵
PID:1576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12863168770594619563,15226014290078265927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
2⤵
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12863168770594619563,15226014290078265927,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
2⤵
PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12863168770594619563,15226014290078265927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
2⤵
PID:1904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12863168770594619563,15226014290078265927,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
2⤵
PID:4200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12863168770594619563,15226014290078265927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2344 /prefetch:1
2⤵
PID:1140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12863168770594619563,15226014290078265927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2508 /prefetch:1
2⤵
PID:3968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2040,12863168770594619563,15226014290078265927,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1920 /prefetch:8
2⤵
PID:5044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,12863168770594619563,15226014290078265927,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5808 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x550 0x54c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0dc31145339977b457eec605c4e1a567

SHA1
deb6ff8183afdaafd849858c821af52f93936e1c

SHA256
4b1ef876e1d4f2c9726b7b966222c336d0be026c588178ad40ab476be4d353ec

SHA512
ef095404247530ade966bae7d6920f0ff060852e3dfb545f4bbca384f88d0e2a4622b55e4b856ab63f6e6c56196a8ad1257711b53a2fcdd89962d1252b6c4e17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
31f5155eeaa8631c1c80614efb4e73cd

SHA1
aac054ba3a9bd71bb2644cc541aad11a5f119017

SHA256
7e0833f04bdc7ed7a88940d793f110d199368d7c2ca55eabb154de84a355d7cf

SHA512
94c43c4e59ae3745fee5157852c279110de2f89dd1562c47627ef960a70790db0b713155817ac7ac636e43f0218f73d35c915f9de61df019ba65c09730a21452

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Filesize
87KB

MD5
c46dc43c8a7bdd3ee0686b9dd740b00e

SHA1
f1992a5d99c0958fa821e1953977651ee96e5abf

SHA256
21f81569bafe5f0c6704d16f541d25ebef7c31414e22f2af7994694ee9a5a246

SHA512
74a2acd40bd439e268b9781d61c3a9b2a5de0e8efea7424a26527990c589efa91ac9d9f391e03c53c8b93dd390a12503423cd6277ad4d6d938ba868d8eca0c2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010
Filesize
74KB

MD5
67516cd11386f83c3708957e7097f64e

SHA1
b02816eff9a799745f6435b9f3fa83015477476d

SHA256
175ab786716cb1703937f324f154a289b793da9f0788b5602827c9e532442c9a

SHA512
8213ad0afccc527e94534b9caab39cd3fd99e128493ccf72a71e56a09839458e1932d0218c623da513e4a62274fb9880a521632c07dd1837d5a92ebc067d50d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011
Filesize
94KB

MD5
e67d81014111f02ab4f4f100e4f0d9ac

SHA1
fe9c48e2d156ee40c5afa093bc9fc0f082a12a85

SHA256
3c379ca844b3bf0a446d503b69e723541163d2f87dd61e071fd84e3aef0ace16

SHA512
67f64a771bb22af8f8756a1b936b5176b2534b9734235b82e231809479d7052dd2f4ba2eab27c56e62c95a8c7c80e2a6c7e492034a33885e718c50f156afc06d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012
Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f
Filesize
1024KB

MD5
ede267688cc08ebcdf1d8adcc8edb65c

SHA1
66f01f2e9111ef1065b32174ccdbcaae35b555d4

SHA256
413fc44b13f87b81288cb6dbaf0b4ea5882d6715b70f4b3f83b40c429a2996bd

SHA512
a248f65875505342c40fc69b752f6804c2a9b711cc66d894195f8c2ba7b0145e7f5705f616fb3b5aebe1c3e3043a785dd5c0a7b2b0692551955beb0f64a31275

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e
Filesize
70KB

MD5
c1b1529a5c55e32d6d4519a0ee882bf0

SHA1
24012e3e1e246a090f9515f659d7e5899063472f

SHA256
c9a057fa9ecdc87e61e33801e0c0581194b3a8577370d114e0b8be4af80ff1c6

SHA512
dc84af9e3939a01b5673b13cd708a77e29288392ff7115cc40d221925ddca1e85283a37ae1b9fa48aaf3897d0511313455cfc7faaccbd96a3933094d78b6091f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74469aed1cfe2077_0
Filesize
268B

MD5
388d9c8db9b5089b3312246b3d084ab5

SHA1
7b16cb6d7249cbfe685e25629af98707bdf463df

SHA256
5105bafc1e1a61e44689a6236d40b044fc42225dec7fa0386786f4e1439b416f

SHA512
d6555e4687a895396c0d5a247ffd455a97d7846ae9a4977f8cc5b81331c11948ab0a487a64bff923896f385a538843f4bee7436f2c15b3d76620c710dbeb5444

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7892e2f4cbf0903c_0
Filesize
75KB

MD5
b9de5750fc1baaa4ea744efca97eee72

SHA1
6dea8bbbde2f7ce94eebee8509466341c530b4e5

SHA256
626e9a934062debbd5025c9ffc1694e261a69046ab980c93856f9634348a147f

SHA512
f98a9f0683d55c04ec4cd210cd51359d6cac99f12aca52f28bcf9b9d85ba68088f9387282044df9d1f485861e3a58e14714da520fa490ff8aaa639af213feb9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a138bf73c4374a7b_0
Filesize
354KB

MD5
0cb3b51488dbef5269a258b606c72813

SHA1
e3d1438a14e6e27a8f0f5c48ae12d3cf11b44026

SHA256
b28816afca04b06d804281981dbb7b38d93d816d836495c5d7f72f40a20bcecd

SHA512
6af6f3a4a234a4c7e714631bbf4ef26cf3f7c5cf43605c11fd86f8544fb5aad6c2b800da31031a0a4467217fef7c97e8e213841aabc63b2a995b0bf33b2fc600

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a1464cdd7d30f01a_0
Filesize
3KB

MD5
8499b089474718ffc871fa952aed626e

SHA1
8eb72ed370bda9a8bce0522b959db3a0dfe0d7e4

SHA256
43ab7fb9a8253a31b24d0bc626396b3c1f85c2193221340171c7e043ca5e9c98

SHA512
5d0e8411caccbe767e27144e940ebae41d39f3adf20a79ffa68357b81eaa72511ce20b73c33a25066e5a7ca29ff3759d9e87596bbb4cfacc3324af19dfe2cb3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a485bc0224a35d36_0
Filesize
280B

MD5
a9fd7fceac081fb93de31a17c946b3d4

SHA1
5e9be228163f52019e56ca115103e8aa7d0a55b1

SHA256
755d80cddbe031e473dfab8a0fcfdd200a695836c48794de9f1e465705885bd1

SHA512
ad3126b4d17971eacdc3b83e27a8b45f11956d3b321d6ceb522e0978aca5b15c97c51360130139d2016515246f8547860b172f885817bcf21869dd9c072695b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\eab4b8742a5d5ee7_0
Filesize
296B

MD5
a81c8fcfbc81b7f491e1ea0daa5223d3

SHA1
355502fe4c4c985066611b4e4036c2b951f4755c

SHA256
54f8ceb88d0626ee1c3094a2541adeeb7169da6ee49e5610792a0802fc55b789

SHA512
7f5164602cfb0bb3fdbd4f7e7564e50c2de54e695f6192ecaf1e2c97b14083bc1e85338a221c8a159601bb1275a8f2d5d2043a311eb241af13e0f2fc3743f1d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\edb8ecbba399dc23_0
Filesize
20KB

MD5
7c9eccf8aaf8447408d277bb8d59980f

SHA1
d6cad61da2d4b5736a9edbbe2da8f65399ec135f

SHA256
3b807d1bd894c0794b760f5a5fbaa378ada2f49c39af5d79cbb37256b871925e

SHA512
13853042cc594280488d5c16e25b96965edb6839218e07df5d646f32b7a370ed008d9d0bffdfda3506488d276413eb61be87fd01257d445a21c1cd1ba01cc50c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f8ab81f08c06503a_0
Filesize
201KB

MD5
910358b87b05977784f15cf1e60477fa

SHA1
32a854c3bc041aa71f27ed93c47a85c1418805f2

SHA256
79202ec5233fa3840dadd96a4d04f83a1dcbb6853172d5f55d402948e55588b8

SHA512
9758d1d65dd578e1721a03b6ee7226c078e88926a95467663aaa636ec48054f0a70e0b33a016b76582d98dc6cd382687ad70252600952b9a9ec3a835d5c727b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
912B

MD5
3d83943d94a2d19ad2b1eb3557d68eb2

SHA1
d44fd2033e974746b62be38e6ff89325b2ec8ca3

SHA256
8e29388e0c53181e6f5bb988674cb115499649c32598697470f8b1fed5499012

SHA512
02eaca92496ac206c7586f33c0002711ca676b609ed8c81b997d2097e536e99fadd0a7288a4f0963b59ebdc22bf2b46247a6e7648eda1ca9f34f2c1c53db5205

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
006b96a12e19a3e57544fecebcd06f01

SHA1
9e4bf67b3d9fcebdff64e945dbf846ecde1d1b27

SHA256
924649a6b669657b1f20c058a187edce0af12db52741fe595da8483568cc12e7

SHA512
d7a6570dc766d66a0650a35fef69a0ab004eb720d8985892d93c7dc0ff88ff602785734ee12facccfee1e101c6356345c737d8575bb415e6779bcf3f3107138e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
4f0c343bb49fc74a03ec48d858b1c03d

SHA1
1e6bbea865f2dd78f89bd239e9bf604a95722309

SHA256
3674dc7c2f07f03ed6e545fa835357048ce9151d2436295ceb052c87cf6c33b7

SHA512
c8fe5439ed0b91186196a688e178ab12e080648b0d4f55fa0586b3cd3afa52f36238f38e8d343559be6d5884f58534608098cad6b7cf894ef1865e3b8050642a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
ec3f632e37cbd9dfda4142cba819b359

SHA1
495506195f51ec13fd685c91a8a67d2b2522885c

SHA256
59f8253a2857db22d3c0f634e453c784f830e1dcc98733171753c330958cd675

SHA512
b2a682e16d98dc8f2dc2d2e694bcc44d1f63cfe09bf0964d1fa4d3d61129ccf46f907531e5a77ae9f124b5eda6a862a48d6ec18a3106986dcbb82d0e7bfe0aee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
c3e08e4b6ab0e3231c6438b41a38acf0

SHA1
8217911f3d46ae7d992010b29338f5f6a48eac28

SHA256
b0e2b43ac8f6888a1c8fa37cdb6517eadcbac2ba594d71541d4f242166e5f097

SHA512
0f43053ae0413d1ed19480b0961ce1614c6592abfdacfade379ff8cdfb91d1def851eda6ccd48a6fdbbd6ac07d7055afaad73324787be894279b04f736e89677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
d47a56cdbbd3be2c7977af3ca4efa3b1

SHA1
acf25f04e6697677d9a50080574e31e042d79df2

SHA256
f24c2cc83fbfbe10dacf15af6f46375dd0f1bbc66e487d09470662a09d4b82f0

SHA512
ceec1b9d46633545d09a2a903eb3b5dc6179e4e9bc4ba9b49f82ff07c6918bb5e7aed42aad7281b2e20cb9d10b7bdc0f9a2bea613fd616dcb6454140a0703a77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
4a5b57fc5cb6c56e45746fae407c2796

SHA1
b40b9e65b40ea9f6c8217fd8353fd95f701eccb6

SHA256
ee7cf0e9e22039fef0b0f281a37d2d9e273bdc02d3f25a95de62e432fede3671

SHA512
691bb01c0d80baf44305490ec1e47b58615dedfa33ab2e1004d0d7b0d3d87c64190fc696551090c04dc2fc5195ba8fdc10edc6a5ee597c655bf465378f464754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
1fd69f33521956696a97a29442aa3c6a

SHA1
aa3118f23a22d39e70f23acd5f4a620d812f0381

SHA256
2bcf6164cb0e4b71f756921ec0a65d40e83ec5bcf5ec0314b39dc90754a7fe58

SHA512
4683f78b5c7f909edd90f95e7eccf6f2dad11981990819a45309f3a366d1d69c38895218e4bcbd8c5803d5332a01e2a9c66ab1fd33457f960270553bbb604403

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
6d57a067fa332ea87030f905422a30e8

SHA1
b55fee8d25e27d9e25aa67891df8f097fa49179b

SHA256
a3bc1d1fd8d081ecb4c97b7451e98c0d9da7e51f17a81031f8cb11278ad5fbd6

SHA512
bdef63473de339171cc89e06bfb793b13763bc94432c16670ace11aa35e5eb67596ac6dbfaffa152315040b1b7bf1c06fb040e7c939ae426bf11477fb5d6c02a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
8dd342479d08d593d3da8b5b70ea3fd9

SHA1
dee84de4f3d40f6a32da2d7b1fc6fd434f5188b4

SHA256
f5e996e342eb76d0d1d0f34caad4e92b2e361ffd015566522a00bdee6081ffc8

SHA512
3c0ab8cd4fa847f616946d184bdbd618dbc227dadfa2d29958293f2dc769b5e158d7ca800a46ae790fcdd9b9951bd33e85052e985172c2f02cab8dca2c0677ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
be0724e518c2a3cc0a8c43cdb2e715df

SHA1
7aa2500a2eec567b4323af513e14a09403347af5

SHA256
3049a04237c9775618fd44f0a5504df68800f9810d659ccb89d8d44a76584e3f

SHA512
43934ddc30f7c6b0f4ed7bbff9c944ee0f4df2625ab31555696e7c44f63d03e09fcd77a0ae0cac2ef4178e7fe96c33fea87f688c98ccd80547ac5e945af14efe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
9099eb0b8fb61f15800719232ff8a982

SHA1
2783a7770e3ef956c0743ed6dcae7d520524facf

SHA256
0ff1010f91a123f0c4d56d24ef7b6d05c1a246a717faf7ce0797a35b3ca677c5

SHA512
fbbddeb66794c0373c9cf00bb350d1bbba7f0ed32e1ecb8fa956cb25d78494749a159a1ca6375f4734d7d17439a5da5eb74fc69669ba39055c951ea173350d2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
873B

MD5
dcf66c0e9efa03957adf46f1f2411007

SHA1
abea9409a79e841c64bddb67a4d152f1db59c7de

SHA256
fa1487fe488059144cd34d0614b062453ea7b51eb862c83a94532e4d90fc47e8

SHA512
17c177c407e5a35e1f153c2140ba2bcafd0f94a217c6a4c26eb7ad7046a1bc630dd85265eac50d2eff24c4884dec7a8a3965aa0dbe054cefb78e5f34a590fdb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
873B

MD5
dec54d0e92fe3c3698e1dcf96c462bf0

SHA1
8161c1af3845f5afe87f8ac5c40829748a20be01

SHA256
b1214be8a7ffa29eec86ea12884347e689a728b1a6111fed34c2cfe374aeb1a6

SHA512
b8dd27d475c045659ae156a5bc012556a3caf60455ffb2a1939deb37c8b6d3d925851991843ac67eabd3c7ab9d09cf132bb4dbc1128c16294b49524d1fe16f97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
873B

MD5
7f2a8f54ef6d2618cac60937cc5a3b13

SHA1
282cb0516b86de022f5f287e59f073af823000e7

SHA256
4a4709fba4c0b75d56554bd6e4035b4b10fb866b80cfa5a5e6bacc9143f0fe32

SHA512
b7b34c00cb4c8241cbf3c60a43453cd27a529a96f29499aac181d44c0a9f3da48aaeca0e6e956cfecb3db104f13827588c87cdf542dc5c5375081d3762aa67f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
9a46a5586dfed99a93698877fcf33cc8

SHA1
8f5fbd6f861af7016faa72a2df529de29a581909

SHA256
204cbad1165961b0b076aec32288f67ed1af23b1bfdcb63a6f10ed02c0cfd021

SHA512
ece840d31167d9f8b5842b1c64aa6a383c154c2a679c344cc3bfca48dea823576279e72a7002063eb744c250d89537369123734a80a825b43b1fb917272288dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
873B

MD5
93a5f56290d37bfe74162a13f1624ea3

SHA1
dacaed04c1dcc7099b0351be4cd6cfaabf200a30

SHA256
dafe3a353d81b7b57508b00be36844e686a589abb832e64790362340625c709f

SHA512
b1e91a123f5ffd3e9cfeeea2cab20cfcc75c7a4fc61638b8bad1de6750af1ac6d16f2e8408ac453d34b4a8882d9a6781f70250cd878791c2cb8d501964ce5a62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f721.TMP
Filesize
871B

MD5
119bd1ce782ac6633467141ceeb1c88a

SHA1
106d1eb2f7a02e9c9198e872a6d5274f614080b4

SHA256
13c1e1355cad3bc17c058a5241f736c5e0605c66ba900a94987e56d126082bdd

SHA512
70d061ce60ba468326e632bfa42132832782c211ed296a5fc08191132235d8c03d7cfd5286be144373ebb19ce90b7b468149c047690ae7546671aebb68eb190a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb5f0251-1bf9-4b08-94db-05cfda4f93ac.tmp
Filesize
7KB

MD5
1aa17767562bdef9859a5082a7637585

SHA1
74fc130f65058d2c1a9599f7c1bfe2272c7e7c5d

SHA256
7a6d56be921ac6943de17fa25d9c4fa2c6bb694c4e09c43f07ca31315c5d6bb9

SHA512
c830699751c5f900ef3696dca3efc81b63b397721c4579a559ed3861559bf110ac959b7c2b933b93cc7eba08cd6c93cf8d8039111cc82d0362d0cc83c6def299

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
b7857ab93f246b464daee580097c118e

SHA1
9be4ac05b8ecc7770cf0a88933a6f9f6a7b24309

SHA256
0e67a8e74f71cfae10378e6a31581556277341ca876e2af6ea91fd0cb9a02d68

SHA512
356dba1d91f3dce688ed604d3feef9dbc88b460d774b49f9b7f5d48ef5812768f4b658804f9782139a5a39bf16d3504510564811b5c92238bec03625850959a5

Download Submit
\??\pipe\LOCAL\crashpad_3644_YKRBGZSJJWASQSVZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit