hxxps://t[.]co/nlZnXpAlq3

Analysis

max time kernel
1680s
max time network
1796s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
16-08-2024 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.co/nlZnXpAlq3

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4892	msedge.exe
4892	msedge.exe
5080	msedge.exe
5080	msedge.exe
3560	msedge.exe
3560	msedge.exe
2952	identity_helper.exe
2952	identity_helper.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 3960	5080	msedge.exe	80
PID 5080 wrote to memory of 3960	5080	msedge.exe	80
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4740	5080	msedge.exe	81
PID 5080 wrote to memory of 4892	5080	msedge.exe	82
PID 5080 wrote to memory of 4892	5080	msedge.exe	82
PID 5080 wrote to memory of 496	5080	msedge.exe	83
PID 5080 wrote to memory of 496	5080	msedge.exe	83
PID 5080 wrote to memory of 496	5080	msedge.exe	83
PID 5080 wrote to memory of 496	5080	msedge.exe	83
PID 5080 wrote to memory of 496	5080	msedge.exe	83
PID 5080 wrote to memory of 496	5080	msedge.exe	83
PID 5080 wrote to memory of 496	5080	msedge.exe	83
PID 5080 wrote to memory of 496	5080	msedge.exe	83
PID 5080 wrote to memory of 496	5080	msedge.exe	83
PID 5080 wrote to memory of 496	5080	msedge.exe	83
PID 5080 wrote to memory of 496	5080	msedge.exe	83
PID 5080 wrote to memory of 496	5080	msedge.exe	83
PID 5080 wrote to memory of 496	5080	msedge.exe	83
PID 5080 wrote to memory of 496	5080	msedge.exe	83
PID 5080 wrote to memory of 496	5080	msedge.exe	83
PID 5080 wrote to memory of 496	5080	msedge.exe	83
PID 5080 wrote to memory of 496	5080	msedge.exe	83
PID 5080 wrote to memory of 496	5080	msedge.exe	83
PID 5080 wrote to memory of 496	5080	msedge.exe	83
PID 5080 wrote to memory of 496	5080	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.co/nlZnXpAlq3
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe4,0x10c,0x7ffef49e3cb8,0x7ffef49e3cc8,0x7ffef49e3cd8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,6742672683552850628,3286583225060250731,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,6742672683552850628,3286583225060250731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,6742672683552850628,3286583225060250731,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6742672683552850628,3286583225060250731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6742672683552850628,3286583225060250731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6742672683552850628,3286583225060250731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6742672683552850628,3286583225060250731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6742672683552850628,3286583225060250731,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2340 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6742672683552850628,3286583225060250731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6742672683552850628,3286583225060250731,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6742672683552850628,3286583225060250731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6742672683552850628,3286583225060250731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,6742672683552850628,3286583225060250731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,6742672683552850628,3286583225060250731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,6742672683552850628,3286583225060250731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,6742672683552850628,3286583225060250731,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d30a5618854b9da7bcfc03aeb0a594c4

SHA1
7f37105d7e5b1ecb270726915956c2271116eab7

SHA256
3494c446aa3cb038f1d920b26910b7fe1f4286db78cb3f203ad02cb93889c1a8

SHA512
efd488fcd1729017a596ddd2950bff07d5a11140cba56ff8e0c62ef62827b35c22857bc4f5f5ea11ccc2e1394c0b3ee8651df62a25e66710f320e7a2cf4d1a77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
03a56f81ee69dd9727832df26709a1c9

SHA1
ab6754cc9ebd922ef3c37b7e84ff20e250cfde3b

SHA256
65d97e83b315d9140f3922b278d08352809f955e2a714fedfaea6283a5300e53

SHA512
e9915f11e74c1bcf7f80d1bcdc8175df820af30f223a17c0fe11b6808e5a400550dcbe59b64346b7741c7c77735abefaf2c988753e11d086000522a05a0f7781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
68dd00d18d98420b673d4dcdd0bf9e86

SHA1
1aee6fd9743150d31fd0b1e97e997c518a5b9334

SHA256
5bbe922c2fe7cb876f02a15656057324a5bd9b086187db946e7894474eb6ebf5

SHA512
599af86224f771c54957eeaa87e7108c4f13a4c242600ce33d1b4c636b6933373a201d6ccd7055cf1dbd23c26bdad5ba02fb81ab3282b4dad525a6ec8eb0ffb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3079f2c17d8580c88a39e67705fc8920

SHA1
8441ad59f2df53ed726bf56c8d3115b5ea3d21c5

SHA256
f828606e104c2dfb136b81a3a714959e6e46c87a0b8c787636f12c80624eba51

SHA512
c013a00d67cb36f258a3a53ac98e765b0f0e655477e17c4490b1a6b0b58c751fe78fb0b9f01397fb3cb2c820e27e460813474cc7f507d2a23b68ad4fb7455c77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
04488f3afb89745277cc1ad4bd56da0b

SHA1
08b21f57e6eb17d6fa296c95031ce51a28017ca0

SHA256
9297a3df0a53532f99a4dde8ae4bc90fe3eea7dc59868a95f16cf8999a530cac

SHA512
ca5b359718da116d1c09046dea6c7e265bf8c1f659800298d86e17ebcca6bace94b25dfaa30d1494abcb55ef0aa9bae07e9190f7427c320ddd851cef9cb0cd90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
02a20469e5f67c033c2248405894d615

SHA1
3fd1f565ddbba71265da115801946891d9034cbe

SHA256
b7d5925da195e6c3668c74217ccbe8f3055f6333466b2e25f786009420b02891

SHA512
e9c17c0a9edba4f714d23b74d290ce3bbea9aab988121364acc16fe64f480816bf22b54a3e9615b9df1357c4b1dedbca3e608b82edf8b4d408cd943e3e73f109

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\07df5a5cc65aa22a9a9dff4c0ec575265cc9b8a1\7078abc5-ecc7-46c5-bfb5-83880ec80899\index-dir\the-real-index

Filesize
408B

MD5
7869acd2938ebb495c5d6fbbcedd9e98

SHA1
88a53708d66ee0e025cbcec56ff417429a022b3a

SHA256
f377da39004c1c441ae12b66ed75cdd16d9627e15127e64b12f68a296ede317c

SHA512
3a43570c0a80643e345f1bc77a9baaa7cea045b5f53ca4e4adafbbb4cfd10d59aaa5900ec66eaff92126e2c747b9019921ee86d8c7a2d82702c8a3c5fa39f836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\07df5a5cc65aa22a9a9dff4c0ec575265cc9b8a1\7078abc5-ecc7-46c5-bfb5-83880ec80899\index-dir\the-real-index~RFe57a4db.TMP

Filesize
48B

MD5
d0b2353905bdd2f0777a46ce3f917b0e

SHA1
1fae444a8eff7efc14146e7d2e469ea0997dbe2b

SHA256
d945528d342a71b28e8d4195858e171ab73eab0aab80285492194459b338158b

SHA512
3ac5e891863adec8cca884094aeb7129ddfa57f010592d8fdc6f08471b8b98274cacee3c7b181c0fd24e5449ca22e1456023ee99f999de61ab08f421339d98ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\07df5a5cc65aa22a9a9dff4c0ec575265cc9b8a1\index.txt

Filesize
93B

MD5
bb20eb0da1356c0ef76d56de04f8050c

SHA1
fafb3f51c45b098a9afcf45fdd240ba0fdb962fc

SHA256
8af89c216b4ba9deedb7d01081df649a104c5b4ad66662c2dc37e958106399b3

SHA512
24a008f2a615911aa5e6c66408a36f070cdc8f084c50aaba95be78f13eea73722adeb65124ee3aca482be0cfb01c34750188346b13961f2cc477b5bccfbb973e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\07df5a5cc65aa22a9a9dff4c0ec575265cc9b8a1\index.txt

Filesize
88B

MD5
8de9e8fd421e93e24686e16a4b11aa64

SHA1
9715031f789322615e4ce5bf94e50d060b926821

SHA256
105e6904d03f6245e15e6707af38f3fa3e7b9fcece5ce4361687c8af1776b374

SHA512
18b5db8e1a1f3abda3a0d45caca0e69a6aaa0c008334703c30adfa22737b1fcfcea8f22e643c0d6769d4e8e4ecb1b40a227cfa2e1069a51990c3e4b1230d7e46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6112f279a111cae9325de5446c5dd298

SHA1
cbe99fb8661fafd94ddef449cf389cad21ab4523

SHA256
8201177cfbb855dcfdc2b171ba93022def0a13c040a8fcfdceedb6b5b1433ac1

SHA512
4a0c8a5b7ec5444ac69953816642f90e9955af563c36ef4434f3af3d9542b91fff339a1801bfa5d81fc1dd763fc64a12242becadd608a5ae9a91b23f944888fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dcd3.TMP

Filesize
1KB

MD5
7f0116669457de6854aa003d999f65c4

SHA1
8cfe9805a51653472b307513bee9e28d80491b10

SHA256
17a4676dc1d1dd8226b6339dbd8b06ae4abf4389ccaf55bb73ad4135c19b16af

SHA512
cd7a0d32cb2bae07db5cc1a29942b1351d46c4a174777c70d90b39cd9df401dbb16fdb3bf5f3a2f07b6192c2ee54b193fb2836a801b296752c3bb0339df9d21a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fde2b16cb154c5ce8d5f390c9315af71

SHA1
a4b02bad9fa6234b7c2067261f5efa110efc1af1

SHA256
98449c0d570e9659aa7069409cad1fc2f983752c195a06555bc55624105c8951

SHA512
4bc6edd01301f70f9be923b7046dbad03e3ae643feade80a76d0d9ada93b4879c1bf0df4fffff0e3815bf338da3532576e92e01bc1827cb9e457084e3838b2b2

Download Submit