hxxps://we[.]tl/t-q6Wvj1f2Zi

Analysis

max time kernel
296s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 12:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://we.tl/t-q6Wvj1f2Zi

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1448	msedge.exe
1448	msedge.exe
4624	msedge.exe
4624	msedge.exe
5284	identity_helper.exe
5284	identity_helper.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3876	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3876	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 4512	4624	msedge.exe	84
PID 4624 wrote to memory of 4512	4624	msedge.exe	84
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 3624	4624	msedge.exe	85
PID 4624 wrote to memory of 1448	4624	msedge.exe	86
PID 4624 wrote to memory of 1448	4624	msedge.exe	86
PID 4624 wrote to memory of 4392	4624	msedge.exe	87
PID 4624 wrote to memory of 4392	4624	msedge.exe	87
PID 4624 wrote to memory of 4392	4624	msedge.exe	87
PID 4624 wrote to memory of 4392	4624	msedge.exe	87
PID 4624 wrote to memory of 4392	4624	msedge.exe	87
PID 4624 wrote to memory of 4392	4624	msedge.exe	87
PID 4624 wrote to memory of 4392	4624	msedge.exe	87
PID 4624 wrote to memory of 4392	4624	msedge.exe	87
PID 4624 wrote to memory of 4392	4624	msedge.exe	87
PID 4624 wrote to memory of 4392	4624	msedge.exe	87
PID 4624 wrote to memory of 4392	4624	msedge.exe	87
PID 4624 wrote to memory of 4392	4624	msedge.exe	87
PID 4624 wrote to memory of 4392	4624	msedge.exe	87
PID 4624 wrote to memory of 4392	4624	msedge.exe	87
PID 4624 wrote to memory of 4392	4624	msedge.exe	87
PID 4624 wrote to memory of 4392	4624	msedge.exe	87
PID 4624 wrote to memory of 4392	4624	msedge.exe	87
PID 4624 wrote to memory of 4392	4624	msedge.exe	87
PID 4624 wrote to memory of 4392	4624	msedge.exe	87
PID 4624 wrote to memory of 4392	4624	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://we.tl/t-q6Wvj1f2Zi
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff914d546f8,0x7ff914d54708,0x7ff914d54718
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,7843319005507573834,15797296573657420803,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,7843319005507573834,15797296573657420803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,7843319005507573834,15797296573657420803,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7843319005507573834,15797296573657420803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7843319005507573834,15797296573657420803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7843319005507573834,15797296573657420803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2056,7843319005507573834,15797296573657420803,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7843319005507573834,15797296573657420803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7843319005507573834,15797296573657420803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7843319005507573834,15797296573657420803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,7843319005507573834,15797296573657420803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,7843319005507573834,15797296573657420803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7843319005507573834,15797296573657420803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7843319005507573834,15797296573657420803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7843319005507573834,15797296573657420803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7843319005507573834,15797296573657420803,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7843319005507573834,15797296573657420803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7843319005507573834,15797296573657420803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7843319005507573834,15797296573657420803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7843319005507573834,15797296573657420803,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,7843319005507573834,15797296573657420803,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:864

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x49c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
108KB

MD5
ff5f6eb22cad5bfbac357077bc963f07

SHA1
7926b4fc2d292ec4e007bfbfb08b6a1ca93cbdd3

SHA256
aeb909116881e83f54f709a0cdd20f8e70c9d035b76e1e65ffa6f80d739fc523

SHA512
f10efd05b45ef5baca758c2de80c31853b25268264dfddbb0f513d33cb96c91886be7abcf343fbb347318d7df5d437d538821e4bf0ce8d165c9fa7f15840b1a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
f7eb6a3ddc090c086ad763a41cc0dd6b

SHA1
b8591efa3b712b575e125fbc9ff7650e842a83cd

SHA256
ebe760129a246609fccb6ec4ca0afcd30181000d09949141b422b194996f6ce8

SHA512
64a019614c0c92cc2f0859ca4e360061b511a7537c0bfb5b3b2df7c14b40e7daf3eaab6e9317307719f8dd8526cc305cfe18ab800cd6574ab2ab424022f30786

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c5846729f03a07882de1fab98b11c4f9

SHA1
6aebdfa57249f59c770e8867c42b55fb2ece1346

SHA256
8df4655b8af312b1c5ac4280cee45b4c3f06a2b6b557ce2e636b9da12172c9de

SHA512
d5aff4c37ddf75909f3f83559fef6d3df9f5e204c2600b6719213e4f61476840c1aec06ea1ffd0453df0dfb71d86eaf2fb4bdea676e8c6837a7819b79ee325e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
54ae04d2cd3a89e8be715f82926bce91

SHA1
f1dc6b449ff52f07c2f053d2145dae1c149a8959

SHA256
b63f4a222513fb6c79c96ec93610ccc7b5d448fa9e2d57e312c1839a230d0130

SHA512
57a41ebf48bfecc38970511a4f60f245923c362e9d0e4c0b52e51a941ccd044ec669e427c6d83a599e3cca3a76e52c10209b263886397f1224779dc2a9fe6483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6f2f97a68a138df1832fd3cda592abb8

SHA1
6a548b2a9e37e79b7b9f194ecea0b200412a019c

SHA256
caf97657a03c6d4613aea0e2b95763131b3e9ca09f5b830a0985c59a7b5a0440

SHA512
baccc1b39ffd948562710e936d25fec553bf9607099c864c8f295f6493f40fdef071dbbaa9858570205ab3c7a1d0bacdce666d8b6f28b83728be2ec635ab06db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0cc8c3fdbf1fd8e55edec9d8363ff715

SHA1
2c79fbed0f3d048f7fb8d47bdbf15490aa78c704

SHA256
bd62a1f9b074daf766a483ab431d0081c10c8f8602a37d519e5a0a5a6094fd32

SHA512
5a8a9427d2ef7e9b450810a72c97009d61f3b33f1d9d8ffc4bc7b59c24e9af13a079f5e64ac39a26cd7a05f39300d8f9a1b51cc4e606f92bca36552dd4ac354d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
dfd1038959aff310f37f4e995763a7c6

SHA1
439b2c5846904c14bfa1ad8ddc781e5fbc14a45c

SHA256
5d8fa711b89827d9c8cf0c57fd46287a2a6d36873821931bcbaf8c21f6db10b9

SHA512
57db9bd830aeb4862cff2a6a24fb4ef1bcb3d22a4fe847278d75b13383c9b3c9a382baf9d201ebf6c1ad5a52a3b11b4d75c76ac99647671598cb30293753542c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
656fdd9344a2b3bdfe380d6aea2020d8

SHA1
c7a513bf3528beff660644b2bf9e59f537e300e4

SHA256
60f057424f2068b4cd1d13de9a2bff9555e7393f09d46590e2eb124632d82837

SHA512
f4dd817f802a4a74d994e417530a172658c0198300b503dccd4abac1c6561125108bbce79a5fba56b2378a8cdf798c8ea7b0d27ba7207b19e4ac9b9dcc1d1e00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4c792d8ce6c36b957358a31fb0e2a122

SHA1
cc2e1f6009bce11d5cbff8e9f9cd6a93e0c8b922

SHA256
4bd2ba167ad45104b6627a8780aec58e78d14cd1eca2575a77cd1a11730bad7f

SHA512
c43ae1ee3f89b8ad139d5b630de962f1bde81f735357308f71d0ffc6eca63ee6dbceb4c8c796d6c345714b641f7594f9ced177d47ed948004b1173210bc79b15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7684863120270ddbd1d497805a50b897

SHA1
0f39edbae225cf397f0c47daa154ba6e6800f079

SHA256
2e458b8758d5c4a13c5b320ffea5f33ccdd225e368fde1f647eeba7946aa2d36

SHA512
02aeb32b0a0e23b2fc0f8ca7745614bf3c3abaefe30720823fa49819fa68273c62f402aa7a285bc7ac90f170b8c5f13e28fc31929783d4ecd2e15ff278fd5643

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aba0dcf7db4e4c659f1d6386d6d60517

SHA1
aae97012ff28d5e92dc30aa90902c470456c66a3

SHA256
14d4e3471cb2c0af043a20874c951703a5056729c5fa46781d05859432c52f5f

SHA512
0619ac19d608f5df461ad978ed8e5dd7b5d8ff2937d29af4c9d231e117620cc7810cbbc386dda794575f57d6777142189ff9a9c0fafd7b50472f9141209ee89d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ef6d4fd8d14b020f505a0bd7397fba10

SHA1
0aae4f8b5f8a90d5487641574fbef5132c85fe46

SHA256
0bcd1a24f18bbfa3d1fa366572d9713bdd8321e158aa8e848f04faf3d3a93f85

SHA512
f150750683a4277560e2141b0519c752a5415c93315e5100d02330eeaad14e16e51b8c9ca52958284a3a75f3505168d1a47285be351edd1ac9e533f62d45f7d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9d9ca27557a9f417de8febe93659b41d

SHA1
5220e22ad757ab3ac4def7bfe508f01e11594ffa

SHA256
bce77d0592f7254daf5e5411393a4a86c724c7b99db370ad076e29e0ba303fea

SHA512
79e503cfea8db6b0eaf0d2fd410775556f596427118d0f1c9b77965245099783a0b0d6b0b61ce9a8e4792f570529e6d3a92f33e8425bedb432b44c4d8ae16f49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e6af764923106f5ea93274e9528335e6

SHA1
1c4f13ffc253084fc234675a74511b01b0442f65

SHA256
99a38e8c003e195c15aa028e160e9a0bbf2552215e5067d0aee655347eac12c9

SHA512
d88d42c7b7750978d98c7301222327fba6e36cf6a08520c34e8009e07ec627ede0367dc3a94e6340178e51a833d163e4e4d7ff060b7bb6688a080ee12e188d2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
acd6fc72ccdc49cc63f2d5d767b09c1f

SHA1
cd1930fa55b13fcd9d5be08044a258570b10bcb1

SHA256
583d2b7a481c04c99143cc18133f221a1b0a84708851de486b8bf5447f1b5933

SHA512
5ec2110435a8155e1575bf0696945588834730aaa787ba72e8b11f3923547ec43bed03c50c2907f7b5b79d203f393d8694d277f42240a3bc444006db2bd8ea21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
843a68b05024b5fd1e1c37a3696a140b

SHA1
4eea1a0f10cc1a5b861dff2801de517a317c7926

SHA256
5273845781d14be5e516aa14af41d5f30af9ec619f9f8cb0e3aa93543fadbbaa

SHA512
031e70c63f3aa0c518433cafea277ac53d0205220940942565d4b3077f0d37c8ebcf19e22fbaf4cb0a0f9113376b385fbde422925a547f607e4d615dba32a481

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4bcbdafb8302bbe5694da7054c95c70c

SHA1
46d7e8e05fb84f7f5be452e25f5a61d8e71020fe

SHA256
2e91b54d374fd35b93bc17600fffc53fc074951863bb58d1e7d71034d8c567bb

SHA512
66abc63c150f5eacdd830f625bb6d67b8c4818491ec184f92b6cfa4fe16345433361eb0787eb990f7d0a21e649e01e413d1befb14cd3434f65704929d1125c8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6bfdd336ca829939a62cded47599e66b

SHA1
14dac636931818b8f5160f60bde40b249e703acb

SHA256
09abc9584f01405d7c6a0295c97dd7c96f7d48c32bad23fdfebd62781048b645

SHA512
a6deb5f98e9b84a8476c65c141fb9fbf6842ab84c028f866f0a12f74cc1925e284b2589f40354d0f87867bb8ac7656772783098d909dc48d668e8c761ea4e6db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2c7df3dfcd34e5df4e91ed7bd75d5b30

SHA1
a9ffa47b438fb8c1be1ca5fb93ba77bb6a55e92b

SHA256
fe4d47cc0ba77a512f03d793ef690dbc09a02c381a75b5e1505ab602799313f2

SHA512
a5482c85cf57b73529f677c0a6e5a174278042df290c34314c3f8c1035cc2123493cef921132071a03e834b2ef5b4f8cfec2546e82809427f442c54f659fe5b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
332aba590eda443c01f781c57b5aadcf

SHA1
4b3ff0ef5c39c5a4e164b4ad8699eab09c24086a

SHA256
3fee4ac4bdcd5b818a9c718ba5c84e2a773c68f4d1dab545f874d4d1a11150c2

SHA512
808fa6c1414f2d21377de07f387f8dff88f07e11793eaec27fd463fccf19028d5bb0bf0b7e8cc8ad1b0a89c7fba61576a75edce31965c412ced1504f33410c35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
fedf84a023788d8eaa9fa9a4d0d9271f

SHA1
64842001319c6ad4e3f393f5714ff913cba851e2

SHA256
eb30b8fbf55e047ecb2ea801c7178ff820e488cd4f45b9462de0dce670cd8122

SHA512
d0825fc888b6f160060ce4b23e88f697d1758a38165a54614ccc6e073d03cc068d06612f207404ff8dfdd234296ff7de69c3b8b4672b10248c18d02ec507f4ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
5318038ee2a154be5be9119bbc187999

SHA1
949c6167739d1de4bfdd2521a0381d74b07daa12

SHA256
f26554747cbe7d77df2ea8c1b4426bc8f354f4c431f255cae943062dd22eee66

SHA512
64f63f4ecc21492a741ef7aad6b48c59b8e290a76b57505537ef5df5914af34bdb5234ec249b6297732e7e0c34c9adb22363a9ad333c221fd1978dee43154a0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
bcb1afa22d287b94ec5fc437326b60ed

SHA1
21e55075765d4901122555e5552973a8c4b12fd4

SHA256
58565ff82cc6ee7f205d788da1e44aa56ddbaf82d37592f324bb92766acd5b83

SHA512
f82154c347f9c24b806cb89f0c660e38dc0c2f574c355b040dd2b4d1ef6866db9fa622371bc3c4c0284e74b31748c135c29e1db694d3ae4ab20a592c4c28cdb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57eef4.TMP

Filesize
2KB

MD5
8be2e828b13e7c69ab29ace8f8b067fc

SHA1
f02f1eaea67b2a74acf966d28a3a12ee12e6c0d7

SHA256
e0e9e688597471321fee0e3d0a07da1a8376e21991026001e1b6beebceca4d8d

SHA512
2d187ee2e887963adf7b8f5804c80dbeb6a1d15221120fa789660f2cc37b75693865ec12164c7440ea90bd47b1ca17b95dbba60aec25549336028a436a725744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8a7d81901ad97562f1a5c6479d56c429

SHA1
39a51248c610be55d22aa098b8cdfd462c7fa0fe

SHA256
45f24d7c3104452d51f433d35a30221f227d7b7e1b1040dad5cba0cdc5202f3b

SHA512
650cb18e469d0df1cb6ae4f70446ee15065c80807e42010b2ce1fecfb845214cafde802fbc6f24ff988b637a44dadca97d4b4aef27a7b9108e7b367038c90c83

Download Submit