hxxps://4jk9hw1t[.]r[.]us-east-1[.]awstrack[.]me/L0/https[:]%2F%2Fm[.]exactag[.]com%2Fcl[.]aspx%3FextProvApi=sixt-crm_newsletter%26extProvId=313%26extPu=nl_rac_de%26extLi=DE_COR_RENT_CRM_B2C_24_CW33_From%2520Intermediate%2520Push_ONT_NLW_de_DE_Streichpreis_138402%26extCr=Footer_rent%26extSi=nl_rac_de_2408_DE%26url=%2568%2574%2574%2570%2525%2533%2541joepacifico[.]com%252Fwinner%252F14757%252F%252FcmNvcnRlc0BoZWxhY29yLmNvbS5hcg==/1/010001919524fa84-d81d6f28-6f8e-4238-8f2a-d74bc51b0a9b-000000/Te4ilMITRFQhiublruj8klo6f1U=389

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-es
resource tags

arch:x64arch:x86image:win10v2004-20240802-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
29/08/2024, 18:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://4jk9hw1t.r.us-east-1.awstrack.me/L0/https:%2F%2Fm.exactag.com%2Fcl.aspx%3FextProvApi=sixt-crm_newsletter%26extProvId=313%26extPu=nl_rac_de%26extLi=DE_COR_RENT_CRM_B2C_24_CW33_From%2520Intermediate%2520Push_ONT_NLW_de_DE_Streichpreis_138402%26extCr=Footer_rent%26extSi=nl_rac_de_2408_DE%26url=%2568%2574%2574%2570%2525%2533%2541joepacifico.com%252Fwinner%252F14757%252F%252FcmNvcnRlc0BoZWxhY29yLmNvbS5hcg==/1/010001919524fa84-d81d6f28-6f8e-4238-8f2a-d74bc51b0a9b-000000/Te4ilMITRFQhiublruj8klo6f1U=389

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
1972	msedge.exe
1972	msedge.exe
384	identity_helper.exe
384	identity_helper.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 3672	1972	msedge.exe	84
PID 1972 wrote to memory of 3672	1972	msedge.exe	84
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 1140	1972	msedge.exe	86
PID 1972 wrote to memory of 4012	1972	msedge.exe	87
PID 1972 wrote to memory of 4012	1972	msedge.exe	87
PID 1972 wrote to memory of 1056	1972	msedge.exe	88
PID 1972 wrote to memory of 1056	1972	msedge.exe	88
PID 1972 wrote to memory of 1056	1972	msedge.exe	88
PID 1972 wrote to memory of 1056	1972	msedge.exe	88
PID 1972 wrote to memory of 1056	1972	msedge.exe	88
PID 1972 wrote to memory of 1056	1972	msedge.exe	88
PID 1972 wrote to memory of 1056	1972	msedge.exe	88
PID 1972 wrote to memory of 1056	1972	msedge.exe	88
PID 1972 wrote to memory of 1056	1972	msedge.exe	88
PID 1972 wrote to memory of 1056	1972	msedge.exe	88
PID 1972 wrote to memory of 1056	1972	msedge.exe	88
PID 1972 wrote to memory of 1056	1972	msedge.exe	88
PID 1972 wrote to memory of 1056	1972	msedge.exe	88
PID 1972 wrote to memory of 1056	1972	msedge.exe	88
PID 1972 wrote to memory of 1056	1972	msedge.exe	88
PID 1972 wrote to memory of 1056	1972	msedge.exe	88
PID 1972 wrote to memory of 1056	1972	msedge.exe	88
PID 1972 wrote to memory of 1056	1972	msedge.exe	88
PID 1972 wrote to memory of 1056	1972	msedge.exe	88
PID 1972 wrote to memory of 1056	1972	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://4jk9hw1t.r.us-east-1.awstrack.me/L0/https:%2F%2Fm.exactag.com%2Fcl.aspx%3FextProvApi=sixt-crm_newsletter%26extProvId=313%26extPu=nl_rac_de%26extLi=DE_COR_RENT_CRM_B2C_24_CW33_From%2520Intermediate%2520Push_ONT_NLW_de_DE_Streichpreis_138402%26extCr=Footer_rent%26extSi=nl_rac_de_2408_DE%26url=%2568%2574%2574%2570%2525%2533%2541joepacifico.com%252Fwinner%252F14757%252F%252FcmNvcnRlc0BoZWxhY29yLmNvbS5hcg==/1/010001919524fa84-d81d6f28-6f8e-4238-8f2a-d74bc51b0a9b-000000/Te4ilMITRFQhiublruj8klo6f1U=389
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0e5746f8,0x7ffa0e574708,0x7ffa0e574718
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,9502166073918767015,6250143299888788864,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,9502166073918767015,6250143299888788864,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,9502166073918767015,6250143299888788864,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2156 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9502166073918767015,6250143299888788864,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9502166073918767015,6250143299888788864,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9502166073918767015,6250143299888788864,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9502166073918767015,6250143299888788864,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9502166073918767015,6250143299888788864,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9502166073918767015,6250143299888788864,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2876 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,9502166073918767015,6250143299888788864,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,9502166073918767015,6250143299888788864,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9502166073918767015,6250143299888788864,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9502166073918767015,6250143299888788864,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9502166073918767015,6250143299888788864,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9502166073918767015,6250143299888788864,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9502166073918767015,6250143299888788864,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9502166073918767015,6250143299888788864,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9502166073918767015,6250143299888788864,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2216 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9502166073918767015,6250143299888788864,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,9502166073918767015,6250143299888788864,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5732 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
19KB

MD5
48981d3cf57e7c58ca7e3e851ef9354e

SHA1
73593de7633b10f9ffd0ef0e46280fa40ff433ff

SHA256
8a5e756923cc5c3f013862427b7622f58a52501c5a6017fff2fdb2afd94a10c2

SHA512
4e2b6ea222ce77e6ec12e059362dddea13758cdc77259ff5cf449bed5a1677e112cf49cd7ed7b1378f96ffd7c5e21be66d2ca7eb2a9cd8026732f867fb5ae8b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
175KB

MD5
7107c752f3901d95bdc4e9d46ac2b6d8

SHA1
747a0d933dc2ef38a98fa11a44ba661ec6a5eae3

SHA256
c4a5ecaf090da5f8115afcf0d4b723810054ecf3de31acc5ea6d48f9eb2d4111

SHA512
71d4ff3fa6c9a902b299302109d034d4610ac8a31ace170f09a3f66bd0d1259c41361fc29f2205fec6eb49995ffc73563399a6ccc536b8412bf1064485caabd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
159KB

MD5
78450fe21afa3391dc4dc62d5f1e09f2

SHA1
8aed39e81b26f10dd32c5b131eb7493d6d41b06a

SHA256
4903f015531ad7a745aa8c5155780c51adba6e0f671607c3fa1447795f33b794

SHA512
46db3beebdbfc0ae2b4e6d8f015e0f122851cf57662d5f445e2c4cd4f7ca2097690a610247e08f789685411d75b018cc35bc0a679b4dcf9e68c9fa164f347256

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
165KB

MD5
34049e45a502035c1ee78f0b0967588e

SHA1
dd604c54963f4ae0cb4cc1c6890b66822a6d7b82

SHA256
a84c114bbb185448de945b27fca0b6ee207f4801505e3046f35db050f4720eaf

SHA512
07b046af74583dc5ccb2dd1a636042b36dd4ee50aa6e7a3871cc26bec7aee823dcb2ef8bae3f465a374b04ae92b8cfb90f41ad3a76a0d2db1b6ca764d8eb204c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
142KB

MD5
d1e0216a2cc3db1dd95ad3230a39a0ca

SHA1
a629d848286dcdb6876631bdd3bfd7dc6e05422d

SHA256
b41f67ebf201d922b8668a628078e11dbece1fdf875d1df93495c3ba3cd31372

SHA512
50f8b14adf524175f2867c7e198c71f78a5b9a1c2447229a418c382519299820ea1f0dc77af121c58ea116e2cfb4163b62c961cdb7091fcc4e9691d6135f3883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
43KB

MD5
820f40594a0e8d5f9d58546208aa9060

SHA1
e17ed5116a34c432013a244c979ac9da53829d74

SHA256
f8f708049e1e1609af3959cd21eaf313c8192d3e962887a7a2e1f9b353d3fc80

SHA512
95879b255a90ccdc41c8696bf7aa05796db56528fc4be78f2d13eb2233740ac8cf0f92bdeaa169ebc5c745f3e76ee9fc67d2626160b9e01c5f5a19b8cbea605f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
672KB

MD5
3e89ae909c6a8d8c56396830471f3373

SHA1
2632f95a5be7e4c589402bf76e800a8151cd036b

SHA256
6665ca6a09f770c6679556eb86cf4234c8bdb0271049620e03199b34b4a16099

SHA512
e7dbe4e95d58f48a0c8e3ed1f489dcf8fbf39c3db27889813b43ee95454deca2816ac1e195e61a844cc9351e04f97afa271b37cab3fc522809ce2be85cc1b8f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
53a16aca3ba48ab7d302c2e4620cf1f9

SHA1
cf448354e997964ecc9f50b0068da90f01784cfa

SHA256
fa649cac48689583a210567c10107a7dfccb69cec7ae48fdfdfbc163041e7535

SHA512
d5cac9af5c986b6c7b0d0014fad93a8304e37e3f82ccf82d18c2a8f360f1470c187ff77a1910eb37720558c73809ab05097da2c622ec211ec419d2f1f878c44a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0639b583cb141c5ecd3b0a596a60b8e9

SHA1
b2b17577fcc8ba048292444017858a544e25a61b

SHA256
f1213da826e9262fd5d48d6d854d09f2ae4c92ecb066e3a9c77c56e475c90f44

SHA512
e34d4079d9648e1193fb6ed9b2dc16df0e688a18c7358859fcede49cc59d72ceabb89d6fe2230a49ad111b079d3f1dac9f030459c7934f8cdbb9e7b1b3b38d63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
30a72b4d84e6439cf8431dcfbe992a25

SHA1
afa379c3f153fe031532154fd28deeb0baa5bae1

SHA256
d042736afb7b34ceebe2c03fdccc9acee48f04a69beeb2b7c2b41857c7fdb624

SHA512
451147cee2459868d137634b5530ea2467050b208c9d4c68ddaccde09737870b8e1b6989afd299754b7aa01cd0c409874996bb96f981aff2544646569d1e3412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f25c83e6d145adb2e4d9ca06ecd3d450

SHA1
e610c3e6a9059a237356cbdac6808898d4dbd053

SHA256
6fee544486d9dcbab2670e1d9a08d2d807a24eaf07af371cfcd9fb48ff0f24b8

SHA512
0b11a774d36bf20afdfbccb9cf7c37d595bcd65fd8d58dd5b5a41467b6428d774cedb8cbbecfa20897455c548af9cd3a51e17ad45f306fc64e2efaa41c4d8619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98139b2cbe5806e7e528a8631ae1a242

SHA1
e7f955d8b0cfa45c80498c45f158a70ffcc4aff7

SHA256
f13b1a5619163aca9528a54585c757ffb65c1cf482f88c31e300c21edbe67432

SHA512
d07e67801c71b2c830820739437169e6485f8d64be966c063dbe78832fa0d6a2a92a8dac9815ce0bd30eeb26eeeb1c19dc9633018bdace8a470b205d7c91aa69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
2ccb064d71498bc99ffa86b34a5b4216

SHA1
d0dea62cc5edd9ddbce460ba9498514d8495f125

SHA256
d87523165965a7ac9ed89fadfe11bfa1d95eb51decceab764a548d30235818de

SHA512
971f38de937cf5d3e978d2c878d9d6cf371716e6a78ba7a74e0b2e924d907de9564140abe6a95739872ddc99f1732214e0995df95e43443ab1b4be0e363c486f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f81261ae685f37da07aacd747f1b063d

SHA1
29defd473a1605d6312dc0f9ef0e7a478ec8b03b

SHA256
b7a2fa03cfdd918fe57d3b886bf39700ad9a8623adce003eeefb43014047a193

SHA512
c73ad92cebd794d7e7ec50d35fa557e905be9fd74c234bdfe8ab73a63e72de6c4a88e880b3f949a092be6fd7b3938e93972453c43f3da8e92eff0e5cea728362

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
721e43e4a53051ac9a4d9f62d186676f

SHA1
3e7cc151a36b86b8509d32ae8e8002b995f78903

SHA256
8a776362d47707897f2549221cd1cbbefc1688e09d47b8d650f875f65e37b7e8

SHA512
7ec45ba5eaa1c149bce08c1d256e8f8f4bb1c4e150c1b055704c529010eba53552c74aa92b010c921c1ff8b1ea0086f8dac56ac7cd839c778dfbea59d10529e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
274c66b9de6b004168fbe74eae0fa699

SHA1
1849d164514426c689eeadc1d0148e76f9efbf5e

SHA256
6dd70949886640bc42583c5002174d7c23ab6eb9cb1d38c0170bf5c6b69d5304

SHA512
a6c0b01801ef38d2b68a52f472a34ffeafba5b639eb4fcdf84fdf595c413a78b9eb1c66ef334735dadbdc6a430c0474996962f55a1723c0e4bcf361ce97113c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583582.TMP

Filesize
204B

MD5
3636d5547a3f5939a2d8dd60ce94556f

SHA1
7720ca78cc78f490741ae6378f6bd4f0ca582d2e

SHA256
347385644daadc17b8fd59a55ed2fea536fe0ead2c812ef2eb99d914b0c8a3ba

SHA512
42c95d477edb305ce81fe43e41b47dce843f9f7f8e2144a8bb8a26fd727d82d52331ebdca2953bcb3d7efd36f36dc742ebe6309f449d85da05c7a22f56304b3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
eb1e9646c0d8504e0e8e5bcb1b23614a

SHA1
75ec882668c541eff2f4fa2026fc7a52389eaab8

SHA256
0d422c2558ed35cdb7b2cec8348d2d91d40e20190de8fcaba14a6b637b0dd956

SHA512
16a6853e0830c7c398b711073ca0db38b48431cacf0cb58973fe5fb446fe09c6d5ee355a6c7c613935ce9a272841839b88e3356e14e4e4ce59c6c1a208d689d2

Download Submit