hxxp://fidelys[.]tunisair[.]com/themes/custom/customtheme/webfonts/fa-brands-400[.]woff2

Analysis

max time kernel
329s
max time network
320s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://fidelys.tunisair.com/themes/custom/customtheme/webfonts/fa-brands-400.woff2

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4656	msedge.exe
4656	msedge.exe
4228	identity_helper.exe
4228	identity_helper.exe
5084	msedge.exe
5084	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4360	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
4360	OpenWith.exe
4360	OpenWith.exe
4360	OpenWith.exe
4360	OpenWith.exe
4360	OpenWith.exe
4360	OpenWith.exe
4360	OpenWith.exe
4360	OpenWith.exe
4360	OpenWith.exe
4360	OpenWith.exe
4360	OpenWith.exe
4360	OpenWith.exe
4360	OpenWith.exe
4360	OpenWith.exe
4360	OpenWith.exe
4360	OpenWith.exe
4360	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4112	4656	msedge.exe	83
PID 4656 wrote to memory of 4112	4656	msedge.exe	83
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4148	4656	msedge.exe	84
PID 4656 wrote to memory of 4772	4656	msedge.exe	85
PID 4656 wrote to memory of 4772	4656	msedge.exe	85
PID 4656 wrote to memory of 2324	4656	msedge.exe	86
PID 4656 wrote to memory of 2324	4656	msedge.exe	86
PID 4656 wrote to memory of 2324	4656	msedge.exe	86
PID 4656 wrote to memory of 2324	4656	msedge.exe	86
PID 4656 wrote to memory of 2324	4656	msedge.exe	86
PID 4656 wrote to memory of 2324	4656	msedge.exe	86
PID 4656 wrote to memory of 2324	4656	msedge.exe	86
PID 4656 wrote to memory of 2324	4656	msedge.exe	86
PID 4656 wrote to memory of 2324	4656	msedge.exe	86
PID 4656 wrote to memory of 2324	4656	msedge.exe	86
PID 4656 wrote to memory of 2324	4656	msedge.exe	86
PID 4656 wrote to memory of 2324	4656	msedge.exe	86
PID 4656 wrote to memory of 2324	4656	msedge.exe	86
PID 4656 wrote to memory of 2324	4656	msedge.exe	86
PID 4656 wrote to memory of 2324	4656	msedge.exe	86
PID 4656 wrote to memory of 2324	4656	msedge.exe	86
PID 4656 wrote to memory of 2324	4656	msedge.exe	86
PID 4656 wrote to memory of 2324	4656	msedge.exe	86
PID 4656 wrote to memory of 2324	4656	msedge.exe	86
PID 4656 wrote to memory of 2324	4656	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://fidelys.tunisair.com/themes/custom/customtheme/webfonts/fa-brands-400.woff2
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff882f246f8,0x7ff882f24708,0x7ff882f24718
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,18277752780123305321,2474941144278609324,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,18277752780123305321,2474941144278609324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,18277752780123305321,2474941144278609324,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18277752780123305321,2474941144278609324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18277752780123305321,2474941144278609324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18277752780123305321,2474941144278609324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18277752780123305321,2474941144278609324,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,18277752780123305321,2474941144278609324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,18277752780123305321,2474941144278609324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,18277752780123305321,2474941144278609324,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18277752780123305321,2474941144278609324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,18277752780123305321,2474941144278609324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18277752780123305321,2474941144278609324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18277752780123305321,2474941144278609324,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18277752780123305321,2474941144278609324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18277752780123305321,2474941144278609324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18277752780123305321,2474941144278609324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18277752780123305321,2474941144278609324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18277752780123305321,2474941144278609324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,18277752780123305321,2474941144278609324,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1940

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4196

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4360
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\fa-brands-400.woff2
  2⤵
  PID:3260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000043

Filesize
137KB

MD5
53d8275c15193a6f396bcb3e28453c21

SHA1
0710ea29e4d733a7098a51a0c5a540f014bdda7d

SHA256
53652fc8d50b394afbef20788eb9ebf582ff3b681158c4ca9c1b51e1f48727b7

SHA512
b5637fd793306ee89bfec1a538eb6e7f15da1e19ed0b1f8c6b2aec3a5bb27f047dd26149c9ddd0d018b9bd5260897301e8cf196365a1683f90cb8c03a6e83265

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000044

Filesize
529KB

MD5
35b79ebe0b7805c1c84524ad920faa33

SHA1
e0d7b2bde55a0bac1b658a507e8ca491a6729e06

SHA256
b4a35d19793de445f4622f4d28db279c0242b60228ef304340aad833d012a77d

SHA512
abb1a70ad42986762144fb8700d0adea6130e7a611cf9e978e51248a4e00b77591127aadec29ab83cb341ff431d96ce8f5c235f1914ee99c0ff408df259dae3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045

Filesize
631KB

MD5
8569328fe58981e7ad4406f67e7db34f

SHA1
07b8ede1f08f73dbaae16bd3546027eb82c6628b

SHA256
c28f706a07f1bcefc642d11658365aa0d73a0c9082639792018e349eb760581a

SHA512
10caf80a68a842c45694b049eb988e3d6ce263e1de78421fb3da712a4dc7454dfe5917f54d21a3854696910bea412ab3d817569c8a3dc4dd159b110085bf452e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000046

Filesize
26KB

MD5
d14867d9fb4da7fc0f7e33b1f7ba1d08

SHA1
06162e36f52b5a9dc16ef3e50a708a0c215443e1

SHA256
bdb7c6226b91cc9993d28d948dc2f7f679bf2fce0f9261935293e6c8ab5f3f78

SHA512
2ce18681966aa3dcd3eea8277806ef15c3b6f1f893dfa32624ef5f74d5317a373169b22042ccd4152b27dac9b598b96957b6d1b839742ec355aa770f7189e08d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047

Filesize
22KB

MD5
e6605eba3f163c13ced97826063fd09b

SHA1
6815a7a00b59c78f13a948480274b7694c04180b

SHA256
bf20931d3b44be9c3c8dd87ee5c520a96905293612ad27378e9ce4c98d4d8a38

SHA512
f6bc1a86f755a21b2b703f2531e30367b3c202fd563475da5dc1c58c8557fad9087b146cfd00feb14acaceaf457430a4e51d3ff0f616910eb3bcff6585d1a9e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000048

Filesize
23KB

MD5
033d1af0dee37f9153333e302857950d

SHA1
53bdcfefc7c5fbc6aeedb3523e67b1f56501595c

SHA256
340e312db110468406c7ad0ee3d74a826abfba76bca087f7c4bd0cd06d71ed81

SHA512
09744da1deb2629a8d3353c487e6292f32b2290a608e9d392c1f1162f73d02b9c76614f2f8180577f7988b828204acac21374791aab644c14abcfa01870aa485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000049

Filesize
22KB

MD5
be5a3708b2367c67c41dd5b13226f2d2

SHA1
838d36ff3583abec5cd3eab63a4ddded41a49e9e

SHA256
2ccbea00d1faed9a61db133ad6e31d661bd4accd29cd30b1aaefe2646c57fd85

SHA512
86fdafdedf1bed4d11952e242046d6a5160126fc12465d7fb1b94462ba54793290909433bebf85fb520075b80fa059a34abfb26fd5e2da3358a1c15c36b4f61a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004a

Filesize
187KB

MD5
f67dc85f2d7af8959c497100b4c9c633

SHA1
303d901d3f80202dc56c61599a06cf1f6639dbc2

SHA256
444d4eaeddb1ca33d5cf0dfb5ece372f264fb5089e4d0f2682b33fc4c7e3d71e

SHA512
31631a96ddb087c4bf8d1858bbd1e0a138910466f967544163ecd37925d31c1a20d89f7fd316809d9c84e22ecd39a730c5b3268b78af1ebe840d86c11cb652a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
acfa1750046eab8a39fa4e4f4bf7b2e2

SHA1
d487ecb8bc7350ca1bbabb6c62297ee8bb399957

SHA256
74b59d21ca381898bac49c19b8be9998682c9b3644b99fd7d8ebb56ab80a1bd8

SHA512
2b47587855f23c33b64ffaf7681e84c7fa9ab859293024ae97279f16ef0bd5cd9b7b5d2ea7874e3e2ff4838288deaa87feb437bfc3b26015ff7894597f59aaa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
59b12174fcdfe12f68f176c8172bd6ee

SHA1
469ff5de2b3373bc1415edc16fb83e0898bb700e

SHA256
3102e1673f48912864d5cc4d382659d0d4a049144581e4d3aeeafdeabd821bf9

SHA512
791ad1ee1f977808d2781497844f626225ecbc372629f21b8cc7cff28a34c3e9533c2642e3bd6c8dd08484a1b643ca5606af3650986ac7cce2325aacf2dfac54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2439f714872e52d28b2fb0b89e205e4e

SHA1
36a9921bed030ef4e4acf29aeaab028c36386be6

SHA256
8828d68e1d1e677ea6e56bb8dff6f71b86d943cfb654d8ce8ee675787e4fb7ae

SHA512
117c812f86355b56bd8811bc512b5f4ccbee628b60e8c056c9a961405a9b1e2d23dce51e3a7bf903308f2b77a3c690b50707a81c7a68bf68029b135226215bf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fb760328329eea9d9d2daefa3a210438

SHA1
d425f9ce1c96697991c5fc60524e386879948883

SHA256
22f609ec458d09a6c161a972f0a57f0f1b386ae7c4ab76e6612223da86abf308

SHA512
2d98c6cafa92dc058dadd58814a165d623d40d036d1003d530182afb982e8496575f99bc5377fd43f486932a271f9e5acb12563f37f60ff9e448074d81db6986

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
004ce026e92499b31eb569cc4e6c0401

SHA1
428f880dd8f5f84a7aca84983edf5f327798077e

SHA256
65e9d6d3769ee79ee1ecf2d00db3e0da69b49025af8abc62854f4b7468f72014

SHA512
7a4988ff1211b31d423156a1a41d5a1ca118aee6d6fbb4e57adc50d5e210193f1ca7528f2b1d25b1ad66eb19f4a78362ced115b1e203e03d75f376b600045df5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
60d086a6376e370bc723096a23a89caa

SHA1
d4d01ebdd1d934c6588aeb4f94d2f2ad69cdee79

SHA256
21c9f584c22546d8e3f103a48b9ebe06cc93db841c21af47ac7e3fec86466f4a

SHA512
effa3f3fedc36b6f310b5e724da972e4ab5ddb6bcd837d39652f8fbf1781ab35eca9e11dbf96a1bf9abe9ba92173abedc236aed4fc18e541859ae301f4181bde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
39c7f13e1d8d05469e26e8ab8d910205

SHA1
e24fd3b6314308c6b582f1b33ed876991d77f21c

SHA256
d7a17e86175c849e41af17729f347897cd9e190d17d526ea056127f2b07a901e

SHA512
1db264cab4cb003c081cc0791593460bee471124d4dd28b41e0c886c43f3628d0fd502afdc45e103a3389bd165c8f5a02eb47e52dd224473029810f9c3ce66d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
85f4fbcc05aa4918658fe388554c73c3

SHA1
37f9c803cac6fe880ae73bc43de2aa517a1e10dd

SHA256
598fcd461fe8270e66cc666602d85ac489b0e06ff8646056158945b32c9f9aa0

SHA512
a61a21f69489e23646fb95bf6757094a7efdba794f02697bb93dafb992d6e286d825741e5d27a7c34a5b906a5bd965afec81afa49d16a59685f3254201da775f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e071e763f121aa5bac7ad9ef1d7ead8f

SHA1
0f1feeb101d66ddf80b32030ad49a425f66c5ef9

SHA256
a0a21655b10268cf8e1a757da2094d36c861b0d1e1645e887b7c59a89eed9297

SHA512
b1a5c7f06357057ab98274dc748eefad60ea45b95481c90815ccfa997de7cacaa273f59ed964b25a722a4030677b1aec6af072df636ae7af88f0f79cba704ed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
5b11bc7dbf4de0b6a8a744e6125bfcf2

SHA1
77e0cc43a981cbeacac0dad5e4578959f2072f9a

SHA256
abb5e9d20d814c9c8b97dbbcf82ac9e7f51f84460d3c8a5398a585c4d1a2d41d

SHA512
656da8acb20591a6454d48abb89376d4ae5475717c507755b06c21a66466ac2295ebedc32c6fd54b2ef8051685277234b58cd9f891b73727e73fac6a838c59aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
2c710771319d1f874aa810dce75da549

SHA1
b1265534f2f33979a05d17234e11a71e7c6a2289

SHA256
fcd47cc55d139306c717f903de0eff9971a0aa293fa7d87ef4df0a5415aa44a2

SHA512
5726bc773538fd5f5e2f00ba3f2678672a6f8b84c6b45d5b1d620252234710eea0576ed7c383a12fd341cacd2a9769ab61d521caf737086a4411d21116e400a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
92c09d78de15c1603213606d59f3c2e4

SHA1
73706ed5860eace3efeb50aa762809519e9d9183

SHA256
c3427377977a65d4d1051e63c8780af2def6a5f4417f2ee50c701f3a1dd328b3

SHA512
250c23b878679a5d46b336b524c4d81f05ce95b92b8df05703c5b78097f9323f51d36224a6f9b5807a6de00cae0e8b141b75fb84faf5944124988037ff002c5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
896820902d8bb45b35cae79556303f99

SHA1
7f3b110a808a5098d38fb867e43b8bd610cb0459

SHA256
a5de795c80913123d58d390ae219864eaf1c030f49d07ddbc2231dc3202ad5ab

SHA512
06831bb15770bd33a3845da937397f8d282df5bc680957e3c2a9040480f13b7471ee5b494b1e96b43fd99a90982b9c99d8ef7536c279a1620f533c74bca27b8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584263.TMP

Filesize
203B

MD5
a6bf16da92dc9fdcaa537e2bec1bd857

SHA1
7bd22d0a5ecafe6e0b56653e601b3defbe9a6172

SHA256
a5568291201750f4f4bf1642c8962e5db18d3cccad25eb700b7b58abb6226f73

SHA512
ecaa339566bd9b824af8fae92d04d20810b592b512263ce7396ce9f998c89920a22a8c8e5ec54ca7950b82761591ea0fc268e4f055dff6823a88593ce202aa6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3d9ae64bd709f27eb9fc0694d9cc003c

SHA1
a067780b121a0095e1d1167f279d9cac80c3a630

SHA256
cccc4dbef221e3faa49b0b12f12ecaa797f480decba275e06c3956a25c3ca11c

SHA512
68f53de4d224fe46bc37e557029c344febd149c27dd83a47a148d99452fcf3ce2cf6da375057471de01a8e7c59b70173d48f64372436428f6c668b06f73385bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d67391d7a5074a20fc4f9fdc5f374571

SHA1
2cf0349531c68dc9a130738de3931298ec679c34

SHA256
176036a71a726314a5f0b7698a6be44fca992b2cf727934c01b123035c74a243

SHA512
dc713977fac1b9f6f59df5cf795e7891968e890c08b74736cf31952ed29aff09b5530299a1ccc295d9e0b4fc84fbad42e046398c241dcc7105ad38d3d4d993d7

Download Submit
C:\Users\Admin\Downloads\fa-brands-400.woff2

Filesize
62KB

MD5
3443cc888af3c04b49389a466cf74f0f

SHA1
59f6a375dfa2f0669704fa8fef86b22aaf9701a0

SHA256
a0923a4c80c1a64629cd6da1298fa57714919564d09aaf25b2c657d0e358368f

SHA512
b3ad0da6c5c6ededde96dcdf75f90e225a172c9fc17e386ec5ea50fb78e3c67e299f6fadb53c6591f3b9a811f57a957228d2f7e10451b4c9d2ae84a0bf6edff2

Download Submit