hxxps://www[.]mediafire[.]com/file/y0o5ceezn0m6gm4/Touhou+PC98+Collection[.]zip/file

Resubmissions

06/09/2024, 16:53

240906-vd2txsxhna 3

06/09/2024, 16:45

240906-t9hkgsxbmp 3

Analysis

max time kernel
449s
max time network
422s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/y0o5ceezn0m6gm4/Touhou+PC98+Collection.zip/file

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
972	msedge.exe
972	msedge.exe
5368	identity_helper.exe
5368	identity_helper.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe
5800	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 2040	972	msedge.exe	83
PID 972 wrote to memory of 2040	972	msedge.exe	83
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4904	972	msedge.exe	84
PID 972 wrote to memory of 4360	972	msedge.exe	85
PID 972 wrote to memory of 4360	972	msedge.exe	85
PID 972 wrote to memory of 3016	972	msedge.exe	86
PID 972 wrote to memory of 3016	972	msedge.exe	86
PID 972 wrote to memory of 3016	972	msedge.exe	86
PID 972 wrote to memory of 3016	972	msedge.exe	86
PID 972 wrote to memory of 3016	972	msedge.exe	86
PID 972 wrote to memory of 3016	972	msedge.exe	86
PID 972 wrote to memory of 3016	972	msedge.exe	86
PID 972 wrote to memory of 3016	972	msedge.exe	86
PID 972 wrote to memory of 3016	972	msedge.exe	86
PID 972 wrote to memory of 3016	972	msedge.exe	86
PID 972 wrote to memory of 3016	972	msedge.exe	86
PID 972 wrote to memory of 3016	972	msedge.exe	86
PID 972 wrote to memory of 3016	972	msedge.exe	86
PID 972 wrote to memory of 3016	972	msedge.exe	86
PID 972 wrote to memory of 3016	972	msedge.exe	86
PID 972 wrote to memory of 3016	972	msedge.exe	86
PID 972 wrote to memory of 3016	972	msedge.exe	86
PID 972 wrote to memory of 3016	972	msedge.exe	86
PID 972 wrote to memory of 3016	972	msedge.exe	86
PID 972 wrote to memory of 3016	972	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/y0o5ceezn0m6gm4/Touhou+PC98+Collection.zip/file
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd83a46f8,0x7ffcd83a4708,0x7ffcd83a4718
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7080 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7808 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7824 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8236 /prefetch:8
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8044 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7436 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9036 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,5140414251543441971,14195087611376903037,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=8936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
62KB

MD5
6b04ab52540bdc8a646d6e42255a6c4b

SHA1
4cdfc59b5b62dafa3b20d23a165716b5218aa646

SHA256
33353d2328ea91f6abf5fb5c5f3899853dcc724a993b9086cab92d880da99f4d

SHA512
4f3b417c77c65936486388b618a7c047c84fb2e2dd8a470f7fe4ffec1ad6699d02fa9c1bbd551414eef0f2e6747a9ee59ca87198b20f9f4a9a01394ae69fa730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
20KB

MD5
8108e5126bb1b9aaa660a7e5257e914a

SHA1
bb5749f62f3005fb718f7c1105a747343a47b78f

SHA256
e4c1b8044c9ac5c2de3c108408d50e218a4a7a649e1f28ab172fc70953fe8108

SHA512
c8ff92765d692ebe176676fb4a7dcecd29963d4770096270b7fd6820b91bd5b8b5e61a643c7fcb045b80b036b2e1d69d9929876a42e2d9b1669a7376384613be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
31KB

MD5
c03ff64e7985603de96e7f84ec7dd438

SHA1
dfc067c6cb07b81281561fdfe995aca09c18d0e9

SHA256
0db8e9f0a185bd5dd2ec4259db0a0e89363afa953069f5238a0537671de6f526

SHA512
bb0fd94c5a8944a99f792f336bb8a840f23f6f0f1cb9661b156511a9984f0bb6c96baf05b7c1cf0efb83f43a224ecea52740432e3cfc85e0799428765eefb692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
18KB

MD5
54634884a74ee7e8e29c70fd792dc594

SHA1
fd58ff24d33de21640dad20f428e916383c614bf

SHA256
2baf2f6645c28551f5e6fcf13a9bf75ce44c5cbd250ee538631f6becadfdc767

SHA512
14966b2328978e0bd2801ac1b5e6c9a62a5004b1feb89591196fba9c926d8a4aee9d39a2d46c3d1434340d603b60e39fd785855eb94694a67d4f711cba3b360a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
20KB

MD5
e9e58e168c0232394ce8cd2d0a18944a

SHA1
9b27cccbb34b3b837fb52f355f1a2b823fb975f9

SHA256
2c09714f6c24f22eebead7e80a08684778895f7b6c21ce6cdd00fd220aa4fbe0

SHA512
d9ef910c9df9e70b02220d67cb24e501d7068968cb27f76f982ed26e5649426d89559f3f19ab01f445cb2c2ed3cfb3d6aa2e6d06af9c5fae9dc920d74d8b5221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
20KB

MD5
539809cbc6f6c4e0fd229994e35f95ed

SHA1
da4011130179ec3274843aa17f6742b028123f3f

SHA256
ce15083cc0d3b10bb9940534312e6500c63a62fdc847ca65bad851d58047ba67

SHA512
d907234418ce3796b7525d883bf36fe1cbc901b21b13cae4cae4c9bb70f612018567d100e3cc61eda3814e49ad336a16279c889e29d96b94a11d4733310669a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
18KB

MD5
8eff0b8045fd1959e117f85654ae7770

SHA1
227fee13ceb7c410b5c0bb8000258b6643cb6255

SHA256
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

SHA512
2e4fb65caab06f02e341e9ba4fb217d682338881daba3518a0df8df724e0496e1af613db8e2f65b42b9e82703ba58916b5f5abb68c807c78a88577030a6c2058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4332f7054ce03b7b_0

Filesize
65KB

MD5
f09e7a4c89bd21cef2f8780a7a9d4a2e

SHA1
5a70b7566652285ffa2e2aa1ac9a8f9d3987ee99

SHA256
6a91c2adfcf012ae102d29313f363df1afdd27d56a6b4d2178ca9aa312dcf7c4

SHA512
758c9fd12beb55167c1c189a5a48e32f6260990bfbd3c6ee179450641607aaf2000c2c238d15b165524dd8015fa8fe7701d663f441f702be3bf7c986630e2a3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\481963cd074f1a48_0

Filesize
268B

MD5
42f6ee62e2afaed4591f6ea51aaea1a0

SHA1
c2cd30bdd8e14bfbe23c033fc93c80ae44af1afe

SHA256
0a8a2301e0bc6da43ad8dae36b5964400eafd5bca3706400ebcf5c3bb768c1eb

SHA512
821e234cdb03c22f50e7eae298a0c797e72b6412a09b93cfa38d3a085fb1557fb646551da77f2fa86950b34f6e48757515304af7740e015ee61122c1cbedeab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\51c1a04c9fe3f70d_0

Filesize
158KB

MD5
81bf3752ece6bd119ad418ada701f8a8

SHA1
8af797517349dbb7ebd97fb0ad078a95c46316ec

SHA256
003c2257fec38992cca5a67c5d30b3b9bbcedf8d1fe50a50c63f3368741984af

SHA512
ce545aa5c1ea17f5de7f341c5720e1f6f20b91f02c6b3def6831f17ac5dd0a25a0b7f54480259b6ef34fc36fb6b5ac2802754bbcef694a53b712b8ae1dad3171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\56d6f409590db490_0

Filesize
54KB

MD5
7e3feae678574ef200b5bf3f158b8a5d

SHA1
7dd08b1e7d67a78a5e1ab293040f07d12dfccbc5

SHA256
b4484b3455dc31f53a16b04da619584a17ab9a6894ae3487f71c49920ceee863

SHA512
498faaaa28f83ec30c1b838104fc4896a1026c42d3f356555f8e28515bd43182f76187d5139236f8628a5c826f590e326ada461619dc5faf39d32129c5dd6127

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7a16156044293157_0

Filesize
342KB

MD5
34a0f595a93231c7aba6ef89aaed5c77

SHA1
1ebd7aa35681807f6e611b1fe70162009fe0b566

SHA256
b945f72e66b8646e9b120162c397c98c798de9fbfbde182012844da0e2cb50e6

SHA512
1d1328ea6f46793b4a500b5074a42ba0dfeb31acc8c4afd54b4d60e53a37e7b85663f2dbe0ae0c182f49f069b829cd82138a930406722ff8f5f36211af4c8c4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7a8694aaa036738a_0

Filesize
23KB

MD5
9989c3d064e9845da974a35eb2c2b745

SHA1
3e7e319e1a881d2109c05d8a272fa322c20d94e3

SHA256
57bb5973287ba3dd25161a06f30e58c6fa692a679eaafaa9c93dbad2a35cea0b

SHA512
cd92ed65cb299cf9563ab2b8638bf3593b01b7c274aebde30b89ef4903f1003fe6a59de8c7a231ce0c6ad1120cb2474160dc9c6e0cd6b2e6315c9bb847261cad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7f73e1715dc0c34f_0

Filesize
31KB

MD5
39e26c28f8fc47f257a61a79e3b9f48f

SHA1
272016dc1c4b650ffde6a84806184095449cb1f9

SHA256
bc92d4674831980e64ab231a274ff2984b0093ccbd9bd578f7077ffc7728749a

SHA512
062215f6fa3e5ff0a8f400a20ce8df6133f09d54338873515d28338ff644ba545234a650146f80b40591856bc58beef1c5efce4f5e47cfaed305e261aaf8683a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\927d41540fc818e2_0

Filesize
3KB

MD5
f3b817d3e4d0ded547f6424188747ae0

SHA1
00c6e8188d02a5572a6b2a5529526ada77912419

SHA256
8ea433cb922d05823f1963425bc1e9d216a4391c15c6517af0a6d8df9dfa77f5

SHA512
07207ae659e4741e4afc108ae800c29a26ed572a6f8110a7d05db16122fda5bbc12151622c2208c0492b269c1024545e635f7bc9c38d8cf1f6b3ca7446c6d8b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9afbe0c0c3782daf_0

Filesize
328B

MD5
bb9990c997790ed61e09e579375e952c

SHA1
abfe0ebddec4abe6002d0120a16ebbc930224976

SHA256
b1138573427bc0e2f92cb75da1885d95185de44216ca580854b70c02beb0cec3

SHA512
45525b2fd934c1e11b9b88ea2a141ec407d9ae8da7994aabc7be11d4c27fa16ae2f1a3b33668aa9e2570ea484ba290a18a45ed3c7f6ab630db05cfc902a09aab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9b1af0e1bff2dab6_0

Filesize
3KB

MD5
35e5e6fdfeb551bb58ff00f39799f3b9

SHA1
0b4a3facf5b0b79f4c2231f8f42b4bfdbf671db7

SHA256
6d74d0ea78b4832f558fb219dcc4e35ace0f165617a1e96aa322a94f47b94727

SHA512
4eba470b60d3da510d102ba5bc8fbf8740bdc61d3355679c4fef112b032336d1799048f986031433e9fd60f40cd559f8af627f6933c42666a773b075a387962c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b13d9848aa9ac2f2_0

Filesize
278B

MD5
76a81d07f9477d07b5416a995957bb3e

SHA1
ab784e010be8b75877509b57949e7b122a3751e9

SHA256
2fbcdb3bfbd7ec7075706ea8ea8e4f50b2ac6c1809974083742718b9a908c2d8

SHA512
8d41d95aa8e9d383e80ca9754f00e4e609a7560f89d9229b7583d16184c012469c57cd546e728d8f15c6999e57c6159fc8ff2a0a9999c5a9a9bdf341d98ffd24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c472784dec098560_0

Filesize
14KB

MD5
04f2bed8540b10a7e66ed1e380c41964

SHA1
c5bbdd1f3ccd1c3f51e118305f11944577593c56

SHA256
23197a0b0cd746ed1576e3b1be390d27ce015e7deaadaf4183a3261732e469d2

SHA512
bc8e8375f67ef1aeb48a8c7f0a9ad0b249ba56d8277b4225e833229e6214689e7c55bdcd5bc3e0ecfa44810e2578475548be46cb34fb794639ee6fb0a277f6ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d151e24b571cc8de_0

Filesize
54KB

MD5
67a8aca162250e817c0e4f1d4ad3416d

SHA1
558946aebf2de54859c3787adb80f7c3b9e19f1d

SHA256
f1ed6110effcc78461a03a74bce3634f57f7cb223a0fee7efc90a6da4888bcd3

SHA512
2d2082ef559c2eb9c17c9a3fd6a6986df8d1560caeba99a1627306a2744223bc147464c4337de921fc31afcd13c2bb02e9685a5aa2390cb455ee9980d0a859a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
fbb5cfe07b1a0abde883226686734362

SHA1
1734690db604e738991ad9d98e116c832a20d3e9

SHA256
006c84fbc9a21a17edef92a6f7cea890ef794d344af816d8c9c5c76e47730ea7

SHA512
8a16c8615c4b155c92e7980b0f246201614c3694c7a5395ed033329e5e320b6df327ff196cf1f64b87f6167beed39e828b7760d4fb7cbf79c2444a13e8d77426

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
1377062fe06533469c73e1b0956647ad

SHA1
81ff23f450ebf0bfd95560663dcf9cbfb5532930

SHA256
2a790fca9c181a6c26a23857990f3c34e5e760afaf9c5ca327cc8bd096b581d1

SHA512
22e5c95d7eeb077e16ebe2727645ddab32abede866184e81345f19dd0a60306a70471f938f6294fd902d10b8432fc70974aa0645518b6c52d6dbc6531cc2ae90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
248bcb1d87a964ae5b8434cceb201c14

SHA1
358b8bd9f1c0cdf7d5be38f4d84343f46c4eb7fb

SHA256
5585d600b984a2fb85cf224ec2c30cbffb3ac475bb4fac9ae0f420d94c29c50c

SHA512
d24743d5d9fea2d04df64780111ddfe50fd8865af87bbfe14a137d4537eae575d3a48e26293eae44db45107b803d6e35fa6b55514a0c8fbc809a717893df2ef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
75075e6d19544b2dd51336fa2089ef58

SHA1
26a274aed37dd19a629a811824347affe8718d11

SHA256
3afdc96b1b9404339c84c1ed49abcf258712ed15949422d572d592690078ba15

SHA512
5a9a07ca97af6b9ba3e28518b6b106f65227fa1a42f8f3ac44080e2349f5b4fba9228390ac8828c771fd17e7cfa7485b4b0ef7409eb8de34b840e79d51d7fed4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
7df3a0d6b3e025ea71c39609aa449d3d

SHA1
4ccc2415619e2b4357db1c0dee1e1f5b2a5bc0c6

SHA256
b168a44d56b11c926d11b80859b21720f2e3e7290a448e5ef96b6d984f964fab

SHA512
6543d12a763e1855b37f3ed7028be29b5f0cd5654204440a81d8fa36d97973f64ef58a5ffe30af30add3fdff2d59779c090c08b888576df78a831bf80b6b1543

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f3a6552ec342e1c8642657786156beb8

SHA1
270bc911861d4f834b778782d273067b81762564

SHA256
f94dde1cc0a708c8ba5e5bbbcc266edbb83eec265eac60b58239cb09b2189c63

SHA512
caf95ef0ceb024d4990becca44065a2674dd622e9a0f35a1a44124e1c3700550861150f6d040f3a3d96076c6ee2aa5dd041888268870e24912ba201ed021fbea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
838cf0dd9fc3c7f8d4cb5145c256cca1

SHA1
ea785c4ca627f4d691e2d22cf2ce2f2f5fb878b5

SHA256
2e5356eafb61d585010e1cdda0d55f79b54798fd84d6586d98592d0ffbf13a28

SHA512
31f6bc09f7a4fac1c93251141f1eb4b719f7406d293c797369da0e0f01b35af22781d1347b0a2945f5a79c2d26a14c28530f886f82d6de5af4bc99c994d192af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ee765d8e7a9877695496c322b3e4d971

SHA1
a15eb14f65e61780c6a9ad537f5186c24a656b0a

SHA256
f6801b3ea89573ce651f099d5156290b2900705b7aebca59aaedf3a35ddba859

SHA512
b43589b6893840dd043d49a022d88fc766d6b969f8e901a7aa3733fad36b8d2f37d251d6b2eac335d3954e2eb703c9d8b6d32ca454bd8a54538c037a1e6b9820

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
9c51cc4f13b1e995ae1df8e6921bffd0

SHA1
3e4c31bdbe40bdd41424d2c6b665161fde649253

SHA256
05d5ed016dd49431e231ea68527f9b607070fb4bd931bd2a04cb0c7c58c31a6b

SHA512
94b65943e6ef0c6d167504feb3ff259746759408e35df6b24533938f89072bb1ff5bebd4765e29ee8259b9b0ae458d6ec978233ee89c1dbf6735673cfb71c17a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f2d07a8effcd7430d005919259c87c90

SHA1
b9466d0314ef91567574e0aef1622109bbb7c81f

SHA256
895a6e778c3258f804e55f8f332615aa6293d6d9355088a114d218619a3a6afa

SHA512
09cfd8f39afe0556c3ea108611c053503cf42869fe7e7c7095c1deb38d3dc78cdeb98cf82ca3916883be4d34115aa0f8b399f1c24965e14ab470c74b40b5e06e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
a5f89ac6055f201f09745386f4615bc9

SHA1
1b4334126576d7c3b70e175143a4e41de02b8226

SHA256
1df2d046339af7ffb88254d6a0e4d63a6e3eefe91fa946da266450d3b55fdb85

SHA512
82c8890415cca7bc859da6d6414d28bdbc956043f131e0a53beafe7b4b7afa4c3258a44166b9c9daa4ac1a4302e1679feee79d255e89f4132524167253354124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
fabec3d046e3d2e21ebc1a3043080790

SHA1
8535c1c8b0ed45092e98cac4af5b8c051de0ae01

SHA256
4485a1451ebb37bec2bd23190c3c240823f7a8fbab5d3c8dfce9d8b9528c4dbb

SHA512
d34afde2a0da2fcd1d7ca993d54d2355f6a118f717f26809a5bffaabea5b1ac33ed541d93ddeec04f86ac5cede3146c7a6d7d3c217752f85dc917f454c496ce6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
b91b1d37e127af5065e902cb0b18da81

SHA1
8edb78d32694518640c33bc78123137ace75f509

SHA256
e8c9d44a62079ceb8a761a4899f971fc39961a076d15396672f55931a8fa38ab

SHA512
db4f55843519575d27bf3125242426fdae194ee04c68f3962e1b9029b84075edb58a41388c3d7ca1776aa45f8e58ab00fbe077dcf32e1041f2a7d974feadbb0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
2f0477334dc29a95593f67e4aeea8d81

SHA1
643fde56ac1a52e90b8d1144fe7ce519e64917b9

SHA256
09e47e32be11ca52f412d8561b4df849fa6e2dbb2821d1093aedea7ad7e258db

SHA512
1dd20359f0fa5b14dc8e4046ce2ad8cd628e9a74e5025fc9d3b16171858f083fbcb417d9be45e616da75750350207a0a17762e03eb7417e0203ede18d6001eb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
2ae71e121c2370ae7453eb8c25268407

SHA1
72ed3debc5a3fa06576916757505ecac1623d992

SHA256
77e123a8788c8d92ee0e6d32314f7f312029a057d8680bcf57f2a621222e62a2

SHA512
e7f390684e3dc541ada57f1d7727411edeef2f8c37926a48116d1bec5802915d4fdf9316bed7e64de2838332ca64cad5c745ca8835068838929bc79f33b677e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5d083d8158aa13921518c093a9908bf9

SHA1
72214096d4ee7d15f74d99dc46765d52411d116a

SHA256
9ac9533dd6f4869cd974e25fa4236d5846e742721e81d3826799a15ff24a231a

SHA512
b836a7e132c351890130c98ac6b670cfbd38f849a5e23d01f7656880a2a25f65176de5796f823b2c991a520b2601a618ce729125cfc32cbbd7aa26a0891f1f85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
fab179be9b55bfe27c43bcc223b5f3d9

SHA1
e4680c62c35c943958f7377af1be9c3c3e5b8b55

SHA256
9ef32384819745866c429a2947350a6d0f01d6b7b86696267ec3846973a66466

SHA512
488cc0eae1a324ea3c75204a47f1040ad899fbae09df465f1706d2678862f467a04d1ceeffa3dabbe2dc117f682d7fc7edc40f646d5dec0fb34b8ca3bf1541ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
7dbc1484915442834ae7e465cfcd57f0

SHA1
119ec6bd08b409b4cd8fc2b6272304ecbb66b827

SHA256
f9ca3e8a382d4fb79c502ae32283d0450f566f5feb4e815750e60a395608e468

SHA512
ec3bb4ab2ec622da14741acd24ccaa91dc2aaaf033fc3e93b34bd63bcfda4ebdd7dc7ca07430f90d034d49d6f4fcfc41d9ef83dc9f8c44d45719dee2c7ddf451

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
d3db4173c3990a50031302b302d72452

SHA1
0a5b10e55bdd6390bb59829007059c821e06c228

SHA256
05dc0d658db32202aa21ea402bcc416d2552337d710c2f93f12b15b07294ae13

SHA512
665f9978a4c822be6317c270fd15044f4d2a9eb1ea2a3d192ee9f23b9ae6bcd1b5475fbd502798985e08bf9c3d19ca4d9cebdb0402aa925144d80aa8a4d62928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
09ba911921d64b86eaafd888a983a751

SHA1
97648824ff2abf4a199ccd3913b238323db01e21

SHA256
b81bb2e136f692601ecef53d4ed27b4411a6c0d4b38da1d205d1bdffc5592907

SHA512
4eef073f342eb0adf00dca0b59ec620f1f610479b4bd131484c64a113f2f4ab9ce1081f2a0687632f136d6ab58a140d48fe31cc909bef42290c722065109971a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
bf1c826de3fa18a48bf7eab014702dbc

SHA1
ee8e702650902009e0fc7c4e9d0d09a5500b8178

SHA256
19279ab59b982b84141c75a95cb59e9927f6042ac62fe14cd5488c71cbd25971

SHA512
ed953f7b41cdd113fc3812d91339fadc97dedc67aae17e7f284040216ec203de456361c397dea0fbd012e5966de5e28419849f42f761b1a14c56562b43a7bbb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
acdca87998f6c594e7f957fc300378fb

SHA1
c7615162ce6d5093b3f483273c02b712fc53c12c

SHA256
b4c63438c6051878cdf9d8674f9d5bff631e0aaa6df4a9e0539f5e4565b830ae

SHA512
a20b62e79e35a280cf275e342e0793cb7814e474ccd4a80c4a49403052e37f25c99fa1d3db44e72afa6e299ef9e1fa4704a225b282949a05cd6952d8db1d585a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
bab01ef7d80ec81ed943c9f62af99ac7

SHA1
47c8441955408740345de5b5d12095c9e0e7c452

SHA256
47d157acd0c7be0062976e7bed909e5500c54ddd4e240b01e76236934c1cdef4

SHA512
27c8198bfd272cf05ed5d3f25937b7b260865fd50122d1593701d956993860ad724634b3d23c16cbc0738aaacfa87368a7587a5b932baae105b4186a1051458e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
39acb3241347a217fe61126dba7d3acc

SHA1
17ac2babc34a5a70098fd51792aa1c310a2c4271

SHA256
6ee5f7b3d631434cf344717d805e07c9ef3c7dc2d4d5e2a5c72fb99b1e65845d

SHA512
77357f1285df45b86065e3a9a53fca05c3840c9cf9d33ce0de9401a344863d91c68a21a196a172430865d4a0d9a335c638c93aa1790a4098ee94d17e37b23697

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
bcfa704322956393bb5144c1448ea788

SHA1
4e3fe5d02d05bde0385a2a418eeddbca79e34b41

SHA256
75e2f55f792831acdc75cbc506532064fc4836fea9319005c3dbe13f8989100c

SHA512
b0c894433f48c1108f366e258096d32a97f2aaeef4dac4b2b4e07486bbc771b44784670baa25ed7834db6c5825561bf0f575ab79afa34edf619965a84f67f4a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
8e2c71c9adc335e10786ab7155cbcdb9

SHA1
b42b2b162e5e70101edd749eaeb3b9091ce78231

SHA256
030432eb242ffce053a71a40153f0ea3bafa24db59839b0a13a6f5fc63f5a0f1

SHA512
b1be7342fec75f78c0be6b8861fe44d934a4a6a3d93b91d2542d78b695ee6b878aa05b144e863bb578ab6cc8e5bcf0dbd5adc9a5441f2d1b71de175a6b81976c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
e651a0cfe94a77b4553e89c1e7c44127

SHA1
5264b8bab85b2a32b20e6b7f2fdaf47db34d65d6

SHA256
0fb4180a856d512a1d60171775bb993567ebaf7bd547265eae2c1ddb9bdd7c70

SHA512
e49fcda5bdb6c9f9c09f4d81458110a9f5c2b3397a619ad037d1611f91c43939bdaeb18fa16bf67059bcd6b7df8ca50106f998f13a9d711c21db6921b3783114

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
8a4c398133905cfbde8ffbf2a989d8c4

SHA1
6d7b0eed21f9ff21d93d6e44d0e914a292b55aae

SHA256
95da26ee3c85851ec760ccd1a88ec1ee795058eea175b2b03fc6bf2c4c841285

SHA512
7ddb471a6733737c295b95d872ded88f00e18c699490e7779e044407290f5144aec768e2c384e6deae497ccb9bfba9c6792099011df9fdd8e22ea16e41d11f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
f2918ce270225a90128ac8cc2c94a3d3

SHA1
4f3cb11ef7378c478caddce5970c322abb8843bb

SHA256
d159e00bba03f738733240ace1c3e04e023ebd20ada6057968471cf6fc48567e

SHA512
e69d02592fda56d25a9b58d1c653d242967cf0a9ed16696664aa8ab33fab69b81ce8294a1644107f5994ba5672c3fbdb03df4c956ae039f0fca70a0873a06e1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
990073b81f2fe3cdd3a5738674a6f88b

SHA1
b3ab0a9bb22bcbe8287315a72371826b68400b78

SHA256
e90ab7cf63cd2594a2da91a7faaba93d6c476670c7e24885d12ad8f3e0ed6bda

SHA512
d036f483044b450cc83645a843b24e225b62c2614122873d42d630fad36b131077d5c84e1169e36fc9535dc6de5907214f8288230c7fc7301fc01e640f5c5ed4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
863c8d6b062357ff6e5f23938e98a163

SHA1
acf4e95bc2dd4d49750dfe2cb8448b5bae5a210c

SHA256
f02a4069e66c41da47c35c65d30b0fb163204513ad1037fc1052fa4b934a1c58

SHA512
1ae2fdb9e4cd7f0f42f1554c8bf4b67dc2249571841f15b7514903b01f8936e4946690b59bf752ea6556a3f28ff13ff440f93f2b2fa1b8b00b4f89a76ef04523

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
e06e26994ace4d1c3566f726d3c7ee47

SHA1
39c9afcbba3147b37e060bd806da3052fad8e210

SHA256
e42d5ee19dfb177d267458540a271a92c0a9cdfd5459816d5ace00d59bbf8413

SHA512
b517836570e40e250eeef977cf06ce66c1d0c8367169fc6a8b3f0dbf0d550d784791f7d9bb767a50dd08ebebb51d281e4552a164d5fc55cee5c8df51bff1826c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
4631b85d4ca662a54c3d8018fe14d94a

SHA1
7c0c4bae951ea2ca045b82de57816a9694860612

SHA256
ebdf9a552ee961cc1c9d76414199a7d29d7b4118efb252500a708a08d40f76b6

SHA512
62f70d72a553cbda0d7c65e87c1b730cab9e34a1a29d42bbeb37cecfadc69e9c7566bb4efe039c1f5a31bb64daadcf25c58358de6c89670acdcf86de50159eb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e8ca.TMP

Filesize
1KB

MD5
c499562515fe089e4900306fbc3ed9e1

SHA1
d5f3a06f04ac126eba9dafef6179f2a0dac33774

SHA256
d3637eb9a7030433a910492c10c8cf12519ec4a1d64fe4aad388e8890e5031d7

SHA512
9337360ae5f39cb38687a984cd44216fa2b6ca2eac1526b2a5f5d4011f39f332d9cb0f7f4294a9d6040aab09e9c97e05bb99838c678b4694adc3b51d20c15ae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000006

Filesize
17KB

MD5
aab2532f8363e63359dbf0c31981f57f

SHA1
a21523eb85636a0455977ffe525260a1a8568043

SHA256
a6abef5f074c67b1f9fbee679151a4c705b71f054c98f720dfabdc65786d5d13

SHA512
7b3c4ce6574b36bf0d4e05bba1063798b525744fdb37b28ad6fc78456ef7d704677795ae4dd0d0eda0954d15b3776395fa931abf82dd4b64583c360dd9916f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
acb7d07625bb640fdaa035395f996b97

SHA1
a9021e3f6456a8824a0e0db36256b69b3abe1e52

SHA256
d39aa0f58c988da296411e2d1d7803f55e0883d37dd89699ff5bb3b651d8aebd

SHA512
6cde18ee6e2654b67b9a27a7f22fd87e80f0bb05a79422ee3b1f8678d0d07df9843d5508a26ada0ad494ad07a36ab6e2054ed77626994f6dcb0eeec41dc31369

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ee33f493829a76361c3f9e5a6f48a668

SHA1
2a9c090d67d5c2809018bdd1d20afc17b1cdd19b

SHA256
9b1278b3bb59485619f08933c2668736f88565fca85d7bba2db17620b0eff4e1

SHA512
de3ddca212dbbb11e5ec7c70c58799aa0ff5f776df15186199800f487f2e6b0e13aad8352455743b09a38edf23d0aec3ac3ac4efe82878fba066b791648f7f80

Download Submit
C:\Users\Admin\Downloads\f3447a0d-21e5-49e9-ae77-963d83d5dc90.tmp

Filesize
32KB

MD5
be318797a23763a2307c5c5e7dc2837a

SHA1
07a1f17d9897eb13ac47c4c53eedf5ee38c3167e

SHA256
ab6c6f3e6cae7aa1f6edeef4d4cd0b8a9fd64fedc8ae05b5242122b12c6d2f45

SHA512
819c119dda07057ee5d440cfc930cb867775a69a3e8edf37797582897a8aa86555b1d04bfe56a3ef27e70f01a5480006669300569e7128c6ab4fd16a89a59566

Download Submit