hxxps://mdhltd-my[.]sharepoint[.]com/[:]f[:]/p/ssoden/ErmvvqLLnehKkwBH2C0BtsIBFIQwchEVKyjaHlu_BQHjQw?e=WexQUB

Analysis

max time kernel
53s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mdhltd-my.sharepoint.com/:f:/p/ssoden/ErmvvqLLnehKkwBH2C0BtsIBFIQwchEVKyjaHlu_BQHjQw?e=WexQUB

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
408	msedge.exe
408	msedge.exe
5004	identity_helper.exe
5004	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 4824	408	msedge.exe	83
PID 408 wrote to memory of 4824	408	msedge.exe	83
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 2208	408	msedge.exe	84
PID 408 wrote to memory of 4916	408	msedge.exe	85
PID 408 wrote to memory of 4916	408	msedge.exe	85
PID 408 wrote to memory of 4168	408	msedge.exe	86
PID 408 wrote to memory of 4168	408	msedge.exe	86
PID 408 wrote to memory of 4168	408	msedge.exe	86
PID 408 wrote to memory of 4168	408	msedge.exe	86
PID 408 wrote to memory of 4168	408	msedge.exe	86
PID 408 wrote to memory of 4168	408	msedge.exe	86
PID 408 wrote to memory of 4168	408	msedge.exe	86
PID 408 wrote to memory of 4168	408	msedge.exe	86
PID 408 wrote to memory of 4168	408	msedge.exe	86
PID 408 wrote to memory of 4168	408	msedge.exe	86
PID 408 wrote to memory of 4168	408	msedge.exe	86
PID 408 wrote to memory of 4168	408	msedge.exe	86
PID 408 wrote to memory of 4168	408	msedge.exe	86
PID 408 wrote to memory of 4168	408	msedge.exe	86
PID 408 wrote to memory of 4168	408	msedge.exe	86
PID 408 wrote to memory of 4168	408	msedge.exe	86
PID 408 wrote to memory of 4168	408	msedge.exe	86
PID 408 wrote to memory of 4168	408	msedge.exe	86
PID 408 wrote to memory of 4168	408	msedge.exe	86
PID 408 wrote to memory of 4168	408	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mdhltd-my.sharepoint.com/:f:/p/ssoden/ErmvvqLLnehKkwBH2C0BtsIBFIQwchEVKyjaHlu_BQHjQw?e=WexQUB
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a02a46f8,0x7ff9a02a4708,0x7ff9a02a4718
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8316039947900204605,7785816572435718277,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,8316039947900204605,7785816572435718277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,8316039947900204605,7785816572435718277,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8316039947900204605,7785816572435718277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8316039947900204605,7785816572435718277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8316039947900204605,7785816572435718277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8316039947900204605,7785816572435718277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8316039947900204605,7785816572435718277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8316039947900204605,7785816572435718277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8316039947900204605,7785816572435718277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8316039947900204605,7785816572435718277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8316039947900204605,7785816572435718277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
38KB

MD5
492cb02957326e2818ed96699b899626

SHA1
1037efe8d29183e92262be13dd6d3923495202f2

SHA256
b808634d585b148a964065345b382dbfe1e713bec430b208532221d8556073ec

SHA512
82582d0f377037588d5a31b8254013e116bdb5adc7b8ab38da2f929ea87a03636f791a40964006016545405b3a749ee5437665b7bf8748d469ecaef39b450b4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
dbce88b937ef893011e3cbb273cfe2a7

SHA1
d5b86e17651590246a72627086943019ae3f34f1

SHA256
a0d8962d3209e17ce0d5cae4ac4a6f84536ff7fa0a30b0886f8e1e487326fb0d

SHA512
e4e3076b24a84341529f8c2eabe6cdae458b230531a5bf5e59ac7620726535a05128dd8627c1fc8a3728338c2b771605186862cd7529ac997602fd9400dd1fc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ba78148a75daa95b52a68a1efede99fd

SHA1
7391d2af99308fc4db479897b477fdb9fa89e126

SHA256
c7594e9d90063d6d69ddb22e9de03a19fb74113abacdad9ddbec4e57a7d00825

SHA512
343dcc4daa448d64c5a04dea575ae96f2ac41605684599bbaae3334e67ffbcf3b1e13ac33855c21011609c56590aa140ba7e05f800ff33d5b00bbbf6c3556c0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
48705d643b3310cb62ed2fb2f6bf5016

SHA1
8ddd574e5c62f0295422d7855d80097f82255a3f

SHA256
67d7ec40d0b46d952a98f1d99a4e9b1f994975edde9b80ae1fccbe1142585f39

SHA512
172062509722bdeb17a0bc33e3b7ec1fb1d0a77d59464c6539f5677feffbb4a5cdb768d8e916ced42b490b2b2b95d9431f7db774492dc2b102efae9cfd0508ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\6cc781ba8ef885dc96560cfa87675ab771573f04\462c8d14-abaf-4aa9-98a6-d6dda7025b81\index-dir\the-real-index

Filesize
768B

MD5
ece346f009699b12c8e19446228cf41b

SHA1
de00fd772d49566ec84eb985d93c2a61ae01bcee

SHA256
e0bfc9a85e37cbadf7d68a8dd04d7f6c884fd9d847102bcccbdd2c97e5a869f2

SHA512
2afae8eb7158548acd498c195bb3d57769127ea0cd57290e6c32d64467fdcd79add79b7776b3ae9458c3b5615d7fc10034cf8c36b4ac5db05e3edaeecd7f6907

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\6cc781ba8ef885dc96560cfa87675ab771573f04\462c8d14-abaf-4aa9-98a6-d6dda7025b81\index-dir\the-real-index~RFe5825f2.TMP

Filesize
48B

MD5
4ddd57dab23930e9fb428fa1f8750886

SHA1
7168b6ffd75d04ec41d86b47f16b709d9b7ab490

SHA256
acd57105d42df0ae5f0af0b604ccd562e834abab4c271feeb76bb37a9112bf64

SHA512
ca3ce260752a841a4fda48369dfddd7f1646075da3052ce3e166b259bb734bf3eb2f8950a25203a9179888921b7f68446c49c619793087c954e7b6520d6adc06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\6cc781ba8ef885dc96560cfa87675ab771573f04\47fe95d0-a554-4610-bcd5-fe153ec4fec6\index-dir\the-real-index

Filesize
17KB

MD5
b98bec584f48f61bdeff248e56c57ffb

SHA1
5ed85e54d0e4156335e7ec5c2a63bab5eba9a3e3

SHA256
c480b5e81a1ab2d05c5d879b0a773908a3049a7d1e3377e1e3d09b7430bd31af

SHA512
a17f22b3f84886cd99ff4a05607ab3c9bbe5f02d136ba338ec6356770d3965630ee753af5b7c51aa4f03de2e4349699ab2bf478e8342f04beebb6bd54b7f8ccb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\6cc781ba8ef885dc96560cfa87675ab771573f04\47fe95d0-a554-4610-bcd5-fe153ec4fec6\index-dir\the-real-index~RFe582575.TMP

Filesize
48B

MD5
aafa9ddb5c6c32301c5d8582c4f34b6a

SHA1
a7a6e9e51936284c389dd342639db7a9e03292e5

SHA256
e26d075397a4c25dfb1708d44c23857203c0bdd0405dc26de3277aebac01262a

SHA512
762710d095b0c2865bdd66d4a88e03d92a93c1341746c9db2ca6a09d9abf608b937ab791358e0024e998b2fbb7983ec493a748314b33a3981c21b34ca5c06939

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\6cc781ba8ef885dc96560cfa87675ab771573f04\47fe95d0-a554-4610-bcd5-fe153ec4fec6\todelete_7a48c130a6a40c0e_0_2

Filesize
142KB

MD5
c16eed4460e693d91a4ee6b9994a547f

SHA1
6ac88590851ec168a9fdc2396dedd67f38dd207d

SHA256
011e433dbe3fc4b2ed3ce8a42c55428cd0e145452cb8b02b06ebe427a90127c5

SHA512
1b8a874ea5d3e720183d9a7da6e8542714e140d84c5f4608bce164430789f06dd6afa413e256755b765afec02acfa14cec4bd79880649104b7f50749ceb66c19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\6cc781ba8ef885dc96560cfa87675ab771573f04\47fe95d0-a554-4610-bcd5-fe153ec4fec6\todelete_7a48c130a6a40c0e_1_2

Filesize
288KB

MD5
87c2817f6c6d1acf5fb0d2b99c1fe970

SHA1
5052c5b09410276cac36f9f88488a05eb087eb2d

SHA256
11301b640915d8e2ef7f2bfcf45124881315596b598749466862027568db6f76

SHA512
ff8e6a15369e9129ba52c06928295ebcbefd8d6441e037206b4214787c7a86e70dbe0107a342469fe8ad10c160dac1acaa86d43ca85824565f4ecb66d89e3664

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\6cc781ba8ef885dc96560cfa87675ab771573f04\index.txt

Filesize
176B

MD5
34ae9b94af1528ab668c35b10d00cfc8

SHA1
a254403c81f5447c7aedba58a447ec075a792057

SHA256
430bc075c0c62d4c544e9dae2f6cb975c1de6982d25148f08dd9354a86f01189

SHA512
0fea9940059bf7ee5f089c803194127d508e148223c2046a882a34d563f9a63d1fd8827c225e2049bd28732d1c7717297748824f83605dba7e7fbf980c4bb084

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\6cc781ba8ef885dc96560cfa87675ab771573f04\index.txt

Filesize
172B

MD5
86efe8448d89fdc9d7844d81f44b63c0

SHA1
b2685afcc2b0a7f0ec9900e914ff4846caf80c5b

SHA256
899c459789df9587610d0f6d4f5a086f566936fa314a32fa31eb6d12bbc505f5

SHA512
e893184ef6055156c9d789cdb5448c107b6ec866e8216b06e608d93d4ab3ad79f99383a2f59eea5e77ae1b905b55726c84ff2567ac33560dc76d34b195217d80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\6cc781ba8ef885dc96560cfa87675ab771573f04\index.txt~RFe57d2e0.TMP

Filesize
105B

MD5
296cba9918ea16b138d65cecb50fb32b

SHA1
2c484f056fd4e43539b7b724ec670b46d7584db9

SHA256
2ed735f95d14df9f991e40c00b1e34306b84ea9fd580f58ca69ff527f4a904d9

SHA512
89c5f84940113995f3ce419fcd5a16e0cb578190b557ea330857752e62e6169a7c746a819869b8c8eae923cb7c5c57b5152365435afb22c91070440ce55bb87c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
779ab6a5873f7acf8d020957b8f9f262

SHA1
216fde0eb39234c16ddee28279b5359a6aaa7e7a

SHA256
e9ac1fa7fb3efe43654d9920fec6aee1fde6b24b53ca457eb158770873f0179d

SHA512
ebd3a05883c102c92a9b09dd635071f4cfe4b3137051a7584dbcd61367cde9e56bd9b4aa10cfacd8e59e053c8a4952265daaeb1905afa4f39a5e646fb2eae7bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57e05d.TMP

Filesize
48B

MD5
16566cecd5ccbde36972617e09d69829

SHA1
19a6114c7b9ffec8ff8482b3d8d18c3ac280d964

SHA256
b95b964275d5b9c8ed41cd2ef0b102c57848a0848028d9ccc7e57613da609ab4

SHA512
d5f817c95e8b20641781815e822e8c7c9a9cd21956be982b02079194e5f2c853345a35aa043c9aa736b457e4ac42ed59ba723bb7dc466b1f465430e90d9f4322

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
51f826a6659dd2b9cfa3ff6b9fe076fd

SHA1
10980c5e98edf5f7b1c44d82bc0783b88127a8d9

SHA256
64c401291cd3ced51ad55cdf1811c607cb5066c2338267bc7eb2dbc067fb9a04

SHA512
db9afe7668746a8a6083fc2a88deeff388586a0d743ddb81dc00c2f0ee375ed4ee6430cea71a4209e0cc7d9b3c0ec4f6b6594a1b7c2ac7f5cdba950a84cc8136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1b592e1c880c3bede0be51c34f2080fd

SHA1
b48a35fa02145575848355e59c998340165e5470

SHA256
41cfe8cd74610837fd06ed74ece3cdea38cd6beb102048a47fdbd29e427a786d

SHA512
77b4207cbd31f67059eab32adbc1d662ed36c76fdc94d64866ac26a8a4792ba567b9896728baf5b91b7ef050b5905ba8d0a4b2a199bc5c471c51cb416151069c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d6d8.TMP

Filesize
1KB

MD5
a406a46c46b24bbaa2dcd3734925a166

SHA1
79419c1965a04613d714a152c4a6dc365a8d1638

SHA256
b2d924ff4fee5d720cfe60a8049eb4f45e7dd4f6eccbb84faf42b5ebc6100cfd

SHA512
002e2738c18fe49cc2e3748c1f6f07a92006478fba76747884f660cf670ab73d7c36bb86c6d54e68673eb7d9a40e6f05f39299393d01f48c6426fbf5c01ecc9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
444370f8112aa68ff1c8160ca482eefd

SHA1
1d8c656061eebf839559f33c328e96594c6a68ad

SHA256
9b9ed1503a889c6d95c35b9983b5cd16904430cf340ad7ed05b9caaf65d25580

SHA512
39a57f1deda260ebe65e46ec16e6a3ae69083c27b0b8e8324abbbeaf184195b09703149d357b0be11f881c64bc845a3757e7e9fe0841e4a29af67f33e0e600ce

Download Submit