hxxps://en[.]y2mate[.]is/x18/

Analysis

max time kernel
136s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://en.y2mate.is/x18/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3396	msedge.exe
3396	msedge.exe
2652	msedge.exe
2652	msedge.exe
3076	identity_helper.exe
3076	identity_helper.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 4836	2652	msedge.exe	82
PID 2652 wrote to memory of 4836	2652	msedge.exe	82
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 756	2652	msedge.exe	83
PID 2652 wrote to memory of 3396	2652	msedge.exe	84
PID 2652 wrote to memory of 3396	2652	msedge.exe	84
PID 2652 wrote to memory of 1416	2652	msedge.exe	85
PID 2652 wrote to memory of 1416	2652	msedge.exe	85
PID 2652 wrote to memory of 1416	2652	msedge.exe	85
PID 2652 wrote to memory of 1416	2652	msedge.exe	85
PID 2652 wrote to memory of 1416	2652	msedge.exe	85
PID 2652 wrote to memory of 1416	2652	msedge.exe	85
PID 2652 wrote to memory of 1416	2652	msedge.exe	85
PID 2652 wrote to memory of 1416	2652	msedge.exe	85
PID 2652 wrote to memory of 1416	2652	msedge.exe	85
PID 2652 wrote to memory of 1416	2652	msedge.exe	85
PID 2652 wrote to memory of 1416	2652	msedge.exe	85
PID 2652 wrote to memory of 1416	2652	msedge.exe	85
PID 2652 wrote to memory of 1416	2652	msedge.exe	85
PID 2652 wrote to memory of 1416	2652	msedge.exe	85
PID 2652 wrote to memory of 1416	2652	msedge.exe	85
PID 2652 wrote to memory of 1416	2652	msedge.exe	85
PID 2652 wrote to memory of 1416	2652	msedge.exe	85
PID 2652 wrote to memory of 1416	2652	msedge.exe	85
PID 2652 wrote to memory of 1416	2652	msedge.exe	85
PID 2652 wrote to memory of 1416	2652	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://en.y2mate.is/x18/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9931e46f8,0x7ff9931e4708,0x7ff9931e4718
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,16496172618687535458,1213883178326504293,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,16496172618687535458,1213883178326504293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,16496172618687535458,1213883178326504293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16496172618687535458,1213883178326504293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16496172618687535458,1213883178326504293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,16496172618687535458,1213883178326504293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,16496172618687535458,1213883178326504293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16496172618687535458,1213883178326504293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16496172618687535458,1213883178326504293,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16496172618687535458,1213883178326504293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16496172618687535458,1213883178326504293,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16496172618687535458,1213883178326504293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16496172618687535458,1213883178326504293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16496172618687535458,1213883178326504293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2076,16496172618687535458,1213883178326504293,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3192 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,16496172618687535458,1213883178326504293,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16496172618687535458,1213883178326504293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16496172618687535458,1213883178326504293,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16496172618687535458,1213883178326504293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16496172618687535458,1213883178326504293,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:1720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2944

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504 0x498
1⤵
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
67KB

MD5
929b1f88aa0b766609e4ca5b9770dc24

SHA1
c1f16f77e4f4aecc80dadd25ea15ed10936cc901

SHA256
965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074

SHA512
fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
ae33281742108cbbce71902de6d41488

SHA1
d87dc183beb2bb93b85c24976340ee1870107092

SHA256
5f579397a3df6d72583ef044b4f1590699827c1e8ec6283b28c4dc1569131614

SHA512
c47a3657979271b3a143bca0950dca0f83e0ee86ab0feea893b2bca3f15a19c4566f7240e131f25e98acddd204e0b6a360f6bb57c00a3a25b7bb878dedb609d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d71d30c300adbafd3cecc8981e54b3a6

SHA1
f22e5f96d896436a295e3defe44c614ecaee14f9

SHA256
ffc358c19a93fd61a105e84aeb545a6db13b60433ad41d4573c2878905954f0e

SHA512
8b82201dddd6e002c4813ffb6aac09da23a4c53e71cc7b902698b0c15f269fd6dfd6aaeaa04cdb538b2ae76d087df88371ad9fb9ecfce2d01ce4bc861ebe708e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
20fd720273bfd712519469e6eee73476

SHA1
ccd9f6dfd163e968e47bc2c63867c96bd10cfc77

SHA256
cfcccea5c7848cd8e4ff17daa77eb353ae8f61281b9f2fca3c6ec3332bc56dcc

SHA512
9eb3b7ab4ac49e1fc6b372aa0d949deac70185a26c3479e03389829dc35d644c815bfb4c9a43fb7a67c21e0a01aad300a3ac7e5e312ebec5f81d165505059c75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dfc530053d3cc4812210996247c7da5e

SHA1
7f2ae6cc10646ac087ee5fc9c6b05c2f2c2d2fa8

SHA256
652b1739ecf606a9454f80cf9e0dd67fa72969f0bd5be91d7a22fa8a630b6238

SHA512
e65ea47e628a0e84081b78aaaaaedc78de172166ce948a76720cff7216e3ac2b4e1f490fd491693f1cdec57856696976fa6df89df4019c7ad9a37cf19348e494

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
78a93639d0d8628173fce70eeb43b013

SHA1
379239e77b311603a51c16a7b60adfc5c7bd4c48

SHA256
f64df699134b19e9bfc84556277eb3d7e9c400399a6047bf12425ebbe992702e

SHA512
237f5f4300504fbe81bc18857ccf0a04946bd1b6726f4ad81b1c40b2c4b0d5340bd2f933c22b124ee9f96a6494809f237024cf8bcf04767c2f04d448df560db4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9c487521c8abeb36c2537cc6ce6313d6

SHA1
381d763f20018c9b164f88c41e94c96717940130

SHA256
a1f8fd0ad9b365d3e32008500a1dac4e592488a8088878bac9b3a9c093cbc912

SHA512
fd958d4a2c76a5d008b69e4b731949d4e0d3a4c004033b06fccf8bc1bfa167bcad4830a84ebad0dd67e42c410cd163e3a60f93d2ea52d4d182b4a4f99f152bdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a2ebc6c44e195c43915003fa09bd76be

SHA1
0e963077576d9f19c228772a83d990057db1acc0

SHA256
d267b73d050d4fa68a5885ddd83aa7e6f5a89355e7642f46eda461da8b893801

SHA512
f1aa861a59810ffa7252000a0fc2d57f828ed59674db2317295041526e461691b9ceeed45f83cf328959dcb321d4bb2cc19de3e2b00f7de181f4f62a4b3ebe69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1851451ae28e13437d77799eac6bb148

SHA1
5ac1f4a630858d91859f79cb765bc1263910393e

SHA256
208a7f3318a9a7af02ea0a55b739c7746f5c2fcf41c793f317b6c1843a5226a4

SHA512
c110db9f415eb7afb0c7a029ad14901c61a8ffbfb6a86958f0301130253355e514018028108b4e8497ef10477d14121829ea6496556750e036d5b8d6b264c4c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5927e1.TMP

Filesize
1KB

MD5
872f2a0db9cce31c384b703805ae51b9

SHA1
47218bd41d9fdb9c5b0ffcfb39f8d7410b9e30bc

SHA256
5732e62ef0b4970dfb3ea6c19bc9482084eccf3b32a3fd640ab83af4fc314584

SHA512
b6962e92ad58701b83d617cadbccef3196ee61df0b08a6e858b53422ce9cbed42084d314cf3439cff67363b977555f16f6be44454c539968ca3030f16ebffc31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8773d188fc7cc5523a81ca3649c493f9

SHA1
9ec74b2ec0cfc998673692460c7ccab0c39743c7

SHA256
9df89ecf86310aa9ff2f70ce3f905b1f2ebfde894327db64aec8af82eb9d1117

SHA512
24745462883f47108b5fe4bb696b2289104df8c1c8c10e26e87fee0a556ac558ca24f3de481ca7f8de0a403751b9a063278b147ebd0afb6367588401da8b77da

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit