hxxps://www[.]mediafire[.]com/folder/nliuafcwkyryt/a

Resubmissions

06-10-2024 16:59

241006-vhq8zsvdkr 10

06-10-2024 16:52

241006-vdsk9avbmp 3

Analysis

max time kernel
375s
max time network
386s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2024 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/folder/nliuafcwkyryt/a

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe
2948	msedge.exe
2948	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
232	identity_helper.exe
232	identity_helper.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
5480	msedge.exe
5480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 45 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2916	2948	msedge.exe	82
PID 2948 wrote to memory of 2916	2948	msedge.exe	82
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 3224	2948	msedge.exe	83
PID 2948 wrote to memory of 4504	2948	msedge.exe	84
PID 2948 wrote to memory of 4504	2948	msedge.exe	84
PID 2948 wrote to memory of 4496	2948	msedge.exe	85
PID 2948 wrote to memory of 4496	2948	msedge.exe	85
PID 2948 wrote to memory of 4496	2948	msedge.exe	85
PID 2948 wrote to memory of 4496	2948	msedge.exe	85
PID 2948 wrote to memory of 4496	2948	msedge.exe	85
PID 2948 wrote to memory of 4496	2948	msedge.exe	85
PID 2948 wrote to memory of 4496	2948	msedge.exe	85
PID 2948 wrote to memory of 4496	2948	msedge.exe	85
PID 2948 wrote to memory of 4496	2948	msedge.exe	85
PID 2948 wrote to memory of 4496	2948	msedge.exe	85
PID 2948 wrote to memory of 4496	2948	msedge.exe	85
PID 2948 wrote to memory of 4496	2948	msedge.exe	85
PID 2948 wrote to memory of 4496	2948	msedge.exe	85
PID 2948 wrote to memory of 4496	2948	msedge.exe	85
PID 2948 wrote to memory of 4496	2948	msedge.exe	85
PID 2948 wrote to memory of 4496	2948	msedge.exe	85
PID 2948 wrote to memory of 4496	2948	msedge.exe	85
PID 2948 wrote to memory of 4496	2948	msedge.exe	85
PID 2948 wrote to memory of 4496	2948	msedge.exe	85
PID 2948 wrote to memory of 4496	2948	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/folder/nliuafcwkyryt/a
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe024c46f8,0x7ffe024c4708,0x7ffe024c4718
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7320 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7792 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7972 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7620 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7864 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6016 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1124 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7972 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8080 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7928 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1124 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13397602358133419306,18240831287107141614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:5680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2888

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\9684f2ab-72c7-44b1-9fc7-0128e3728629.dmp

Filesize
433KB

MD5
910d9ae1d772a9942fe98162fd01de73

SHA1
69ccf422308a7fb7070f968326c4dab5dd5c1a5d

SHA256
5f8be9ae172e1094aa909b8a4a8bda47dd0391b548b5f15f65410e769e96c480

SHA512
767123da2124bc234df4650820f1e5ee1c747e13a5a16aba4773ef75348d15fa1f4241977d4f03b67f12362e2800b897d19c3a9027c1aaa855de48907fe1adb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
84KB

MD5
71fd84cc46e5af871f3c29c582ecd22d

SHA1
f0d6004242b4c7510797ed47eeac0db1b8756d57

SHA256
893712b4100d45881c6dc8eaeda9b45f37f1ed476f9ac4327cf2ed8bfe9dbfea

SHA512
a554d23800a06de700f42b65497da2fa29615ab5661365492e10a85cf6e68be41b2784f1889dcaf2efe5cdd61c87cf611e20e8b6b2ae47b93fae1e1d3c544b51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
72KB

MD5
1bdd34a3deb16a0a8f0c2806c0bb576e

SHA1
e43fb8e67321d843a4f4e7b45930ffd7f13a86ec

SHA256
dd859b0cf3a9504db76ea0d5bfa741b7857f846897eb928b132801bde3718325

SHA512
8f3d02e9f7a2396da252f132f74f422f52b437b8c9719224dc446d93f56005fa3678ef3c4661116298f96a954e5f1ad5a8e16b7ac0abad5ee73b04b23ff7b652

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
21KB

MD5
660c3b546f2a131de50b69b91f26c636

SHA1
70f80e7f10e1dd9180efe191ce92d28296ec9035

SHA256
fd91362b7111a0dcc85ef6bd9bc776881c7428f8631d5a32725711dce678bff9

SHA512
6be1e881fbb4a112440883aecb232c1afc28d0f247276ef3285b17b925ea0a5d3bac8eac6db906fc6ac64a4192dd740f5743ba62ba36d8204ff3e8669b123db2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
109KB

MD5
5cba2c7136057afa095475d12c815dab

SHA1
5c1d2dfe9c594270b27d0fabba82cd826994d09c

SHA256
a4f0fb745f68f886099a7f46828c2908ca868ca97db6084ce410e9a0d81a4284

SHA512
6a453ed638517974822d2047262b51415633021f49b017103a5a7c1415235c42e394608c0294509b5a813207fbbe8d250b38a96b94db3b482c69e6e1a2d586a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
72KB

MD5
3c8aa5cdefe5f7820691760ca2293cf4

SHA1
9a5e8a92bbfec460926851b449166a5f81ba05a0

SHA256
3eb9564708d6479dfd40462c4c0c58cbf737a7261155f3f2d7d1160d4c1edd51

SHA512
41baddb6d5865bf252f1ed08a37d6544b068ad19d02765685ca17d7144095e9d8ac6d278918f08c988917bf1f659fbdef9542db11dff3331e9c5943e09ddff0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004b

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004c

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004d

Filesize
67KB

MD5
929b1f88aa0b766609e4ca5b9770dc24

SHA1
c1f16f77e4f4aecc80dadd25ea15ed10936cc901

SHA256
965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074

SHA512
fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004e

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000055

Filesize
130KB

MD5
9ccb87075144ef38081d7d49295ba0b5

SHA1
189a3da859b1e414014ba523cfa068bcc70b1567

SHA256
95134193894c05dc77a5e5507052f9ece4e88a494f926b1ff6ee238ff26bb360

SHA512
01d5d1bb4a489f12b0c5c1200a652495dd297eea318511b8cdb924cc96b5d5ab1d27d5256276bdc8154a21dd82c3872684e15715ec6bb916c1e1a96dfee22677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007a

Filesize
63KB

MD5
5d0e354e98734f75eee79829eb7b9039

SHA1
86ffc126d8b7473568a4bb04d49021959a892b3a

SHA256
1cf8ae1c13406a2b4fc81dae6e30f6ea6a8a72566222d2ffe9e85b7e3676b97e

SHA512
4475f576a2cdaac1ebdec9e0a94f3098e2bc84b9a2a1da004c67e73597dd61acfbb88c94d0d39a655732c77565b7cc06880c78a97307cb3aac5abf16dd14ec79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007b

Filesize
70KB

MD5
8012bf592b9dd22bb33791418cd2c2b9

SHA1
ce79417c62eb05e075c99eea625bf4f1a67af7d7

SHA256
ce84f96fac1e5f0825453bffeed9f669b44ced56648a1c34fa6a7be224732b2d

SHA512
6652ebb783d5a559fe85dd1d493f13455bc33976e0060e9322d7c960b3b69b946f24d68f3c056f1bb791906419b78b60d69497300b7eaba9247a1068e5cc2e5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
589361bf4b7bf372ccc70ee348bcb9d8

SHA1
939746921cdf666205237fea05bda79f5c00390b

SHA256
807148b356ee0377298bcafdfbe0808057c20fd08e8952a0fc19719d737a43e6

SHA512
a12f06e491d77e4d328d3d568d41bb1588481cfb66a6ba454d237c803cd5eda0a284c5344633ec784b9eb34c125117b5283f3c824610327fbb1d1e217f1f936a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
29d45bdb9af9c58dc463cb5e0c9106ac

SHA1
b079c3946992ffbd3f9741829d480c26c51dd5b8

SHA256
4f643408ee54d00f011fdc0cbe724d3fccd3b7553f2e7ddb51d7771bc615814e

SHA512
4647ee511a9e49d365d9069cf416e394a24a516fd329d30a88af81917c64655e00bfb46a4d53fd39b27c09d0445cbd907929731af29855bb3e7829abcc4b5c89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
460b82bd079d334a7e958f64d3b889d3

SHA1
2050170b286cc27f838f84110b8cedea94987f41

SHA256
b843e9c9dd3d5a6188fcc59afaa9c2ca22207a0ae69494f47203dc13ae8d5759

SHA512
a68360fa7184e1e1a400f92149b176bd6f7725072e893296a36d2264c24c2c5abb387ba76924bef7fe7e80c26bd12d49be909ace1605afdb4fc5c6a349bb920b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
5626fa9888efa76a7f96f89fb5fc64f9

SHA1
741826d0d299128bb4e3942923f469721ac57284

SHA256
70e9751e78303b43b9b944262ff4904dfe4353fe68bc2bb999e809b6417a5b6b

SHA512
8b422b207ca8aa65d65c96e3168bc13c30d2aced05eb38c322b4f342ff6810672491b250502e6ab93cc8aff77325168d04eadad13f8dba5a61ca85791224dc84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
11638ee77013489acb2b68a3d319d872

SHA1
93f82429a057ee12d967e09b26126931e6bd0057

SHA256
7eade0e10a5764058f66be0ce4560ea68a59d5aac0e762fbafd31db331b340c9

SHA512
db9d126c92b9f50f724952d8d9694f821d5b7a95cc903f49e8896946b9d227aaa76aa5342c532754602c6a15005eaa52944502105d316d94528518cbd5ccaa38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
ce0588a25a629ebec8bf184bef93e1bb

SHA1
ec6575600b936154cb1d4a700794061df3c63c42

SHA256
ade3acac7555d8e372ddb7eae2636ff562a9e4e89ab4ad27ebe7c46352aacd13

SHA512
c5662765cca49de032dec1215217c0417e28e6970e210213d7e99477d508c6dfb6a935a965b44dcaa621b336083fd7ea7c9f6a64a19d95da5656a6ab468b6d92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
96b0658b3d89c7bc61893474148e0d3e

SHA1
f3c4cb29498099f5796dac55b92900c065ba017a

SHA256
d566a6727253f36eebdc235946254cb75bc8b01cb6a862ca89bf27b356524cb5

SHA512
7a69ef813fc543c95e8654a742a40cb540054b6ea836f547a71720236a41bc5d52ecaf665675043550ddb9917305123e3a31b64f246db5228790425d3fc1abb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
13KB

MD5
35063dda143a860ef9a375ff1b0f76e5

SHA1
48a2f70ba16daade8b70e4826fc2d83e9b8b42bf

SHA256
06b31addb5eab7d81b64e321e4193385f9e02c97e42773536f5b14dd5fee1a2a

SHA512
1764bdad9f43d74e0a7616cf76f63984d61acc30eadfd1539322aafd591f30fa3a7720fcf02c47d6dbe01c695b0755d30768303acf5e32ff7a7b79e68630707c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
12KB

MD5
6a32bb8f6c740a9dc36c678ff5048786

SHA1
ea0f4b90477c83632dd6fd112fe70539396d4d7e

SHA256
cc5fe971a9c9ed84714c29f7b4c071fab0aac4f4f7deb494f499859bdb7c1645

SHA512
e56530d17f612e87c436ea0cf71d155459804ea0754c6329e7705afc0d4cf60c1eaaa7ae909a3ef88fbdbc2f599d8401132705e242c2499bc0b439a8b573f204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
6d9e326ee1ac3282e13d5b6e8ffe9fcc

SHA1
78771d49273269652baba39a2f39dbc12ccc064b

SHA256
a9a9bf5da26912be10c7f682bfe01536b8d9c0c0a42c82b961c134f8ca097455

SHA512
cc8dffe54cfb6f44803ad4bf91eeb861704b5c3618f5e11135ec9f04055440bd33b7a11ce38fe147002547b7dead16e61f79ed1b5bb2d2926595228c90d04e4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
49b05c146d06f82fafe28aa546ddaa44

SHA1
e0fc6feadb893d5b2abd91913d00c08bd01fb8fa

SHA256
03990a64a49621995612016d19a6ceb5f4c359eef86188925ba541e7e1c09ed9

SHA512
c0bf9475f55bef56fe0116c47f04d09c1791e2b80ad160f86bb85477451e85d139499d823289267537d437c661d0959ca2abfd67efcd63bf86edd1c685e82426

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
9d515de8da707d46603411fb50d7f717

SHA1
4575d1de9d1796fd2c251d6082c0310dc95de230

SHA256
aae1fb9b01cc786e1bca58fd694db36aaf40ec8fbfca40de6ad6dc9aa586bd0a

SHA512
dda7ad034a555958eafe397cffeb5a6de0434b00022d52aea5b9a125bc2ba96f9ad4a7b7a3a7b8b43cff3ffdf07b8cc964f67b57726f39678ea2d7aa210d5937

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
5d7d84e8f2681813c91be17c75111edd

SHA1
160ae12a4bda581e3f0d7435af0187f737ee6152

SHA256
833e74d708a91813984e9cadf14a0246707e96038caa26a22fcc314e15dc9e3f

SHA512
9ee0679214c9789c9f6459dd63cbcfb9aa4d6d1fa758c2fad0c125b57bcfb738f190657f6fa807d88896211167410b4d793d43b40649264e54b40ccddf1fcdec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
b680b5ca7452ece1606bf15ec48f1a2b

SHA1
a2f25adf081d2c83ba861584a77e0471ce4ce9df

SHA256
fa8dc1a39fcfaf85d9b1be0ad9d4322db17961dd2d4d75046d26acd717372aad

SHA512
3b27a933a0adfa598ea613116973b5cbbba2c2c1bf4719e72a46d33877fcc5fdf7e60b6d75026ee63def4eb5ff14edae8c70cae24298c09fd5d2610d4b99db99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
bba1e8e2a5c38f38774b9a9f73db8c04

SHA1
343fea1d576c15be21e1f62d938a81b2533be8bb

SHA256
a29d9eae1c433d430d5b15e9036cfa6dea58bf3660275f9e1305180f3d328839

SHA512
e12070198cb495ab6b075d5a82f5432255fa24c22b5d17e0a3b9ff3f9933a6d5b62195d405af5aa5236d2cd43e7f44fda3e5a14f0c61078619c5a042bb24cd2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
bc7ce392eee76226134c0d90f191bf21

SHA1
6cf327aa44489bb23e6b6f1650a420ab338fb6dc

SHA256
bcd40fc7e8a615e2965477dd23ef93257bc4ced16d7de3d2bcbf17d9e01da43d

SHA512
87a6bd89dbdba8641fc472f288ccf5487893f799be24e865c5f162ee6031d73d193bb77a9892ce4da5a6ce0638db8a307581c8daf9a76195d1ca24ba97745c76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
618d683bf645de5b76616f00cec8f8c9

SHA1
7db194e58b66fd6ceec564d5352398d821529a8c

SHA256
e8ecbf2d0abb764927a345bb24b94cd677bc4352365963c2518e41bc35dbac5c

SHA512
196015e24d17b735cfc12177eab6f984441fbcd733d78353a47ae98a1ad701eb75d8bf87e5d99de4e227df81a526af82101e3b56f588a5547c2404d4263730cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
c812701fd425ce15b8a21fc95c5f31f8

SHA1
b38c008935c138d2d0b7aad5c6f930a0c5a49067

SHA256
e0e83217dc5666c40659a785ba55d16aa195b9fbb3eb650522e27553b87c8b92

SHA512
f6ba05384dcca380463b121d3b46d18f153947a03c1662bab7482bb8670d71f574e831648099caca7253808dfd5a9d6d022f4b80204d5965443acc9dfa2738e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
7a07a8e205b988a1cbcc216f1103c381

SHA1
404d5783da4806db9917d5d9965dec09fb43427f

SHA256
88a166054dab05d35b405f508a2925c558e209a003ce5513416e2f0da6a4cf76

SHA512
0b0724efbc40ccdd820b35fc133914dc9541a34cdc72372de16c9175c863eeb9c76600def36482a61a2af5c0d78461b28c45c8a9412f6b979fd65d1271c9b484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c6c33755142c0f2c8003f4ca56a2cb01

SHA1
071637140f9d22f54cc0839a1954ac90c81169dd

SHA256
1070b6caa6df25d409bf642a67ef71a457cee622bb87e3c12d54a0bd61db8f52

SHA512
83513e3c9a017c1ac791d01aca6d895ffd8f6e46221fcb97b1f27210ab1d0223abb21f1774e0df508546e88a974f232947f7815803e8ded42428577ee1a67ccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
5c6dd8ce9096ee525940c37534a39ab9

SHA1
5caf5fca890306ab2bf54c8ab8b0fc83fc66a521

SHA256
ed57c131cbac7a373d3588047749ee752cec31b51c653ed7924b62f7bd72183b

SHA512
cc9972efe5c97264939135b5a5252bd98971a345a84ffb71b72fd20912a812b236f53ef65957c56f69b909dcaa0655ddf9d7977317bd33255485d3144c4a8c4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
e04230c4a9a5ca60d616dd7c15b4e842

SHA1
baa11c2be890a74b71a3af7fbe0bb8ca212224db

SHA256
f858f7c5a59127ac0e7ca4775f448f03be0cf472606791cf31cb02912dd58c54

SHA512
ccbc8317d2465aac6aeffa9ba04f6f99f380033a28e0fdc9f0aef8665317e370fc71845bb2b814ef56131109fc94db03fb5bf8b6710ba8d8e741ae10cda1490e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
392a5cf468cb7ef0bdb8a37835a40eb2

SHA1
706c212a1545cdcc1c430131d754fba01fef758e

SHA256
e9577f8d3257f04fc1d2cbce9834f0e248678898202506198250d81d15ff6017

SHA512
57eb64a025cc4af6f2185702d5d533a7926307fb43b5003f713821f9c97105b02a0acc761c5e9198a6289d351a9708d9bdc59e6191d228795cfbda1f3376bb52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
aa57322db6c45046a12704a10548cd43

SHA1
540f02e5eb6b9e2c9b87c97007780424c9118f4a

SHA256
65d7e3c4f34a010ec32e9cab584040af9be8daff34fdfc3db05298b29eeb9a5d

SHA512
8ec831af668e0557ee3320c83c1110e8d9ae69c7a6dabd2b89db14e189c8cc475546f1849753b831a99d5ffb16db8ec33a0ec4e91bef008073f3cc59703bfd64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
ff9049f4279f33c9fdfebdc67bff52d9

SHA1
b5d63daf65f359026de815ffb20f7d5df2b2914e

SHA256
bbb9a43514ac093f106da304e6bf3c9924b42621703c0905b6eeb8978a6fc2f0

SHA512
4350a0d262208cad5d7cf397fc212625be375ac7d07fd203689b8a5fa2abff484a442bfc124a3c3dc7dd684f99d5b65c9795df360c4fb44768cfbcc7e32d8d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
0cb13a6cc454f43ccc1b9aa2378152ad

SHA1
7082e0e7f58a4d624798bbb44a9da5bbf348c966

SHA256
f55e494e6f369a1d5e2ec89883bc28f7f34c7663bbc9770e5f7433befd833909

SHA512
e22282547567159543d5d71ed3a5e3e5d1ea8b6d431cc20e84ba795f87459fee888d55926e8132d5dd2e0f0ab23912363b426e0b3c42833d46410bbc3091b0a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
bfbc7d933dbc535c093344fb126244e7

SHA1
29a8526826364db25f087fdaccb3329ac8241c76

SHA256
91f4bb2011bf8887f24bf76b57187121d932e610e5a869c291c77b5cc3716ae1

SHA512
8398d6b9c831dee86eea7d5ab89fba6cd667de7c6132d3265fc7ad3a47aa38887349b264b9bff83f30d6fa2a7590df1fecb57e57e0810290d5623122a0e47194

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
282193cc23aa7df901b0377a7ed09281

SHA1
9c4a410629b5043c17446b0728203518257ca851

SHA256
bcf3a42fb0aeba367cd1a2bad3cb1d050abdd168e7fb6df86fd22148d26befdf

SHA512
00c5a509f764a1259b9567a797ed8fdf8b12dcf3df97c1da0664cf056d1bf8e939702fb6db28f53f1e48c4f664f243f159d7a851d4e621fdd74ecccefe306fab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
acfcb858d88e23bd9aded077d297f24e

SHA1
b4df60fc5fbbd42420e0108ce24bd2f39612594c

SHA256
7462877b3d9c64bcd9827395342d74365c1707f6a5bee00011f18a3ff466daf9

SHA512
b0eddb66d32437a294b3a66e4ad5b42f0849fb94177485c9dff2b2a503401a6bf2c10df3e48abfdeee8e0d9ff5be00c02665fcd5936f0268365e25f92019ac65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
8b35f8ba2a6dfc3f86d5c812c6647d15

SHA1
4f95c6cdfc3c59195b316a944546d12f709958d1

SHA256
27ec2a7274284d1c07e53d6921be9f0623d9eff5c4d3ffa43a7c630ff70df748

SHA512
72cbaccb0348d01aa641f182ec402855ba071d65b30f0c0a892ade1201d1ef6ebcffe7b0bfda6979652382e5a1df3f61b37a5ed0a63efd44336ef3de886b2b24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
5d5d9189d4430c27aadaf23213fcb3b9

SHA1
4fee7dc3eab043ad8c5a0cd12e10d3f48fed29c7

SHA256
b9e71262ad5462d301d647ee5d4673e107d8a2a4d9e4832a24a2d4340bc5c89a

SHA512
657723ba8c2751329875d9d9df08c49bb90ee5218c28b0625930dbef1869bb0fd973bb0e5696b44fb4f7576de15d746ddc70dbeb6dac35b307435658991287c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
5eb6472210c41e20c17f8c4e2780a65b

SHA1
15dbe25ae7c2f48ed05d1eb9e917300b37389703

SHA256
44d4538775a908277ce9663818a0c2f315a2269eec713e6b9c9f44e985cfe256

SHA512
4bb2ec17e816050276e988025d3fb4815f065e7033c0f874e3d3e0809a1ee8bb06b2bd06a3b252c1f96ad58ba612997800f0cab1a462f4458c09ed33e04c63f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f27e.TMP

Filesize
1KB

MD5
c0615c835c38652234c92eac41b9597e

SHA1
5150637ebdb9adfdc164553706c7ae5c9effe236

SHA256
2d450261da5719cc3bfbf23f61e581bcf5a7a2d8724395d856643ae5c864f7d2

SHA512
c169694934cfec8e17c37102736e236cdd4e794afc46468b2c1777c2a07825a08ef3a0e8b36480b93c763eb909ee23d291fbc10ff482eeb24763adcf5f09c74e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3b902f69f9e9c7d4a22526904b6f43fb

SHA1
3a21a45f6aaad3cebf9f2b14fa7657a3735c62c7

SHA256
a121ea66931ee7af9e0239dc33103064d46f13087c9de6effc0eceab0b820115

SHA512
1a136de66e46a8e889083fbdffd4ce7a9a9ba5207063695339e4057c077841e48344e0a2f83bbdbd7761bae6c3e548c1c1f408e74a5ef10cf0e8bc80e8e0adf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
072d07f237bbd27071024101c22bb9ca

SHA1
c405557cdb6e00be7f2f42a462df17b671768078

SHA256
7ad13b4dc72d1d68dec67c6a96613670eb8d066a323cb44f459120811314c3bf

SHA512
bd91296b31c1b642469a8433d0494cb4c48c759b721a21ac6f036fcdf5b5f2d912fd2db61a4708fab5796201efdd9567942c6d13304468667d9daf4a523a5546

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
359975715db48bb0a8e2a064bc5075c7

SHA1
a8337bc3c143f31207ed551590ac1306f6bfbf89

SHA256
a34640ea25366bbfe85784299d1358eccb8a7550f7944f5aac8f65c02bb83a96

SHA512
8aa9f1daba64c282e25a96f3c1f6fc16ff4346b7e268fd29f15d0e047b7c8ff1693fe5c04f8c7d634f2ac48648276238a1ac33fd9e3fc936459792d3ec59f68f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
d866eaeda12028c2a491976712032aa6

SHA1
6c45c70d04b36903d4326e445009f3835fc973ed

SHA256
a2fe9841b582265e4542cdb03edba9de44a362667ececffe38256c9195bed7f9

SHA512
a895afc10fabbe4cc859f26a922aa35820032345d7e91310ad2291f7e201e78b5d766bf35012fb264ae6e771b55a4ac82affa78aa36f1170c9cb7bfd27a5cee7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
e1977c1b7d7cc66eb20e70cb8fe52c6c

SHA1
7b7d90de03e3d60e589536938ea0fed555b39773

SHA256
7895ca50c70499688e5a5918b00ead450079077fe437399936da4fa6cb44f794

SHA512
f9beddab7a8a5dad78970e0448527246d7b215b7dc13cd64a33d645af36ac8bc4da53a5ebf9036618e6e48b74b6192c3a866612c8b75f4da9196fd2054886fac

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
930c7b6de867f5ad18f97b8a3b851973

SHA1
4166c5bf445efbe20f21e95ab71b40d7407dcf16

SHA256
20143dd86fe10e5ef4c3a694d20ecbebf76ab86b81472965d5a4f5d1723b50f1

SHA512
e6c56a5ae849c6e1eba17b1d2ef52a64d0e313fd73ba13bb2073dece2023af2544fbde8a4256584e4f24698e7f593442c89b005911f37a38a5c40dde42061d12

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
f6cb63411a5ffd56dcdd4ac2087d5028

SHA1
06d8aacbaea28e999747e0ed1d6f622d50bfa246

SHA256
5837ece6802608729cd97fab6eb9b66d48c8ea354921018ca43954c00c117d76

SHA512
9c03ff53cf9367c29633fd85895298d30fb69152ad0d971059153a5f1c39fc99eb76cc2c80d9ac1c8134cf7776c140daa26a94dc77d54994d99eabe2c671e363

Download Submit