hxxp://instagram[.]com

max time kernel
199s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://instagram.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1716	msedge.exe
1716	msedge.exe
2796	msedge.exe
2796	msedge.exe
3664	identity_helper.exe
3664	identity_helper.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1136	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1136	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 4256	2796	msedge.exe	83
PID 2796 wrote to memory of 4256	2796	msedge.exe	83
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 2744	2796	msedge.exe	84
PID 2796 wrote to memory of 1716	2796	msedge.exe	85
PID 2796 wrote to memory of 1716	2796	msedge.exe	85
PID 2796 wrote to memory of 5064	2796	msedge.exe	86
PID 2796 wrote to memory of 5064	2796	msedge.exe	86
PID 2796 wrote to memory of 5064	2796	msedge.exe	86
PID 2796 wrote to memory of 5064	2796	msedge.exe	86
PID 2796 wrote to memory of 5064	2796	msedge.exe	86
PID 2796 wrote to memory of 5064	2796	msedge.exe	86
PID 2796 wrote to memory of 5064	2796	msedge.exe	86
PID 2796 wrote to memory of 5064	2796	msedge.exe	86
PID 2796 wrote to memory of 5064	2796	msedge.exe	86
PID 2796 wrote to memory of 5064	2796	msedge.exe	86
PID 2796 wrote to memory of 5064	2796	msedge.exe	86
PID 2796 wrote to memory of 5064	2796	msedge.exe	86
PID 2796 wrote to memory of 5064	2796	msedge.exe	86
PID 2796 wrote to memory of 5064	2796	msedge.exe	86
PID 2796 wrote to memory of 5064	2796	msedge.exe	86
PID 2796 wrote to memory of 5064	2796	msedge.exe	86
PID 2796 wrote to memory of 5064	2796	msedge.exe	86
PID 2796 wrote to memory of 5064	2796	msedge.exe	86
PID 2796 wrote to memory of 5064	2796	msedge.exe	86
PID 2796 wrote to memory of 5064	2796	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://instagram.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80bd346f8,0x7ff80bd34708,0x7ff80bd34718
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,1349284307048056148,8207910224564917998,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,1349284307048056148,8207910224564917998,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,1349284307048056148,8207910224564917998,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1349284307048056148,8207910224564917998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1349284307048056148,8207910224564917998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1349284307048056148,8207910224564917998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,1349284307048056148,8207910224564917998,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4012 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,1349284307048056148,8207910224564917998,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1349284307048056148,8207910224564917998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1349284307048056148,8207910224564917998,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1349284307048056148,8207910224564917998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1349284307048056148,8207910224564917998,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1349284307048056148,8207910224564917998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1349284307048056148,8207910224564917998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1349284307048056148,8207910224564917998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1280 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1349284307048056148,8207910224564917998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1349284307048056148,8207910224564917998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,1349284307048056148,8207910224564917998,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5620 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2244,1349284307048056148,8207910224564917998,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2312 /prefetch:8
  2⤵
  PID:2232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3140

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3cc 0x33c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
65KB

MD5
2841c83ed16445b929726d0efc76918c

SHA1
6671a3b643f6c9091c0db6fc80533993aa6af502

SHA256
b3fbc2ea9978a37e1e4db1ad6b6f028228633cf3c93a63b8a2832920b5d2761b

SHA512
e1cc608fc885040ce3db27d4e0f9099f0af5e0d586498baa8ba2668ad3282270d486f8a48174b793dff29f6a317b02af97e0e6f33672fab179ee9658d40114a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
13de4cab52464718e964020388d217dc

SHA1
3dd033b0f0b7c993a3353769291acb8041b2a617

SHA256
e76bf20fd783a057ddc76c252938127998d2577287cfeec481606ffc5746f05d

SHA512
af1360e9a3c5826a7c165734ff5d47fe878445fc7f24968138faa71b16dab84ae0386282fe71947020e041b36f475c91a9dc39ca4745a715de0e7c69dd573ada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
84665634bbd95f8598b2a0230801ba90

SHA1
c6d33a4e4c0bd783e4ad261d6deca99bc1b1319f

SHA256
b8a69b02a2f5203548b7deb8ce3c0898ed011768790a427687569c27ed7f8c91

SHA512
40935be0621279246efbf22fe14a3b048726270d537097025e17ecb91db42152c5f258628a90bc3cc86bc96eeaee25afcfc8a130a39cc814a7362f085d615674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.instagram.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1db8552afd3e594bb11041bc65114cd6

SHA1
bfdbdf8b720373c469ffca3a8e0fa4b99c768d89

SHA256
cab9acea48f79bbaa469a31f9ef024a35bfd49abc5fc379edc5dcf63e7aac9a7

SHA512
956366a4379b8056715f02f0a77228b2348fa42b0544cbccd8aa55790f8fe339cc67fce7bf988960b21b7248a1f4c8d919c2693f44f4b4062794b81309ecb939

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
336B

MD5
0fb13914683a5d1d869fcec5843c6377

SHA1
ff0352b96819d7266e9191328ae3b92a2ad79217

SHA256
5a46242ed49ca7bbd9d6bc9b7d728193fc75ab10221c2bfb60aa79950aab629a

SHA512
16e0ea3b2756fe42bedc48846f24a8dae1514da7915f43cd9de821f874e7b2b88c4c53dae2a4b14c537ca717bf2190a64ab76d7b464ffcbb0235807403bb7d8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4e7e277eaaef50cecd3cd26a22b246df

SHA1
378c3af3cf08b9bd5adc8231e03e80112a2da337

SHA256
ceaab1e0f879d730f9df9b0a6c76f5438c41382f7d997d5938ed83e7651354c0

SHA512
941987c2ae6dc9f58a185a8a92e1adbad0f535af46fd596b130996a0a61a4eb5d0b65b5ff7a06e5a164e6c4d7c98eafd35fa66fb887ee5caf4e366438354a05a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d205cc97ee254c442b63ae749d353b60

SHA1
0608a0a9a483e409b0d0bb0a117a59891854748c

SHA256
853fa5adce47e44346fbd8e4d09c85a0b4401727f3f9757db03277a2eb9cb39c

SHA512
5f4a89554cf27d33084191d3286232547c9872b5e49d7cd3026741e224562a5ac6176bfd4d3737718903fb56a808691f05acedd3e2da091da092e3d2d7aa627e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f406a6254953ab033b725281c84b70cd

SHA1
a414dcff06545cbe4c0584bb6bbe55d36f8b7ab8

SHA256
4f2879b7367dcec6663b13845c7a201608f4f7fa67bc529394249d4dcc053321

SHA512
6527399082c4181917bfed7c0091d3851874b406115f77ded7519b8bc8bf63d84cb9279a9568d767e59dfc93d6001ea63528f16bf84723cdf19ea9de73c23fe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0325a121c023f903747a80003afbacb4

SHA1
a4671118ee75711a10417335e205ad97f2c53340

SHA256
cc4f774f89b2fc048565ce04f08f8b26125b485f8c65eadec4b13399fd65701e

SHA512
7ea117820c34c98cc2212a52a2a640190dbf544e4acc0da69394093d4bf4befe2af69d1f326c215816348fe534b2f5d9136a3aecfa5d866f4213c487258f84b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\1c2efb7a-9638-44fb-84b5-78592dff454c\index-dir\the-real-index

Filesize
72B

MD5
44e441fa332bad8150b5baa869b6c891

SHA1
cccfb8aa9868cf6235faea5976470050d6e0c515

SHA256
f9615de16edc5cb30e3f3125c506949db6e604ee00fd07e7029137069f189d4f

SHA512
21f384fa742e6d7c6757fda53d77cc8adf6c263deefedcfafa6f1927f6cfde01617ccf9f12c82cb473879840aca967355d226df72b082635da1f1d39b60ff21b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\1c2efb7a-9638-44fb-84b5-78592dff454c\index-dir\the-real-index~RFe5949b1.TMP

Filesize
48B

MD5
1a31be38cca0f30b355ed9cf32dd6603

SHA1
663acd6b2eb4d8e8aaee2a7f57571974fa6e74fe

SHA256
19c7fc62a7988ccf372f87f37ec118eabb558ee833adf4d8e832af2ae7dd58d8

SHA512
25cb613f6b10dc2c89880005e40d464a7273d8579aeaeca123fcf957587b0aca64bd7619ae72965f778d3ba9a56c587be0a94735939813d042f2d538d553933d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\51ee468b-611c-4727-ac8b-edda3c7d88c3\index-dir\the-real-index

Filesize
72B

MD5
8d71bbfa7235d0c437ac010caaec4554

SHA1
f1bb9de5d45e89e1e0b0ecc68da83705c7ee0d57

SHA256
830fdaf83313ba39146332210e109be022f375dad8a48fe6f74e35241cedae72

SHA512
754a2798728c18006c50caef742748c220ab5effc7960c19a43ba94d0832f5d7bf67b8814a1d8ae9105a9dff850e8a8644b807b592d5cb40646b696d345f10e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\51ee468b-611c-4727-ac8b-edda3c7d88c3\index-dir\the-real-index~RFe5949a2.TMP

Filesize
48B

MD5
de35c2c563c6a7ad52394e5fa0c82346

SHA1
c77fd5df6f988494a76966e7171a58aa26403667

SHA256
6a58284e6ffa14367aebae6a1f7f5dad014a68135ce994327e1c6a76071ffe53

SHA512
5fa03c795cec2654be36f635930a25df239492cd368341174d3820660a67f195e3a6fd48288fe1a4ec3418fbd0a078cabd9d9baceebeff92245241ff7ae2d185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\index.txt

Filesize
160B

MD5
8f56e5efa55956337dc88bed386eb254

SHA1
cdd736eedc4a28bfe3361e3bee1a05306a96bc40

SHA256
37f1dca9e530b3e299016f95e91c420213030c7540c1306316da03124e79e683

SHA512
0f11d6ad3fd260a19fe579bef96cd658e619c671d2c28681438dd53966d0608712e71db6c283d5940ea18f918d339c6d4e00e64747189d9aa644efe651480dbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\index.txt

Filesize
155B

MD5
946a6c5c4639a1a326c8d973d5731310

SHA1
becb07d3c747945dd91ed81c8140412fc13a4e99

SHA256
8e235102ee457d3934151c59c6f738bce3f1d7f536789fed3d302eee32d68bfa

SHA512
64284be526ace71a8f0cc4a47a537f753e469a36bc31a3102aa78528f4d3c5d1a5d3b61e4ae2c35fbfe810ce7015181bce88823875a0fc2ffe1461355699c69d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\index.txt~RFe58fb53.TMP

Filesize
95B

MD5
403f9d96aa04e5e8e2fd3fd2e67d59ec

SHA1
dcc2b6ccdb49eb6e4b7b1d811010f47cbdb5cd5a

SHA256
30cb2971215c77011bd9501ea8926dc86328f9794413ba4e535f5a5dfb1cf200

SHA512
14f39383477431173ab733a507e609c3e5fba558801d5d16570c09cba6b922f475ab851db850051a41429049bab6c17934434f5c16e81238daddfd54b9ac95c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
cfb52269ce4b5c94ca3712852b59ad1e

SHA1
f773e12bc45d47266357718a621606dd4ebd05a2

SHA256
3f438e4297abf39d545a765e29057658320ab65893cd66271dfa6dd49a5f9a15

SHA512
13eda5e829083190b7e35dba20f7882648f77acfa6ecb0e09a9b5c9e5356bf052d3f8a561c9487174e4042ce739761073ee4f53183a41ecc5f4afb3a9ef61dcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594ec2.TMP

Filesize
48B

MD5
7b32db35a6fe349e17052bde7d88f7e7

SHA1
4f56afae83ddea9fadcef7e558560773916fe2ec

SHA256
3d82ef744a636255cb67ee667fbe6f660452a26f2ceeea7466231c45a6b6d0ad

SHA512
a92376d48d8611e70cadbf44bc216fc7ad94f4c1f9be903300709682f5ae89ade4f3d7b6cd44563bea3350702487f57c366f92407a745e1e8aac42719f002dae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
867B

MD5
6b256b3311144baa9a6c85798cccff6d

SHA1
53eadb2f342ccbb0008e3016ac41fa2e6f92e01a

SHA256
5e6a1193284d0a63818abed2e0cf8edbd29d1b3cc2ab0c473dc4fafeaa609770

SHA512
7c264b0412969ac55df557be613e9df5660c7e5d88ab985c8737a4e876753b48d331c0d3a683706fca724d20812beb69198f22eb08edc33c3b44f79073cbd0c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6174af92e0c10bdcb1fdc220147d7c9e

SHA1
1cc2976d0e015392a37382340f0dc2427592f5ef

SHA256
ebceb6b0d761a3d29f5cfc1a36877ead83d4d2e52b03968f7d7402f551417e10

SHA512
1b4c0c096b33ccbce6f54aace0217c9778f6fd3c1eb7ccee45f4d236a7387e9d409927e92c3aebd91e4df08ad28191ace17b9bc3e680cb95f9760cfcbc15e746

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
87f7ceb010c5b680550cb5c8f221432c

SHA1
55a38641f5e09c40fe17ba20961e8f6a1bc09a55

SHA256
740e73d9c1fd2aed83652690f6bf04a7a5db66c2188768252edc6c670b163b7c

SHA512
e1ccff77287cfb9b8ab0d7aaa3fe0f8ba917e1f0f1a252e3e75807973223507b710e9b52bff8e8c3020ce98e020ee0d929506f6f58838d4c74664ce52a7c4840

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7c9711a43cefd356d129cc239f63a15f

SHA1
3de5e34c2618450b52ba4c57e2123e2a01d43aba

SHA256
c449fe2d3a09fd7a111e2a7daad8ed7949559d957f29d64f5e89390eec2618d0

SHA512
814905cf6130a2085c3b0e48e31ab8f30a12cad379a352d272502113e869f324a4337b4ec9f767eb3ee2669f531550f87af12d68a5e033b152cc24e432fa6a67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
595d45527f847cee1b4502ffbc169d39

SHA1
8501f0b2aa154b3d82422e457efd2322bbb47757

SHA256
df98ebc59de01b89b8822268b5928cbaac3fee4a157f0447bdc30e6fe7884604

SHA512
bc615d124f73bd4a6cdc29ed860d4f11b820b99344f973451979fe45f91685a56f116fda34be3429e86bff57bce4d9e210880d82611b4d0057651ce9ccb81361

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
369c2a8924514b002dd48f27e5f989fb

SHA1
d61ec7b736dd60973a912c90f278e44f0a4c2ac6

SHA256
51147596ae57d91b71ec897140b3c058402e3b07347c312e953c6b4612debfd6

SHA512
2e6b59588843bebd1bbbbb86f4b99750197242c2d3117fa1f548c6a29ca48ffd5f53006d68e0c1df84a46e0f5a308c687d7299545e755540835de8d0b1804c95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
88c49e474fb488f6ceffbc8b5570b020

SHA1
bcfca24b513bee67d134f2113426ef279aa5ec5e

SHA256
f9e03c4c3b63b6313baf31e655676449226b62fbaa170026074081039d7ef788

SHA512
f57c7e655a757be7a3af6a116fda761a5b6f25edbe0d0772a614146c3ec0fc5aa453c88bd770a41c8a075734db93a456bd3f80655e2a1731feb0d7954e1419a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
74fc49b8f5655e8c778467d89e8a1e0f

SHA1
cd9ffaa39c0765cd1980b2072071cdeffe99c18b

SHA256
d075e48085550d0757b1546a18188267617928d4a396a0414ba23dd6e1938b75

SHA512
2dbd66af6058fb5bb284a480c0f577fa1d7560e6e3807aef0b5b0740342ef1032fad987c4af814ee7b3423486cfe0de744e78a84d83fb5c63c04cba3b1f16ef1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
699B

MD5
281a88d1ce4a5db2ff63f6e4b8c897d6

SHA1
bb5ee633c3ff31fd5083157191793dc80a45b5c7

SHA256
e8aacba00fbb9f67f46dc5b2211f96dfb281463748965f92695d854895956383

SHA512
ca4729283500a58824ebf61088d094b6dfd767d4ed62a0525006b0e000597d29a7472b9dd93321d2e833950a2b683262f2aea70b614b5883f8c6c5053d615fe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5812f6.TMP

Filesize
699B

MD5
a95afe419f0dfdf8d5613befd7776ae6

SHA1
c1372760ba5fbf327d25cd0a3250fcb7c638e3bb

SHA256
60224da2231cb2930e7d06546b2ffa46f67fbfc94236d8a75516efc779ffb695

SHA512
e68127af1446832f45a6dcb19da2aa9ada33d37a6ee8259b35d047309b3a640a083f1b5bab088aceaa1da6165cc7fb44f4795eb8ac6eddab7b4abf6e5af286b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0d9b5786a879839d69331eeddde7d910

SHA1
6e1cc2ffb040652271c823887dd8b6fc062ac3df

SHA256
b0b7228a1682d2f414254bdf0e59b8664b61a45ddb03b74f3164057738211c43

SHA512
15f7e57db35c4ffb0bca798f26ccd3df4c4ed60dc3427c90c7ecad39dfbf6c3e75a3ec4fd532f1c920c3504eb6c7f562fa0fdb8fff847117971a422dcac0fef9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit