hxxps://www[.]bing[.]com/ck/a?!&&p=73933c526ce8e975JmltdHM9MTcyODY5MTIwMCZpZ3VpZD0xYmM5YWFiNy1jNDY5LTZmZTYtMmJkMy1iZTBkYzUzNzZlZDkmaW5zaWQ9NTI2Ng&ptn=3&ver=2&hsh=3&fclid=1bc9aab7-c469-6fe6-2bd3-be0dc5376ed9&psq=malware+download+test+github&u=a1aHR0cHM6Ly9naXRodWIuY29tL1B5cmFuMS9NYWx3YXJlRGF0YWJhc2U&ntb=1

Analysis

max time kernel
2640s
max time network
2644s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.bing.com/ck/a?!&&p=73933c526ce8e975JmltdHM9MTcyODY5MTIwMCZpZ3VpZD0xYmM5YWFiNy1jNDY5LTZmZTYtMmJkMy1iZTBkYzUzNzZlZDkmaW5zaWQ9NTI2Ng&ptn=3&ver=2&hsh=3&fclid=1bc9aab7-c469-6fe6-2bd3-be0dc5376ed9&psq=malware+download+test+github&u=a1aHR0cHM6Ly9naXRodWIuY29tL1B5cmFuMS9NYWx3YXJlRGF0YWJhc2U&ntb=1

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
32	camo.githubusercontent.com
35	camo.githubusercontent.com
34	camo.githubusercontent.com
36	camo.githubusercontent.com
37	camo.githubusercontent.com
95	raw.githubusercontent.com
96	raw.githubusercontent.com
31	camo.githubusercontent.com
33	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1604	msedge.exe
1604	msedge.exe
1744	msedge.exe
1744	msedge.exe
756	identity_helper.exe
756	identity_helper.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 3516	1744	msedge.exe	84
PID 1744 wrote to memory of 3516	1744	msedge.exe	84
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 2824	1744	msedge.exe	85
PID 1744 wrote to memory of 1604	1744	msedge.exe	86
PID 1744 wrote to memory of 1604	1744	msedge.exe	86
PID 1744 wrote to memory of 4344	1744	msedge.exe	87
PID 1744 wrote to memory of 4344	1744	msedge.exe	87
PID 1744 wrote to memory of 4344	1744	msedge.exe	87
PID 1744 wrote to memory of 4344	1744	msedge.exe	87
PID 1744 wrote to memory of 4344	1744	msedge.exe	87
PID 1744 wrote to memory of 4344	1744	msedge.exe	87
PID 1744 wrote to memory of 4344	1744	msedge.exe	87
PID 1744 wrote to memory of 4344	1744	msedge.exe	87
PID 1744 wrote to memory of 4344	1744	msedge.exe	87
PID 1744 wrote to memory of 4344	1744	msedge.exe	87
PID 1744 wrote to memory of 4344	1744	msedge.exe	87
PID 1744 wrote to memory of 4344	1744	msedge.exe	87
PID 1744 wrote to memory of 4344	1744	msedge.exe	87
PID 1744 wrote to memory of 4344	1744	msedge.exe	87
PID 1744 wrote to memory of 4344	1744	msedge.exe	87
PID 1744 wrote to memory of 4344	1744	msedge.exe	87
PID 1744 wrote to memory of 4344	1744	msedge.exe	87
PID 1744 wrote to memory of 4344	1744	msedge.exe	87
PID 1744 wrote to memory of 4344	1744	msedge.exe	87
PID 1744 wrote to memory of 4344	1744	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.bing.com/ck/a?!&&p=73933c526ce8e975JmltdHM9MTcyODY5MTIwMCZpZ3VpZD0xYmM5YWFiNy1jNDY5LTZmZTYtMmJkMy1iZTBkYzUzNzZlZDkmaW5zaWQ9NTI2Ng&ptn=3&ver=2&hsh=3&fclid=1bc9aab7-c469-6fe6-2bd3-be0dc5376ed9&psq=malware+download+test+github&u=a1aHR0cHM6Ly9naXRodWIuY29tL1B5cmFuMS9NYWx3YXJlRGF0YWJhc2U&ntb=1
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc80b46f8,0x7ffbc80b4708,0x7ffbc80b4718
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,88653404586540784,9053004988826595824,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,88653404586540784,9053004988826595824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,88653404586540784,9053004988826595824,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,88653404586540784,9053004988826595824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,88653404586540784,9053004988826595824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,88653404586540784,9053004988826595824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,88653404586540784,9053004988826595824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,88653404586540784,9053004988826595824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,88653404586540784,9053004988826595824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,88653404586540784,9053004988826595824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,88653404586540784,9053004988826595824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,88653404586540784,9053004988826595824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,88653404586540784,9053004988826595824,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2000,88653404586540784,9053004988826595824,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1864 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,88653404586540784,9053004988826595824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,88653404586540784,9053004988826595824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2712

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\92dcbf05-855e-43ad-86e2-be2c52d6f92f.tmp

Filesize
1KB

MD5
9537c940d7191bfdb1d6dbfdb5e1ce3d

SHA1
d1f39b453f67047e00e7ce51e68103d484f3818d

SHA256
6077d6d90c63f7f7282b0ace2831d339d2360951ea5682a70849fb60ce3ef987

SHA512
692605853d853b359190261b0ff1c09e1bb47658c7334256e2727965cd6e979bcb0c0e28ffb77e4134e505ec914ace778cb38367b1f2d280ba07953047570172

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
1bdfeb909a0e5c796d2f226db4cb4511

SHA1
01a92c8f0b0413ece1468c910c605b64a89b5857

SHA256
55d1a13efe2618de1c00656d30785adab4c4388d6a9729ac16d4d83fbf350eef

SHA512
f4195a3598b238f6750b7cec414ea6739b5926b8463c79df1ab0c579d019b5861dfe38b700655f83d6107da07ccfe77ff8d7aab3e5bfc742879f530d102197ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ce4d108503088c2dc6a178cf1d768ed5

SHA1
a50e8dfd3095b1237fd25d8095d1651ce22f6006

SHA256
4ae5d042342d367e1556ecc1b01e8ff319b1382e2edd386a2caa78f85ef74079

SHA512
7c659f271f40b5f62e1e5c11ab155623d3942e86adbe9b135b2e54ff8a7f3a28ec1dd55e368b84a56e710697096524719d2cd3ff56f4baea5ab66221305299f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
733B

MD5
cd088cf68c77e49aa8349a91d836679e

SHA1
e158344dda775e685c7b5da949cb68e6869685ab

SHA256
4ff39737f735e106b95eb0b4d35f7ca27938526cc6c2bc69caedb5745f1ac36c

SHA512
d4566cd5b5b25388a2c34710efcdd34ebcf0aec59322d45852796501547fe575794fd0ceca1a564c82cb40cec7c7d12326de1770d3666f6f0ddd318f99962409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
650B

MD5
5b6ab61eb90a9791ba5c72e0b505eb41

SHA1
a0279fe1e8c9973b45ad59fa292c8bb5fb517d19

SHA256
3d8ed5ca99e23efc0d43b3b6e11130517e51d9184e09886758e820619f941497

SHA512
79546861c1010ead5c666e8201d72fb4c5484813ffca760529c47114e1644b2f82485712a8d922772a976fe8b80b371baf398d428a45972bfa0b199e566a488a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
43642b174ef3d90e42eaaff3a88dfc63

SHA1
b5cad09b9c4fff7815febea6edef051af9c916b6

SHA256
21c112ffb2a3a568e65d5a920080b5b2fde29a7f0c109cf047b00eaa795d3ea9

SHA512
adc60668dd2429596a408655429b2613364401984cf5230fb50819ffc3d21f985e549e1c659f428c98db39ad6d0db292aeb6515e3a972d51e345c40708760005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
607d4c17b9cd87fe5afbb424dc2d2600

SHA1
702219242953f18659f3532100232d2189350d77

SHA256
f0c5d676924874df2140b3f5064ef027299fbaa32b0fea135e6f4eafc9e80a74

SHA512
cabccb10e57fd14dfa645903dd8a28bdaa4e6dfcc6a0eb9879bf34c43c7dda0f2e48224cb4518217ea634a36f6d13d0501682291fec8fdd6b04fc70417ead17a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9c1c663c898839689cc5ecd3bac3e810

SHA1
81f596cdcb1532e7092bec1b210f9b3547e34b58

SHA256
601d4771ae6b86a2c8ff27f19f0cc884f30ed4c5bc64b8453219502b053dd60a

SHA512
e282e3b72ba3f3c93cb89b50d399c11528ff975ea58162049dfb3e677e98212783c21d22529284b8dda368ae5eb487abce9a482a4a5f3dc25d9a30a80752d339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eee0309a6a846aa4c8984e312e0f3f33

SHA1
9c0b5ed0c4355c5ca61f761fd992f2e1421b27c1

SHA256
bac0e62d5cb54047e42ffc645a516c7fa351fdd531ba26e8e64c1819d39c2e2d

SHA512
b3027fb109f05b7e45cf85f7ddbd14ffae1ab1ce974d8bd48429a936c83d5a4f0bdbf97f77ffd06af6640376f4443caa3fcd81a8b49588656edde1ce8b77152e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7414561b83513c44e284f47816356666

SHA1
532591aae8c1f3cb707c51129dda9dbcb4bdd704

SHA256
053c495603a1eef7934ab97fbd5a2442d8950bdd07646be42de6b6cec21f5d0f

SHA512
6028d706bcf9dbb3e93732e507046749d7b92167b26b484e6f74ed2f5f681b754535005bc40a69e253c5b0d9e9c6200db69dbc2e9fb57b03c682efbc4761cb69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fb70a60ffae04d6f365b0579b08dbfd1

SHA1
7d3a9e7e02e561c62a3631ba863a2c291fe757b2

SHA256
7f5fad8ff05aad9b25012cf11dcf6684efed507ac9fd463a86a0cb4e3b7c7ba7

SHA512
de26c328452e483bdcc38cf3849ce47ea394e2280d0e8171cd70815df4ebb625628a7bed5889e66907c3e5140257437910e2f2026be54f1ccc0e831436fe242b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5b1fd9.TMP

Filesize
1KB

MD5
66c01d5c084539fc8e98aed6991f94a0

SHA1
f039f19962a9d35c3bafaa3d06dada0fb999541b

SHA256
c82a0d887af7fa2be96026648849c0e4c4311319e2f07cd9de8cc277af8903fd

SHA512
b1052927be2b60dd349781c849051a43533642de5ca4f54c768b484560dddddf2a041663bcdc50a9ca4bcd842dd628576e4edb728ee3f51cab1b56f5855ceeb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dba9fbc44c11c013653e9c57aab4118a

SHA1
3ef0452f7899ff2507f971712968732c4d7e12ff

SHA256
07523e4bbfa7bc148ab7fae2c5ffb745a19eb1e0243bd822b67df324a4bbe4c2

SHA512
d47694d042025b7adf24badc9d045c661dd4ad6656552b9b28f977f7c05f20fc1df2fcf63408a9dc0fd9de6b9491613803f8320324b1917892ec13104bcb77a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5a7d4d3c5bc2614eb7a5193b9235da9b

SHA1
dd00c25703f122066b8e130553b48b84398ee173

SHA256
b858c23d41a72851e8992413e54a52da4302fc9c2c3e21882f0f96cc157a2d18

SHA512
9565f9cb963a19a67779e9d772440300e7db266665b93282c4733679cb651e240e6e7bcdc52534c8526562861995298ab9a3b22dbf934098e0a072cebd4421b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d80a0194de1f8d11d998b579410423d5

SHA1
fd2b8599308986b7e45220f028922cea3d23bd65

SHA256
a3729f317a08c88be88fe8992055f093c83c2ef0513b0032709219616f9c7efb

SHA512
1eb16b567bd8725c667202b63ddf8412f51b1ab8285df926b2f442ec8dc7adff7552bc3f88902f296a498f7df69c8b4264325b9c756796b33ca64aea1a655952

Download Submit
C:\Users\Admin\Downloads\16f75019c7de5d79c259d4b1f1003938bd6449ce3c49b28d6320bb43dd6bd82a.zip

Filesize
246KB

MD5
d15e684fdc21fc3ce45ce251eaf75cb9

SHA1
9e41034fb8695eec75fa462f32a6296eab6947da

SHA256
1af6d9b10817055d298c03c54225f81163a782b384e7dddff5bfdc4db3cb7a71

SHA512
7cac67362b3a559500e000d371b3216a41a5d11e88fbaa40c6910982355d5239eb56646087a607237335184fec8719c5838ed45b7c8780bddbb5e15ea2acdd0d

Download Submit