d0ebe07f9a924c46ee702c913c1c78eed91c1fb104b965c7a41ad7d0dfca0e21

Analysis

max time kernel
40s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

yCttpNGcq6.html
Size

10KB
MD5

67b272639d80ead2d7c20688a7b64f4a
SHA1

540f1017cf750140aa45f395171dcb74838a7b54
SHA256

d0ebe07f9a924c46ee702c913c1c78eed91c1fb104b965c7a41ad7d0dfca0e21
SHA512

8b7a94cca7f9566262eaeeacabba0c15d07637660f22ef9a9b87c3f8f4046a24fcd981d4ad4e53344dfb78513fb3fe5406ddacbdc2da91333d6c5a5d29a64f31
SSDEEP

96:2wJw7wzVe1hzmcpWZvZIZZOfRr8L3ZPRe5mvtgCsXe5oEDZqZQzZJnx/IJ:hOszV8ExK2Rr8tUoVNVYCJnx/0

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
1060	msedge.exe
1060	msedge.exe
4824	identity_helper.exe
4824	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5056	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5056	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 4084	1060	msedge.exe	83
PID 1060 wrote to memory of 4084	1060	msedge.exe	83
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 1644	1060	msedge.exe	84
PID 1060 wrote to memory of 2284	1060	msedge.exe	85
PID 1060 wrote to memory of 2284	1060	msedge.exe	85
PID 1060 wrote to memory of 1908	1060	msedge.exe	86
PID 1060 wrote to memory of 1908	1060	msedge.exe	86
PID 1060 wrote to memory of 1908	1060	msedge.exe	86
PID 1060 wrote to memory of 1908	1060	msedge.exe	86
PID 1060 wrote to memory of 1908	1060	msedge.exe	86
PID 1060 wrote to memory of 1908	1060	msedge.exe	86
PID 1060 wrote to memory of 1908	1060	msedge.exe	86
PID 1060 wrote to memory of 1908	1060	msedge.exe	86
PID 1060 wrote to memory of 1908	1060	msedge.exe	86
PID 1060 wrote to memory of 1908	1060	msedge.exe	86
PID 1060 wrote to memory of 1908	1060	msedge.exe	86
PID 1060 wrote to memory of 1908	1060	msedge.exe	86
PID 1060 wrote to memory of 1908	1060	msedge.exe	86
PID 1060 wrote to memory of 1908	1060	msedge.exe	86
PID 1060 wrote to memory of 1908	1060	msedge.exe	86
PID 1060 wrote to memory of 1908	1060	msedge.exe	86
PID 1060 wrote to memory of 1908	1060	msedge.exe	86
PID 1060 wrote to memory of 1908	1060	msedge.exe	86
PID 1060 wrote to memory of 1908	1060	msedge.exe	86
PID 1060 wrote to memory of 1908	1060	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\yCttpNGcq6.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcf3146f8,0x7ffdcf314708,0x7ffdcf314718
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1472,1514710604269096103,7887025346460396597,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1472,1514710604269096103,7887025346460396597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1472,1514710604269096103,7887025346460396597,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,1514710604269096103,7887025346460396597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,1514710604269096103,7887025346460396597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1472,1514710604269096103,7887025346460396597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1472,1514710604269096103,7887025346460396597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,1514710604269096103,7887025346460396597,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,1514710604269096103,7887025346460396597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,1514710604269096103,7887025346460396597,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,1514710604269096103,7887025346460396597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,1514710604269096103,7887025346460396597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,1514710604269096103,7887025346460396597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1472,1514710604269096103,7887025346460396597,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1472,1514710604269096103,7887025346460396597,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,1514710604269096103,7887025346460396597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,1514710604269096103,7887025346460396597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,1514710604269096103,7887025346460396597,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,1514710604269096103,7887025346460396597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,1514710604269096103,7887025346460396597,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:1672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3504

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x464 0x50c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
232KB

MD5
fccb518b72760b85abb965b59571adf6

SHA1
d35de204e27829a92cc2372085dfa22b00291368

SHA256
bf2d2c81d5197a2b0171fd5d445f7e2066d736bd0aed15d443ebc7dc14f546bb

SHA512
a059ac6d076d8f99e7a375206e82ea91c3675f5217b30cd52d888d415be20d0c39bd49fccfe71e12d986155983e44032cd4e5aec396b4e0c37bfb3fb93846b87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
20KB

MD5
3684c7775bc328aedb86315ec6891439

SHA1
cfbff177f45afdf36026595ba0abd3bb59f86a43

SHA256
e8d182897c2ec12664cd8e86b31ed441f775479b41a7f1ba39278d32e29fed87

SHA512
2f5f00b2018c4632260b7b26ed4d524dcdcc02f66c3e561a3ccef3a023c042ffefc3028329b4c58b59c4186936d51514b892bed0da00a410502b81bc95b6230f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
47KB

MD5
97244a4b866e404446dc139016cf23fc

SHA1
54b2c9d1498907d75c6722b145729361b2353f47

SHA256
2fb7c27a7ff245726c6d886d5342cbd81ebb451c0dcd9a231af2252e8952ffac

SHA512
aede88d704c2bc0210189880d4260b9e35a9081eb21c51409048287ff35fa88aeecb036661baff2605419897ab644a4fc8e7fcfd93c14096d5e91503f5a4fc65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
610KB

MD5
430e1ab1d525a05692d565b8283720dd

SHA1
6220b1642b5fd7d84a84389f8d5c963c5efe6e42

SHA256
b595a37b77b2d1a1f1b0c6b189fc06e9bb1c409b5a45b0dddbde182937c1db55

SHA512
c81ce8b14b268f31bba063cb2e7b397cc94fcf725183dd42be8010e5f5526fd755d6723c6b02a36b68a46b1fcf0de09cfb12f8219524c4c658f54137cc220512

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
32KB

MD5
6e2a51539d4397457ebda8454a1936f5

SHA1
ef7d320c0b86e3e781202592fd2e3f3c30570647

SHA256
3d10aec7fe2514f5c8da104394c6bb853097ded5d54bada617c7e0eea293142b

SHA512
479a953160660170ef5a9dc90cd47b6d65f90c2c0763fda0ba0aaa12503208d595e81c3a79f3952c95dd909109aec3ca5259108f946386f2b3bbbc1d92b4cd95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
32KB

MD5
1fbfc2ba1b544583815404b4ad92dbfd

SHA1
d4f89ec5247bf715e314e45848a2710b35e79715

SHA256
35683e41edb1cc791cf6d8c925431d63b500c4e8436b61a26d4676c3f1141476

SHA512
17530db85040c96d7971f0aa4cc768d297f2bfc3075533302c56b2ccc4f4da862e8226b9e642e8044c2061e26a1d2633e344439244c55cdf271d0c58d8b6a83c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4c046312227ad7a33f95bae807bf459d

SHA1
91bd5429d2de1667a013d4236a86ecd4ebe86de0

SHA256
f4341397030d7e39dcef19a1cf6be2d8c0f8c546c00412411681be8e0eca399c

SHA512
05005c3b68ae6c5cb652f238851e1c64801f3bff7b2c9bcd96c1418646c894d193b84463ca5d590963b1c2de5f782fd35cf46219afc6f0427471bcb9bdadd995

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5f5287d4d0d3810f0d3d8bcbb1735651

SHA1
8ce09fcadf8cfdecf428e30dec1a9c2c6a660bef

SHA256
7a86228db66823a0577f3e97c87138ddb83200cd2f0d226725bab56b42b91ebd

SHA512
3c5bbe8e846b4430c83523ba3767d703489ed04a4eeeb7fa4ebb702eaaa40078f4857f5cb8507b7bfa6258523e168438f4643bc3cd0edcc12b3834ab10d0aed7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
05ab880a92c65dd5884c998bcf9d78a0

SHA1
7e676474d13bdeacd6bb09b05713f84e8255b1ef

SHA256
cdaa73735ace38d348a75eccc654d9c083c4eea414c233ab9419e72aea6ee311

SHA512
eab2fd80ec27eecdacba579550b99991d883cef79e5c98976686c07bdc3bddb7c725de398506a1fd970b387447629e3e6428d523d598091b6e7db91213fff4a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f6f84d980527aead62cc5e01d51e0c88

SHA1
02f3ef0ade3633971aa395f8990423b405bc7686

SHA256
fab506112e4fc509e65c0cae1625a29c7ac614c8b7727e944232853aa2e28985

SHA512
fd12fdef7ce8584eeded8ef107757300b5c65fb8fbe5ad002f20526a1072cfadaa6c8c378fb1f75e5559b5fcbab694c90ede5d7ad078cc34d605c87f4f78d715

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\197ba74e-98bf-4b35-948f-8ad6acfb5fe1\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6ed05d0c-759f-469a-89cd-8b46572c4d58\index-dir\the-real-index

Filesize
2KB

MD5
3adcaf8c3f908f5bc6da04dbacf64853

SHA1
21a6150534a1d93e6b30c280197628fa17f11922

SHA256
16653782e02299c261cfc2596217f32191af31a2285ec25cb022e049d8bfc7c0

SHA512
77f9dffb0dbbf424327c1a8f675f27976aa16be56758264b0bb82a24d785dddcef674e054a103ffebefa53cdfb90daa6a51027a5a331a172d5f50faee4cb4de5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6ed05d0c-759f-469a-89cd-8b46572c4d58\index-dir\the-real-index~RFe57feb3.TMP

Filesize
48B

MD5
6a50f42e72315457b2ed69cfcc54b120

SHA1
2aa5513d65df4a8b19a81f8679dec0640203e735

SHA256
4ed761fb9f4f1096aa7c491fff3270f8ea56f8fda198cbb8958dad79b00082b0

SHA512
7b6a16dfce101104267a291039522f19fcf0fa64e80530f14d849b373b70deb3e37e3a323abf1155c8881ddcf849ac79a5f61e2a7553f83d906540490745676f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
9e00512d519f29c14e331799a132cfb0

SHA1
2abae4ad338c08ff1e36d573f09fe7bd07bb2766

SHA256
b07d48792de5a85e1d62fe9c9eb61f829f15bd59e3e48d003fefa07bb010b86c

SHA512
867e40a0b444b137476ac7acd5736c987d9a7029e7f7bc5a42c5760e67eebbe1da38190be60dae5dda00dffbb76b47fd199e17ea069395d44ab1ef1e63ec6649

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
f46bf227acfccf23567a48f86ca79e2b

SHA1
576c3939afc01875f58f54c2181cec3d6f05a6c3

SHA256
f8f8e1e218f4c23f52d86c07738559a5fd93a62e983409c419a43239844e6a1d

SHA512
376b666c14ce8ba32c1d64ecd42031768ad1fb4db9f916f1737ff6604f4648e4e89159eaaba1c0a2c7a682fa4cd35dd5dde13fe7d762c33f8fded60ecfc47abd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
5cfecfcf31170bbd6c9beb0a6f184836

SHA1
021b874f8c4b857a7fbc6b0c7a65ed250e761eeb

SHA256
b5edd80f572fc51f03add5bb5667306da2f4b4e6773ab817e42d8005b29ade29

SHA512
1cc561acbb97add50007b0ef824aa7b545a6d17c7813b409e3c5b6df13947e2d2be5e85f4cea9329d5488510d5a116672ea71802bd29218e5fe09be336f243c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
157B

MD5
5061f91c7ee8ec13599edf234c71ed71

SHA1
fc2c138fa9b6ee50d6c64680e2d391c2f686a41d

SHA256
0fc69d62f08ece6683dccc89ca88b0c7fb0543f023a1c450b2ba2e853dfb0966

SHA512
1496ad6a9b141779a1c001fb0825b264b838633b39ac7d32c71aaaf29f0547eeef22b4eb13fbd94215be6ec49b5b49194ce797eab44e088c11acf0a377a9a9b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
fa6818e37ee95746f5a880c03e3ddb21

SHA1
7fd5e46c66f9e89b769a48410df3bbe5b2aa399c

SHA256
81789b792c4657152beaf82f3d995b5951cac1437a2bd4ff2376d6736c2a0f35

SHA512
d9d695b747a86843011d07d8a7d56f525ce75c241b220f7197fce2ca06161a0b03cda9d99dbc548e50f406e3a2d328d54171b7ac9a6af8be971b7c95260ba695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
fb00bf9d48a3b8b60d4e9ab59c6ee619

SHA1
37a754f5eca566536283659155e16468ce2f1cd0

SHA256
1263141f5dd759c586fb5a6eb615b7c94ed23dadaa7b5f76ffd803c769c66153

SHA512
c556a286eb2d7fabaaacbe5638058fac41ee8be3df880ebc990a728d974bc64e86bf02913640c1be053163b75d3dd61e3eac59a5abacab05cc1637844ab580ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
702B

MD5
dece25c883596b9588437b7a3181d30c

SHA1
da9216a3ad7ca637ea2012918adb85da0427c7ca

SHA256
b381d8f75f1a228215c1ffe8fffb81ae46a3657fc001833eb088251602c9f273

SHA512
1b9cf39320af29b62fea809a552b633a222e46290e9df52b8d7961f39984a17fc3ad0b69b45d3757beea7b16cd29fb27628f2a8456e0464483e112998826bc03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5830cf.TMP

Filesize
700B

MD5
021eb6095744084bd602cb1f38001a42

SHA1
8bd777ad5953eaf2b10febb24444893d850993b2

SHA256
016fcfedd5f986d7384e499f8a8df9dd33c20f63516f16fcee6d041c1b1222e1

SHA512
cd857369c7a3f730a23453b482f74c6b684d226ac8cdd6be4fa8c90e0dd2d3850a1ea18cf2ba2d2178dc1c6a51d074221462b2c4a8eb876625f2d5b6dc6a16bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
de60b60d667b0a2482580fcde0341cfd

SHA1
cd0015ade6bee019bcc0a16e32dae24187190683

SHA256
db9d49f4ee2a1ac0d7cd2e68b44049ab39078b6480d6b0ef7b53e313cdb8fe86

SHA512
f4a879cdc17c29950d2aaf3c3d183f36fe94a4d7c46daec08262546bb4fc63bb164ed0d633e339efbe197ab57399a7df6d78735edb1a718374d63010cb90f7cc

Download Submit