hxxps://microsoft-outlook-microsoft-outlook[.]chicken10[.]com[.]br/?no=eGluemUubGl1QG1hbm4taHVtb

Analysis

max time kernel
604s
max time network
605s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2024 03:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://microsoft-outlook-microsoft-outlook.chicken10.com.br/?no=eGluemUubGl1QG1hbm4taHVtb

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4084	msedge.exe
4084	msedge.exe
4588	identity_helper.exe
4588	identity_helper.exe
5600	msedge.exe
5600	msedge.exe
5600	msedge.exe
5600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 1924	4084	msedge.exe	83
PID 4084 wrote to memory of 1924	4084	msedge.exe	83
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 1364	4084	msedge.exe	84
PID 4084 wrote to memory of 4324	4084	msedge.exe	85
PID 4084 wrote to memory of 4324	4084	msedge.exe	85
PID 4084 wrote to memory of 2780	4084	msedge.exe	86
PID 4084 wrote to memory of 2780	4084	msedge.exe	86
PID 4084 wrote to memory of 2780	4084	msedge.exe	86
PID 4084 wrote to memory of 2780	4084	msedge.exe	86
PID 4084 wrote to memory of 2780	4084	msedge.exe	86
PID 4084 wrote to memory of 2780	4084	msedge.exe	86
PID 4084 wrote to memory of 2780	4084	msedge.exe	86
PID 4084 wrote to memory of 2780	4084	msedge.exe	86
PID 4084 wrote to memory of 2780	4084	msedge.exe	86
PID 4084 wrote to memory of 2780	4084	msedge.exe	86
PID 4084 wrote to memory of 2780	4084	msedge.exe	86
PID 4084 wrote to memory of 2780	4084	msedge.exe	86
PID 4084 wrote to memory of 2780	4084	msedge.exe	86
PID 4084 wrote to memory of 2780	4084	msedge.exe	86
PID 4084 wrote to memory of 2780	4084	msedge.exe	86
PID 4084 wrote to memory of 2780	4084	msedge.exe	86
PID 4084 wrote to memory of 2780	4084	msedge.exe	86
PID 4084 wrote to memory of 2780	4084	msedge.exe	86
PID 4084 wrote to memory of 2780	4084	msedge.exe	86
PID 4084 wrote to memory of 2780	4084	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://microsoft-outlook-microsoft-outlook.chicken10.com.br/?no=eGluemUubGl1QG1hbm4taHVtb
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc53746f8,0x7ffbc5374708,0x7ffbc5374718
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2604 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3519825589904313871,12152745339078818141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:6104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
103KB

MD5
d354b18fe32fc3565451a8f98153bc9f

SHA1
e164311fd2577bafabf3bc438ac5dc3b2e1160a0

SHA256
3368da5385a5dde6783e316b59e0cd6c42c91472630c6f605e31d0ffd1c9f101

SHA512
95d7d2ebcf0603ece4a342df9aed4926d1e68bbba067fa83bf9fdcbd40e9a511284346de734f2bff06a7fa82b37b6e0d2aefb61f8dcec8990086ab73408464c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
19KB

MD5
d5b89ceec2b024c565802c0e51607044

SHA1
74696825d59f384d3d874638537bb4920fdb60cb

SHA256
05dc99c6e0751d3a98e970f628c8426a967cf068a4bd681bdbaf6f627d54c7e2

SHA512
bb683a290b2f506a413baadca020a9716299221746b3e6a0d4c9f4ba481b3605f2911c1011f60f0d38d155f8086c3af51f21d8c0164eccb911b4531983c544e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
113KB

MD5
f47950aa430eb5af343471efbdc60752

SHA1
7e34a0615cb327587a845e51e3fcdf672e9f7f31

SHA256
84981890bc788bfcd25ae0e19ffed0c54dcdc19007a7e0957eca4032ddb60b62

SHA512
084f2318db8492c3c323487f68d145c4137f5f45abe453cbc8b9c0c594c3a1a2a6e026e07d516fa1cc556f3244ef3220e81e0055452cbd2c7a7805a9158948f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
34KB

MD5
a353eee49ca28f36b2ffb518e6f4e666

SHA1
61e9528f8e265e14bd08db43ce6c79859f163a51

SHA256
9a7b279e4bd947d6b9cc2f510740458e69fe18c73b9e2b647bd9c9a79a654af6

SHA512
515d7821e6df768e93b827b982f3b6d4b452eb473a02166a21aaaf21000a7638d1858972227274b19930b50c11a8f2f19fbbfd9bb14c727871df52de6dd8d21b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
93KB

MD5
b178308b8dacb3e15cde3917dad8f3b8

SHA1
e8c392b07c74c4528024be66e36f3fdecdabc031

SHA256
80d594d4c38dab1b8e4b089b6549c60286b3ad3cdd7e062ca9c7d4bc5427b5a5

SHA512
2f5a78d1a94e72bc4a8049ab107658b9cecca4f55989f6ff9dfc623de164bd458925adfc8826257bd5e07ad55dfe6f939292dcb91b18b5c1f50b6fd750ef8893

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
314KB

MD5
637e11e0e951cc47137bff40dd229f0f

SHA1
61d9c2dcdc519586b54d46b77d493494ac32a986

SHA256
99d05b502850ed33cec5f293aef6d66bc9a0993e4d5c4f5e6ac4cded20de22c6

SHA512
2ae73e87db67c7022abdeb0e688b16857319ebbda9446ff92cfa39aeb92bc5c5ae2220412cf62f893cb26383ffa31acdab9d46c656c49ecc84e8cada8bd67d2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
413KB

MD5
1d89733b60bb6602e4fb38383fe2dc6d

SHA1
a2be11a1f83826f10fe3bddc224cd26bbc226a46

SHA256
9700f989af83e30931ec50fd523788a8828f77e9421e2fb474d477d8fd662d1e

SHA512
1f685440aaba73f74f08311a512ae5bb4bf2cf54dbe247ae82be3239fd6c53d4a53b31a953d56235c658d574d7bd3380049d165e79db7ee26b18f8d6ea7cc24b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
4a02a6d5cdbda1cf5847cc277c51f827

SHA1
1f8a2d6d55ddc983647ca324f10d936e98be84f7

SHA256
c8f9afbf81caa1d4559d947404b916c228b6e877e9b6b6b04b30b2b40344063c

SHA512
66af5160578d51e77f5ba3c55b3e585f89a683e1d61e6166bf96824ad12d9bd6e2612d8f279894755adfa209ab0737800c17c2c462fd726dbc9129aa8488198a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
4e78a5b08bb76e42d1791c6f4897eca7

SHA1
027dfcf00468886ce2c31793419e2435b558f639

SHA256
7cc6271344ffbb3dd5e1baafb7272c62b8bdef2785bc2d0dca4fbf57cf4d405f

SHA512
56e95b114dfe0e43e771d0bf82424c2ed52899308459d38248ce59afedcd49a24dd069915e05e291dbb74a064172bfd75d3cae141267a658020b8d7ec077e6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
9fb4a2c59e6e0ea5dec9dcea1e83bf3c

SHA1
9f0ba61f3dedd3b3f64e923f51159632cc5f4428

SHA256
07eb4f159218f028b6c323c5fe77a0b305ba7aef2eb3c04369cce6998c0ffdb8

SHA512
5d86491cd5c770fdefb768ae7550c863ceac0ab0d69a735be7743f0d5136d2d5de173cdac550a500571bfbcb887fc0b274f44e15f64e2f9347aa71e6f84138c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
1892bf5742b842e7d4cd714445ded19d

SHA1
4808461e8c8b2f910c1d5928acb8e623b37f3e4c

SHA256
f55fd36c54bd575c5cd8c80ac28f4d6cf81511c1d7dc0cc249dae92164fb2a20

SHA512
1a976e896e11533445864fc67afaa76afa24691904d3d6b12a427cef6f1e9ea9a4f7df9b75b945f1ebf029368a9a40281d3687e693e1dc2543da1c5b999f86f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
392B

MD5
1346ac01b9f780353144c02d15cd3cff

SHA1
7e06342daca44c8256f60772e83ff0d2059350d3

SHA256
e0126ce027417a2d7fc493e00c307080e8512d52ce5989a1dc852de2ce9d6020

SHA512
0cef390819b8eacb739cd6a21bf5d381827bbe030c730264fb1f94217da7739964e085a2796f22b228174f3cf3d7cca993bde8973462343a72b58feecbaebab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
392B

MD5
400f9d6232ddbe336dda168411ae6121

SHA1
baa825fc8a765b6f98adad7db2124aa5a795d098

SHA256
723fecb5545bc35b68096adc191999923f98ab2c4eb9be78a580b6c0590b720c

SHA512
5de380061278bfd2be2ea37ba633052424fe0f3a34b9a92f03815f731dd266e9980237de1a7c016d0e9e65e29804e2527b283076af2f6acfbd8112e01c942218

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
73d5c6033ac1dbb1b485984750288584

SHA1
530b844608a6d98f2e3f733d081b63080b77675d

SHA256
e27bca151e8487cea3c5ad6411b9c1302caf3872f28be3ae46336b2e9fb754ad

SHA512
03462612de7da8de865a087939208ed02cba07d20fad002f74ab286c56711777aaef3c5a0705a41f232885de4c45f8d5d2037f24f6254a5ec5c90efb532a76f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
947de4941daf2c99a09be22288e93321

SHA1
0fef429083dec8dd43088837b4fe8dd41acf8f4d

SHA256
db1573dda4ebf73719a13eef01767272630d22b73bb14b0da4c8d395403e2572

SHA512
76f270c27961468462da115306cab028793aa7874666d241622fd0361c87da482a47d75aac4aa35d383f1775c3ab040c7e03413b61790bb5c832902dce8a1146

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
09ff5d8930e95f1477d0f447422646f1

SHA1
f916e6a9cd1fd85b8819b297a66180dcb57da281

SHA256
5ca85fd67a749122c645e1a67189ce2d3c7a3a1e4292ae30e8c4a367bb9e67e1

SHA512
aab800886746bc1d96359063c10171973ed59920223bd3224f25360b25a4c2978af833bbc486d1dbf3d3abd087810f3f6f4ab5a5db74b686935f06a63cdc7865

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
770864cf748b84189303042dc9faead0

SHA1
d9f790e1e69ab9e3ee196a08fd50ca0eb55e2b20

SHA256
c2edde8bc9f01f7996a6999335189b512e1e036faa670decfac6e0fa436c0f21

SHA512
7e30aa05b733bd41ee2f19558e5580fd7413957b9f631743c55fb94aa60a0e93af8d635d56106f7765274fff57f3429596552110863c50f8700633dc3ccd5488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
7ff7fe8cc54d07b4b100f79df6767ebb

SHA1
45cdca43a349d2c585a5a53b61e06c054c83fcac

SHA256
fb0fd7e3ee06388dfa95363cb3eb494d4d318f8db3478a97eeb7a809ca059623

SHA512
17cffaa219f4613c8d1dede8bc08a86a8979b8239a37138f9ebe689834e66d9882688bf9c814dc2845b252f9bd83c8983e5476365c72582e99d60cb48185dca3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
a94883c13c3bbd5b517485e56e88c2d3

SHA1
0cdf09637899978b78ad56156cf084421fc1bbbc

SHA256
b0eb0da852dc9b90e66a1d424509b16cea4b0a1f24e929d936470356fc1f7627

SHA512
a91353ea05db8c33586565240086a7edc253be6f20a7e4eb75b43abb2859318c9c038995948c5c8e7f4f84bb6ba45ccc5d024409db085ce845a2c8438197a77b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8a2d843ee51a7aa74dd37ce1d56c003d

SHA1
b6e8141f0083fa71b48a198c8663da2a8ec911ee

SHA256
c8b7fc5120fd98970eb04d34a3b615c3f3dd6fb00ea500aa83aea5d0604cb990

SHA512
ff6ba987881ebe5988e60857126d24fd9ffa229c64e66a0547bfb4ca22e46945704cd66f095e9a66874d15fcbaeeb0bab36a2bd83afc0aa558563efc6e58a020

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
f0627858a53db92e3b9876a7022e75c7

SHA1
f0a35aee72f88fcde45aa2780a052fe8c1eab489

SHA256
937f558a23929cd096118fbc67cfe0ae935b419144197ca7d94d12d711e7af77

SHA512
2c25e90a23a55bcfb4ec20f330cfbc2890c39f13642a4b109f83923e1bc91ecab57bc3e9c0164798e725ec2d5abf1fe15b754c18b743855d0e41f538bdd94680

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
5be7c3b39d7af5f689075f00a1b5888e

SHA1
8220264a7df7d440e891a8ff64a44a802525b157

SHA256
77b30451d33ddcb5d4f60a81d2d1805ad77bc3dcafae7ef484b6d61f9d1cfcf8

SHA512
f0a6c313a3c951f4db6e5705db9e86338d4ef522f7fbf50ddbde8cba81f19c16dc79198229257cdfb378c783375961ec6b251efad44eb28cdc5239e2563f15a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
5021998e8f830aca40fe0853078f3356

SHA1
9f08e833d647d263510f1aba05d5b349dcad0e6b

SHA256
43f752946ef1d031af9dfce8a6b0e10ca125a159ffb1ea33d40cfcab2a44bf3b

SHA512
6cc791b11c72c0e003b09d8554f81f5ff24bda576e87923616f9d8c614b081354c6f533a49777197a03ea6a80788c7fd094be479f75ad8868ec80c3b387e5a5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
588fc93a3d15da394e5c306df0382adc

SHA1
c25cbf012d1f302c68134eec4e25f345e8d18241

SHA256
410e4c632e5979a5e0315c885bf3b53659a30160adf7ff896a14a9c4236e9568

SHA512
54d85ebd89a67fb3618fd72d807efb45785eb60829297fda26f9600de1e57499bac982637f22aa5e188cc9eeb7700b74a5ff84ceeddeceac54bcedd6314f481a

Download Submit