hxxps://mnnyyf[.]co[.]uk/?hekkgunp&qrc=

Resubmissions

21-11-2024 19:32

241121-x8xjsszlhm 5

21-11-2024 19:18

241121-xzyeqszkeq 5

Analysis

max time kernel
77s
max time network
74s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mnnyyf.co.uk/?hekkgunp&qrc=

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 4004	2320	msedge.exe	83
PID 2320 wrote to memory of 4004	2320	msedge.exe	83
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 3880	2320	msedge.exe	84
PID 2320 wrote to memory of 1816	2320	msedge.exe	85
PID 2320 wrote to memory of 1816	2320	msedge.exe	85
PID 2320 wrote to memory of 860	2320	msedge.exe	86
PID 2320 wrote to memory of 860	2320	msedge.exe	86
PID 2320 wrote to memory of 860	2320	msedge.exe	86
PID 2320 wrote to memory of 860	2320	msedge.exe	86
PID 2320 wrote to memory of 860	2320	msedge.exe	86
PID 2320 wrote to memory of 860	2320	msedge.exe	86
PID 2320 wrote to memory of 860	2320	msedge.exe	86
PID 2320 wrote to memory of 860	2320	msedge.exe	86
PID 2320 wrote to memory of 860	2320	msedge.exe	86
PID 2320 wrote to memory of 860	2320	msedge.exe	86
PID 2320 wrote to memory of 860	2320	msedge.exe	86
PID 2320 wrote to memory of 860	2320	msedge.exe	86
PID 2320 wrote to memory of 860	2320	msedge.exe	86
PID 2320 wrote to memory of 860	2320	msedge.exe	86
PID 2320 wrote to memory of 860	2320	msedge.exe	86
PID 2320 wrote to memory of 860	2320	msedge.exe	86
PID 2320 wrote to memory of 860	2320	msedge.exe	86
PID 2320 wrote to memory of 860	2320	msedge.exe	86
PID 2320 wrote to memory of 860	2320	msedge.exe	86
PID 2320 wrote to memory of 860	2320	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://mnnyyf.co.uk/?hekkgunp&qrc=
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff276546f8,0x7fff27654708,0x7fff27654718
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12652158475256525052,1324104843857562351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:5476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
175KB

MD5
7107c752f3901d95bdc4e9d46ac2b6d8

SHA1
747a0d933dc2ef38a98fa11a44ba661ec6a5eae3

SHA256
c4a5ecaf090da5f8115afcf0d4b723810054ecf3de31acc5ea6d48f9eb2d4111

SHA512
71d4ff3fa6c9a902b299302109d034d4610ac8a31ace170f09a3f66bd0d1259c41361fc29f2205fec6eb49995ffc73563399a6ccc536b8412bf1064485caabd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
159KB

MD5
78450fe21afa3391dc4dc62d5f1e09f2

SHA1
8aed39e81b26f10dd32c5b131eb7493d6d41b06a

SHA256
4903f015531ad7a745aa8c5155780c51adba6e0f671607c3fa1447795f33b794

SHA512
46db3beebdbfc0ae2b4e6d8f015e0f122851cf57662d5f445e2c4cd4f7ca2097690a610247e08f789685411d75b018cc35bc0a679b4dcf9e68c9fa164f347256

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
165KB

MD5
34049e45a502035c1ee78f0b0967588e

SHA1
dd604c54963f4ae0cb4cc1c6890b66822a6d7b82

SHA256
a84c114bbb185448de945b27fca0b6ee207f4801505e3046f35db050f4720eaf

SHA512
07b046af74583dc5ccb2dd1a636042b36dd4ee50aa6e7a3871cc26bec7aee823dcb2ef8bae3f465a374b04ae92b8cfb90f41ad3a76a0d2db1b6ca764d8eb204c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
142KB

MD5
d1e0216a2cc3db1dd95ad3230a39a0ca

SHA1
a629d848286dcdb6876631bdd3bfd7dc6e05422d

SHA256
b41f67ebf201d922b8668a628078e11dbece1fdf875d1df93495c3ba3cd31372

SHA512
50f8b14adf524175f2867c7e198c71f78a5b9a1c2447229a418c382519299820ea1f0dc77af121c58ea116e2cfb4163b62c961cdb7091fcc4e9691d6135f3883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
43KB

MD5
820f40594a0e8d5f9d58546208aa9060

SHA1
e17ed5116a34c432013a244c979ac9da53829d74

SHA256
f8f708049e1e1609af3959cd21eaf313c8192d3e962887a7a2e1f9b353d3fc80

SHA512
95879b255a90ccdc41c8696bf7aa05796db56528fc4be78f2d13eb2233740ac8cf0f92bdeaa169ebc5c745f3e76ee9fc67d2626160b9e01c5f5a19b8cbea605f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
2bc1dd350c94e591d20f1e12604dd520

SHA1
e1f3bbd863770f1c0cb4d6b98e318f634a3891a0

SHA256
5f4e14b74344bad1ccd3472765fa2fabf93f462f32f220e9475b358b14dd82ee

SHA512
08d8ca86b625a665b87b23611ca25b891312ce32ddd8072269659527f1f235ce87268c584cfd36936938b7ac2428a4cf71178a5c86b93ceb08bf1c53883b7945

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
8dc141a606610aaa9461917175242f3b

SHA1
472ecd8673ff69c48f3589c477161e10271ae332

SHA256
e291ebd978471c64cc654d858d3d5d69276516acdacc3a91b165d30ee4c79d99

SHA512
f3c073196c0791e10216c11bf0c0ee9e50c184ccd683876dd1f4d8f68592303a3ff604f23a537bd0258db59915e0c4c7e62aed21cf01fa9cf514dd9396b02806

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
dd354a0e3bc4ed43b31a91b0d9496d09

SHA1
d3dc3fbaa0873c95df83ea293d7af2bbcd0309d7

SHA256
0c7782e50d1527205845ca34d1017f5d5d838e1ee4be2bcb0037340839490620

SHA512
8bc82545d88c2a65e750231f3a92811111f22079e7ee9af84754a80090f9c40463829fe0a5284f01fddb2fd8fbf29bfae03f75aa6bed7f57b195321a799ec5fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e215b73e60fa014b7e1fdd6063d82fbc

SHA1
44bdd68cd9bb5d26b6e618e158499a2bdb8b7636

SHA256
2651f1afd28e1ac18f4143d64a0550a592bed5c253bd67a1d0980f32dd95ec0a

SHA512
def15a9870b9dd24fa58f006088f335a7de8541f5465cf6ce7293873ddcfb26ed784746d7b043e0c899d413f07dc2efc3ba8e2f5d4b7593922251ba700d7daba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2c1228e36b733843adf9ec702baf99f2

SHA1
e20bd81da05851dc391e6bef513f42d6c6e16676

SHA256
97523a3dd50b4b7cc180ab7cc0184dd5bb0a8a0b68f9af4a5a877d56ecffb8fb

SHA512
c77a04aacb7fcf10671c700e2e5dfdf909d286e9694a1d963b6b7bc8649df93cb40dc1b52dec7f8bae0848b07c6549babb419c490aaa470ff5a313680b28c4de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
e0926107c18f20ba4bc0eb67a3fa9357

SHA1
273f09a8440f8e125ee48ede2a98cf8eb53d3656

SHA256
7ef206fa8e81df049cc4b0492a931145a0b182aa193d38ec75be9d177035e813

SHA512
4b7bde50a636b76c0a53eaacea7bcb232f33df9e138c90b1be43731035230b2767183a6fa30278b378b5dd52c787b96a696f8984eaa3aa77d85e58844e115ce6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
dc15ffd00057dc2c34af6586e4816c59

SHA1
ea7b35b707ffbf347c811a9ba61178a0fab1ee5b

SHA256
722ad61bceced238efe56c0f8accd3f9bfcdb33131c84b1486c56d75316330e5

SHA512
a09082fad214b9bb19334d7bc8e4f514dce2f3219ed9e3a9db2ffe0358d474aff13c3e39de27fe48b35389c5585f6b08cba3bd00dfa296fe2b56c143a5c922db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
598dc09ce3ecfa6421d8252465b4751a

SHA1
f4b9998af028e6f5c22667db2766dc0d68cc10c9

SHA256
4ba32737c507a60bdbbdde38a8eabe37a434dc0523f48e443b56d2f75756cc4c

SHA512
a872bcd6933b265d49a327222dffa32f0ea2057da75a2eab02efad4262b196bd361b8315ba542bb78a554cb3cffb4ab6b4aeb2eec9401c9049938d540c554b78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
345ab42dd75ddff87fd2b5b3cc173866

SHA1
c9188cdc73f53d4eaf0f397add7031bbd33c7bef

SHA256
58048bc3343987d5a1179f95d69951eadf8f06a53e050e83a432cd11a2e12ef8

SHA512
d882e1dde1c1f6fda7310f8a4501d74e8a2485c2f36315adfe902e2ff9712386d7b7eff0fe12ca3b9ad1b22f0069e27403d54f51954f85ac6004d569cc65a17c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58681b.TMP

Filesize
1KB

MD5
8b60dccacf377238b5451a0e9cc7ad8a

SHA1
ccbd162ed5bad1820e988f3487a867487e7d4277

SHA256
588f7bd810ee5215438cb40427c98fd04a8b3d09d05a69d9dbaf99272d49eb54

SHA512
6428b6eeee968046afba6a90f474a79d783f7a72397925ed6ca1735b712dcaa0f7a23133fbf36acac9169eaba4cafc2f63a78719ab418592e62ee69acacaa4b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
caabf61093b6ef39281c92807ea1a2fe

SHA1
8c62fb28acec15bd7e2ecd6538039e09f83d9bce

SHA256
cf98b313cf3934c929a863b54f4e01a58305b776ef649d2c1e7293a9b761bd9e

SHA512
26b4796ca28bfac7e14c529fabbf31d4c04c1989ba79563600b9719baea8bad18ba51fcd6805136b019e4c772fc8b8e69be7f2613b07629447287be40954bb9c

Download Submit