asyncrat | hxxps://gofile[.]to/b55d/gyat[.]exe

Analysis

max time kernel
51s
max time network
56s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
24-11-2024 11:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.to/b55d/gyat.exe

Score

10^/10

asyncrat discovery phishing rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x002800000004525e-277.dat	family_asyncrat

Downloads MZ/PE file
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: sweetalert2@11
phishing

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6801a5ad-5b05-4d7b-9d0e-83bcb1e319a4.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241124110553.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 557933.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
2556	msedge.exe
2556	msedge.exe
4912	identity_helper.exe
4912	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 1464	2556	msedge.exe	80
PID 2556 wrote to memory of 1464	2556	msedge.exe	80
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 1644	2556	msedge.exe	81
PID 2556 wrote to memory of 4252	2556	msedge.exe	82
PID 2556 wrote to memory of 4252	2556	msedge.exe	82
PID 2556 wrote to memory of 996	2556	msedge.exe	83
PID 2556 wrote to memory of 996	2556	msedge.exe	83
PID 2556 wrote to memory of 996	2556	msedge.exe	83
PID 2556 wrote to memory of 996	2556	msedge.exe	83
PID 2556 wrote to memory of 996	2556	msedge.exe	83
PID 2556 wrote to memory of 996	2556	msedge.exe	83
PID 2556 wrote to memory of 996	2556	msedge.exe	83
PID 2556 wrote to memory of 996	2556	msedge.exe	83
PID 2556 wrote to memory of 996	2556	msedge.exe	83
PID 2556 wrote to memory of 996	2556	msedge.exe	83
PID 2556 wrote to memory of 996	2556	msedge.exe	83
PID 2556 wrote to memory of 996	2556	msedge.exe	83
PID 2556 wrote to memory of 996	2556	msedge.exe	83
PID 2556 wrote to memory of 996	2556	msedge.exe	83
PID 2556 wrote to memory of 996	2556	msedge.exe	83
PID 2556 wrote to memory of 996	2556	msedge.exe	83
PID 2556 wrote to memory of 996	2556	msedge.exe	83
PID 2556 wrote to memory of 996	2556	msedge.exe	83
PID 2556 wrote to memory of 996	2556	msedge.exe	83
PID 2556 wrote to memory of 996	2556	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.to/b55d/gyat.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffecb3d46f8,0x7ffecb3d4708,0x7ffecb3d4718
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4817626405881684676,13134902999660487564,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,4817626405881684676,13134902999660487564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,4817626405881684676,13134902999660487564,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4817626405881684676,13134902999660487564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4817626405881684676,13134902999660487564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4817626405881684676,13134902999660487564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4817626405881684676,13134902999660487564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4817626405881684676,13134902999660487564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6ab045460,0x7ff6ab045470,0x7ff6ab045480
    3⤵
    PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4817626405881684676,13134902999660487564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4817626405881684676,13134902999660487564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4817626405881684676,13134902999660487564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4817626405881684676,13134902999660487564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4817626405881684676,13134902999660487564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4817626405881684676,13134902999660487564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4817626405881684676,13134902999660487564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,4817626405881684676,13134902999660487564,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4817626405881684676,13134902999660487564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4817626405881684676,13134902999660487564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4817626405881684676,13134902999660487564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:1672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c29339188732b78d10f11d3fb23063cb

SHA1
2db38f26fbc92417888251d9e31be37c9380136f

SHA256
0a61fa9e17b9ae7812cdeda5e890b22b14e53fa14a90db334f721252a9c874c2

SHA512
77f1f5f78e73f4fc01151e7e2a553dc4ed9bf35dd3a9565501f698be373640f153c6d7fc83450b9d2f29aeaa72387dd627d56f287a46635c2da07c60bc3d6e2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ccff51f965f8f4176e4ad112c34c86a7

SHA1
eab249ca0f58ed7a8afbca30bdae123136463cd8

SHA256
3eb00cf1bd645d308d0385a95a30737679be58dcc5433bc66216aac762d9da33

SHA512
8c68f146152045c2a78c9e52198b8180b261edf61a8c28364728eafb1cba1df0fa29906e5ede69b3c1e0b67cfcbeb7fde65b8d2edbc397c9a4b99ecfe8dea2dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
38f041731ec2b7e71bdbe702d8f37a7c

SHA1
c7ae2b11fe27c11df5679007498eef0f1eada4bf

SHA256
8b8270f8c6db05d9dcbc10ce45182a546cbc4b9d78dc02c968871046458528ae

SHA512
2eaeab1b48131b15186fc44a80d5b5cae5fcbfe5c872510acce6b26143160c9cd46db9c05fdb1812732d393ea71b028b0c57efcdf35f43fe3d54dc6919552f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
d4f8c62df7f4293863e3ede6cb2f1092

SHA1
5a772a79d86630f7c2cea1351edbdbe8867cfe25

SHA256
1c7b93e36333cd652f16f90644a3c7d89b16e0e9b37629c3f801bd554c946601

SHA512
444b9e72368af9218f7ce7856fe582ce3e15c0eedf55dff2b2da62981570f2c78f8ac5b70fc14781138e47200d8aa9fd86b8b5dc9ce1be2ac6850e4f5055dad9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
745ab779f0ac846c5ea0db1e2250dc80

SHA1
766a7d296e28a10d06016ffb52ad170cb011709f

SHA256
981d8bdcde960bc72d6e6e1d704ec077a2bcba15431ff42b78dd05594715f479

SHA512
d8a4d05c914b1ed35c4faa2a2cdd95de5f89da6a5ba015333e10ac40f9b1126ee6e5c336b07fb965fcf0202e8c35e3f641d8fc32957ff211a569f3e2070c4eb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9bba5d528854af1a0dedef263dcfa5fa

SHA1
77cb48e28bd78bc03d5ff39843af2ead5d8cf450

SHA256
b82f8fa87ddcdf435174388adfd6dcfda6e47ea05d8424d07e4b9c0ac4622755

SHA512
e169416768220002eff1c1665415545c042f7f5def960fafaf97d2b913ec694ebd66e2a34093691c8c1a9be2ae5b4e3b2c344d9dd26e78b7ac43c35a87e6cbad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3282878577632f845e37e2dc9c252b66

SHA1
65064748e4c1148ee4073cc198eb6d622d478b59

SHA256
84af51dfbf00741c8ae9039f3924c1fec241d5d40a819c674c74f28f35534dee

SHA512
8e34e43f9a971059e67dde571cab2070b252453401240a5b2e951b6919415ef1b58f50fd436ce23568afb2cccc73db13528deda9161b87d66fe34cc21b9cd813

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
86aa28ffd286b08415aa197216684874

SHA1
d99924976c73e3220108817ad6bc1d8b1795ca2d

SHA256
a6dc4bc6ade3039e57b538f2620b91602199f1908b23c4a2beb3fd3aa721579d

SHA512
a51fbd1af778d32f2f95a9a863a59f42a7eb804dbb8ce85459297959eea21fbfe9625d74c3f91ad65016031d4b3e26eeb748c1c59e09ac68778fc670d408d0fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
26978f38b0bce48572b90b762b7d937c

SHA1
8b8b88012fab1d37fca79575a5db81674b424867

SHA256
b38f05e2e63a1f87026aed06f5b85354570c6f91d28947466f0555276bab6afa

SHA512
501e0de5f46bfaac901cde5c39a321edc411426fd91c83427f36710fa56d20b5f6ab8f2219d963f7ab495c2df7def879652381db3876b7e2a7080921cce78379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b8df436a7f370631b94f02e12785d6fd

SHA1
905e83c1445a69cc583ac65809d7bba24bd2d775

SHA256
8e6ceee1bba8984f39c767c9a4acf195a95788fb1ad738b4d665c0e2d2e18609

SHA512
b75a876af69955f03a8dda7496100b0bd829b90ec0f37a2750a960cf7049531e8e648d1d28ed24e80eb5559c3ef41a27ebcac51ee121fe6558e97fb7cda58436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58319a.TMP

Filesize
1KB

MD5
d1908e53b890d49f363470f46768a18e

SHA1
13f173b579d9260a545a3ac6e5816c5514251cbb

SHA256
6028b441cc42131ff48302b10fa48244a330dce046de9b6aef283b1cc42d3328

SHA512
87d61df9844535fcbcddbc3e020ac38d7a51410001f17688b833a4aec698c2f51c45a72895fb2e3d3286574b5b9577231a65cbe7bcbccdf51fa513d0e6bdae67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d16ed5b15e31e78d747cb1801b2376fe

SHA1
2a4d8746f45252a3eacc1ed7131ec285abe1d8bd

SHA256
c58e899399ba60d3a30e873f2516b7f6064368b51280bbebd0e159131720cf56

SHA512
ef162e7de41ab7eb0a943f39d8b5ce3b3de442d23b93cd76b374ed130d61f4edd3788ba381752b8e67dd89bb14519094f2b853d568c1c30dc6a7f16bcce10748

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
0aded50aac42504fca4a270810d7b222

SHA1
e31304b1d8398d99d61eb4b49613ce35e1fb17ad

SHA256
cfb90ce978e7c678e9fe35b4384bfe5a068c382cbebed643cd342f6fc5821c40

SHA512
3a6169a5b3c0c9417697cfa5ea302588018367814a7563ed11b3f415ac028d4d3b08f84cfe696b35d2c7bf5bb92722e0345ea521f51a1498dbc56293d62a1bfb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
2adcb72aa235ef475ce2ca856576de66

SHA1
4d18d6b86a31f48f6f1fd9f94ec4ce57140da288

SHA256
ecaf38cc901a1261f2eca55cd98424885827f6638804b76bfdced2616e58ffc5

SHA512
879a327d99cd0712b7bf85b0a06e4cdf7d23c4e2bc321b95aeec87c5ab046f35d8cc3c7ed475e7305a98bbf4b6827da33cec42219d1b4ae2378321c4a193fab2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 557933.crdownload

Filesize
45KB

MD5
2541779f4721f47090af7740e951fa2b

SHA1
7a7ec8a327d2facb1c02b1ce1354b519e6159d0a

SHA256
b559a8fc40ac83843685fdb8735f445a72dcfd4fc5441b33ad8332e1e1bb52fe

SHA512
c5e2527547218ace005df0c9e3c8ff6d50a562af4a89ae52b0fed1d9c65c305051d9516831957197d57eb7cd2a8d2732af3b5a5c5994730f4d33c0f7d0031d86

Download Submit