hxxps://apo[.]cuona[.]io/

Resubmissions

17/08/2023, 14:56

230817-sa6btsbf71 10

17/08/2023, 14:52

230817-r8vgjsbf6t 10

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2023, 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://apo.cuona.io/

Score

1^/10

Malware Config

Signatures

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1722984668-1829624581-3022101259-1000\{9EBCA52E-349D-4B22-9F20-24C1E80DD1B2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
4936	msedge.exe
4936	msedge.exe
4112	identity_helper.exe
4112	identity_helper.exe
1092	msedge.exe
1092	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 1900	4936	msedge.exe	82
PID 4936 wrote to memory of 1900	4936	msedge.exe	82
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1392	4936	msedge.exe	84
PID 4936 wrote to memory of 1648	4936	msedge.exe	86
PID 4936 wrote to memory of 1648	4936	msedge.exe	86
PID 4936 wrote to memory of 4848	4936	msedge.exe	85
PID 4936 wrote to memory of 4848	4936	msedge.exe	85
PID 4936 wrote to memory of 4848	4936	msedge.exe	85
PID 4936 wrote to memory of 4848	4936	msedge.exe	85
PID 4936 wrote to memory of 4848	4936	msedge.exe	85
PID 4936 wrote to memory of 4848	4936	msedge.exe	85
PID 4936 wrote to memory of 4848	4936	msedge.exe	85
PID 4936 wrote to memory of 4848	4936	msedge.exe	85
PID 4936 wrote to memory of 4848	4936	msedge.exe	85
PID 4936 wrote to memory of 4848	4936	msedge.exe	85
PID 4936 wrote to memory of 4848	4936	msedge.exe	85
PID 4936 wrote to memory of 4848	4936	msedge.exe	85
PID 4936 wrote to memory of 4848	4936	msedge.exe	85
PID 4936 wrote to memory of 4848	4936	msedge.exe	85
PID 4936 wrote to memory of 4848	4936	msedge.exe	85
PID 4936 wrote to memory of 4848	4936	msedge.exe	85
PID 4936 wrote to memory of 4848	4936	msedge.exe	85
PID 4936 wrote to memory of 4848	4936	msedge.exe	85
PID 4936 wrote to memory of 4848	4936	msedge.exe	85
PID 4936 wrote to memory of 4848	4936	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apo.cuona.io/
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9958446f8,0x7ff995844708,0x7ff995844718
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,2672980803582031933,1169502156331780748,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,2672980803582031933,1169502156331780748,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,2672980803582031933,1169502156331780748,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2672980803582031933,1169502156331780748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2672980803582031933,1169502156331780748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2672980803582031933,1169502156331780748,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2672980803582031933,1169502156331780748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,2672980803582031933,1169502156331780748,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,2672980803582031933,1169502156331780748,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2672980803582031933,1169502156331780748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2672980803582031933,1169502156331780748,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2672980803582031933,1169502156331780748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2672980803582031933,1169502156331780748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2176,2672980803582031933,1169502156331780748,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2176,2672980803582031933,1169502156331780748,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2672980803582031933,1169502156331780748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2672980803582031933,1169502156331780748,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2672980803582031933,1169502156331780748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2672980803582031933,1169502156331780748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2880 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2672980803582031933,1169502156331780748,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,2672980803582031933,1169502156331780748,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5248 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f6f47b83c67fe32ee32811d6611d269c

SHA1
b32353d1d0ed26e0dd5b5f1f402ffd41a105d025

SHA256
ac1866f15ff34d1df4dafa761dbb7dc2c712fe01ac0e171706ef29e205549cbc

SHA512
6ee068efa9fbd3c972169427be2f6377a1204bf99b61579e4d78643e89e729ad65f2abcc70007fd0dd38428e7cd39010a253d6f9cd5e90409e207ddaf5d6720d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
5c7533f667ed6044213e7f4d8d8008c4

SHA1
dd5f067803dd4d1bcaec9f041302b2245da98480

SHA256
437c2b31efbb7433210ae1621f564148ce9e41af3b4aacd0c68a871206dd3f92

SHA512
a4d5148e6f51beac28b5b5f47cb215be04666147b7a709476ea7db5205e4e358023351a82093cb5dfc5ddb0f472ba449c653868a620f4610ba7931847be7b526

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
557B

MD5
7ace2aa58e66cf50a8efad335dd97a27

SHA1
448bdaed16dedcf88e74115be934978b9876f837

SHA256
30cd7a84a1c4e5a0af7306b11cdd0f624c9f796cdef922c5507a44ecf4b133fa

SHA512
8374e1ddc8ba107d54a1f235cdbc926e4e43ae261d5c1d9b012cfce2a59ffc12a2a94ba784633148331b0e11048d6ddcd17f685c81f83eae1f7419ac383207e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ce907169592cc4991800b69d1866a65b

SHA1
93186a8f9dfa4b1fcd5f15a3dd592f55105906bc

SHA256
d2ca7b9bab9a1d0db77b8f7c8c646642251c5193492b9245006095874050392f

SHA512
0a09fa2b77ce5177c59f96afc0fd37d4ff4080d1b4cccc74a592251930c3f26312bcd6fa94289a4eeb2f799e98506b657f501e0e5c20630740491b7dff45c132

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fd099b20a5cde1d56614e6608a59132b

SHA1
358620e08aed8bc95a88fdca69e841cf80f84a5a

SHA256
74e17b148a2dba0c85dd6473d8c9b7736d66f4fd4d7cdb7fd20d184fccda4488

SHA512
c2b9413d790a03a124e431c7d12e4601e3ef3ab5201817c32b4304f8f23c9c73a45a6119029d5f1adbbb76b0a5fb020e0f3ee3e743f31eee95696c10d8b1bf28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ec4c228a95e1c71338a73d45e2465eb

SHA1
d5fb69ac0fecbb85c38ae176b99162001d9efd83

SHA256
1ab5de6d474e1c36d176bb0db1e74ab05ee8bdd08e96a1835193afb580559476

SHA512
873794c588eb36c3519e86a1be5f5011014f3e50627b564cb3625fb21a2ffe590dcd5569f68a817caab6feb8b98097999059e1840445443a9a8847e92d40a4ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5544c64f2a8f49dabc19eb84267b1c9b

SHA1
c5b78d63a8bab1c7b985f7ea2f268d0d7809071e

SHA256
a1fcfee2974a77e76a7431a2069db301861ab42dd41769cead8697f41f5a497f

SHA512
38c80d7c810441fc87beff38929473088cf426b0a25a30820d8a060f493350d99bb8521b314afe00578ea54648fce2aa4e55880a83a4f1048c56307991726565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
907ed690fb7a55de63b79530bdd3c492

SHA1
130126b2a577f9379c9e07f66ae033c08e9f1d32

SHA256
f476a0f0ade29717459edd2cdf1458d27e5631059c69ca8bf9b9128328fe5b21

SHA512
4dae23edfa7e6fd24f517ff27b0ceaa4f7b707424ecb67f7ef74831ab44cac54ae250f67e9e125746194e1639518a593d02bd2e8bbb1353034517ea7a05e114a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fdf7.TMP

Filesize
706B

MD5
58a0fef6a118473e8f4b3309f561c469

SHA1
be332ddddd70cc3664c28e6b41ff238f644fd110

SHA256
039178b164dcd64462cc95b1f0b5dcb66305fbf7cad29cefdc5c24830d7d46a0

SHA512
0b2528f8b01c366b14857ffb4767070a626afc545c5566a54f2271159df40ccdec321f1c1526b150089afde7b8322ad693f55230b5487d82c1d3608abb47cf56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1173752915195dca0097ad2ecbb4e7ca

SHA1
35415ded2b4fd397585811e06465b54358204f48

SHA256
044f9b471cae83b6393d764c47f1f6aaa1d7049f2408e13745bfaf0a03ed76ad

SHA512
e759d7af6fd7a816ae7e543a7c428d5d7e6885c7a6c87e805b14844956c9845aad3d8b6c0fee8aa509573ed2f8cd5b038266895912326d5d1952a3ee34c5daba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit