a087a5a0c8cfb78baf89e0bbc1c5cb456d629f7e7648b04bef293f7a19c9181d

Analysis

max time kernel
1795s
max time network
1761s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
17-02-2024 20:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Kugol.bat
Size

465B
MD5

7d417bd8c8727f34b05eeef034f43810
SHA1

610e2aa20fd7af1fc813f0bfdca8caeecd8cc8c7
SHA256

a087a5a0c8cfb78baf89e0bbc1c5cb456d629f7e7648b04bef293f7a19c9181d
SHA512

0995f713ed0169cb073ea58d04d82ed82793ae6e97a55bc3cf3eaf915b9e616ca41b7bfcafd9cfe9619592eda98c3f69c792795d225cdda8570c638f753f7779

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1260	msedge.exe
1260	msedge.exe
3740	msedge.exe
3740	msedge.exe
2564	identity_helper.exe
2564	identity_helper.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 808	3692	cmd.exe	86
PID 3692 wrote to memory of 808	3692	cmd.exe	86
PID 3740 wrote to memory of 4888	3740	msedge.exe	96
PID 3740 wrote to memory of 4888	3740	msedge.exe	96
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 5072	3740	msedge.exe	97
PID 3740 wrote to memory of 1260	3740	msedge.exe	98
PID 3740 wrote to memory of 1260	3740	msedge.exe	98
PID 3740 wrote to memory of 3552	3740	msedge.exe	99
PID 3740 wrote to memory of 3552	3740	msedge.exe	99
PID 3740 wrote to memory of 3552	3740	msedge.exe	99
PID 3740 wrote to memory of 3552	3740	msedge.exe	99
PID 3740 wrote to memory of 3552	3740	msedge.exe	99
PID 3740 wrote to memory of 3552	3740	msedge.exe	99
PID 3740 wrote to memory of 3552	3740	msedge.exe	99
PID 3740 wrote to memory of 3552	3740	msedge.exe	99
PID 3740 wrote to memory of 3552	3740	msedge.exe	99
PID 3740 wrote to memory of 3552	3740	msedge.exe	99
PID 3740 wrote to memory of 3552	3740	msedge.exe	99
PID 3740 wrote to memory of 3552	3740	msedge.exe	99
PID 3740 wrote to memory of 3552	3740	msedge.exe	99
PID 3740 wrote to memory of 3552	3740	msedge.exe	99
PID 3740 wrote to memory of 3552	3740	msedge.exe	99
PID 3740 wrote to memory of 3552	3740	msedge.exe	99
PID 3740 wrote to memory of 3552	3740	msedge.exe	99
PID 3740 wrote to memory of 3552	3740	msedge.exe	99

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Kugol.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffec17c46f8,0x7ffec17c4708,0x7ffec17c4718
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,13492572169594927894,3103025023705756774,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,13492572169594927894,3103025023705756774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,13492572169594927894,3103025023705756774,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13492572169594927894,3103025023705756774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13492572169594927894,3103025023705756774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13492572169594927894,3103025023705756774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2264 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13492572169594927894,3103025023705756774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13492572169594927894,3103025023705756774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,13492572169594927894,3103025023705756774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,13492572169594927894,3103025023705756774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13492572169594927894,3103025023705756774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13492572169594927894,3103025023705756774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13492572169594927894,3103025023705756774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13492572169594927894,3103025023705756774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13492572169594927894,3103025023705756774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13492572169594927894,3103025023705756774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13492572169594927894,3103025023705756774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2864 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,13492572169594927894,3103025023705756774,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13492572169594927894,3103025023705756774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2088 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13492572169594927894,3103025023705756774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13492572169594927894,3103025023705756774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2960 /prefetch:1
  2⤵
  PID:928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bcaf436ee5fed204f08c14d7517436eb

SHA1
637817252f1e2ab00275cd5b5a285a22980295ff

SHA256
de776d807ae7f2e809af69746f85ea99e0771bbdaaed78a764a6035dabe7f120

SHA512
7e6cf2fdffdcf444f6ef4a50a6f9ef1dfb853301467e3f4784c9ee905c3bf159dc3ee9145d77dbf72637d5b99242525eb951b91c020e5f4e5cfcfd965443258c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cba0fb45f955784232981374898506ff

SHA1
ef93ce4d66c46d5690de3d7ae3ce95093f170d16

SHA256
37cbd38e137d22f6124c30a203ccfce57e3c8063e77bc9eb38068558125ff739

SHA512
70d13a8900a48d0412a0f205bfdc932d1a2a1b61a8abe1d0d8890e6cbd653c4bc5dfc7d00834d6cf97c29007af85321eb97e0a3dd381561ae8a5fdabc871d396

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
717ae197f8d781f17c6d9ad741b0645c

SHA1
eaecacc460d7b8ec5a03967c35988893bf060d3f

SHA256
31cfa5cb2c17ad4f3d642c4d9e680468ac20ed87fba2ab28560bc23124034ee3

SHA512
5e9949cfa056c3644c6f7741b3ec173fe28d7deec10c2daf856c2803fdbc24e3eeb87301514f4e84c4e53ab683fad78700dc8bc700c3fba4edc4eecc1d051c15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c979fe92e840fdac26e7a04b8fe6e2c8

SHA1
603501e7854ffc142b780fadba9047514cdce66a

SHA256
58c0276472b4c62247a65654d0e8a7c1096c024e0cc7c80af1f23b6fbc4af532

SHA512
86fb5282771d0864447fbdbd087e024b450a1542762cb5246a4b6aa1be2f12359d66857a7ce101a5d62d92c4454ffea26a894c572d2b6013911c297c2d7719e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
dd290d25ae37dd472315558d90431990

SHA1
2ac3d95f7bbed537119df1c05fda9632b662606e

SHA256
e77eb47b8884c7f8662917c5625d9e098e70f86bce6339e7c73c213a5ee3dd50

SHA512
5b5fdae16655a252b597cbba526e744c281fa24cb6b7932e9c4c482f721d30700d065f2f74d8f69d76a4433e29e5fae0cc6c5a16e8cad10b657fdf7c184c3d78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
c2c8151860e3aefd08733ea2c09527c2

SHA1
9b8fe2444024596222fc2c16b2ac8c56855373a6

SHA256
e189e50c01516ef3d23fc14926f823956e9e64ec441b361a89806b9c0f12f7ed

SHA512
5a6fbb3ad6c93fb9873917dca38803b8acb20ab88b83803e693846ae73d94327b113fd6aa4607b6aecbccb6bc699c16eee60a809ef86b04e32ec2d2e8a7e56bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
fa76880753b7cf742007f8e0cc31a90d

SHA1
d49fff935edf5dbb05ab58ef09161d255c4b79ed

SHA256
b0c3018df9e1457813fd647b55456a20041d2584d32b7d334cb10ca67b9c800f

SHA512
5304ef4df2e66d93bc4e6b97b7adc15d78a35705fa668b84c8ad359d3dfdcef5f80345d3b2cbfb9e3a116acb41f93c66689fd7f990a96c76ea608d9bc68ddfde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
9cc6ef9811fbf70ac344a340cb4d0f0c

SHA1
70959bb7bea5413b1675c458eafb8ee38240f42f

SHA256
43ef11e889b52a46ff2400d9a3b3af780e9f2fae866422992dd44cf531ffc5d8

SHA512
5f9483a7d7d1eb4c3136fc5d78edc43a4b00758b7d79f0d264d3fd197e9897335a74e8fc5ee824c2d3fd90b4cd4ec1849aa67821e051537be59c930bcf163477

Download Submit