hxxp://gofile[.]io/d/a1coun

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://gofile.io/d/a1coun

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2912	msedge.exe
2912	msedge.exe
2256	msedge.exe
2256	msedge.exe
396	identity_helper.exe
396	identity_helper.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 3600	2256	msedge.exe	86
PID 2256 wrote to memory of 3600	2256	msedge.exe	86
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 1456	2256	msedge.exe	89
PID 2256 wrote to memory of 2912	2256	msedge.exe	87
PID 2256 wrote to memory of 2912	2256	msedge.exe	87
PID 2256 wrote to memory of 1540	2256	msedge.exe	88
PID 2256 wrote to memory of 1540	2256	msedge.exe	88
PID 2256 wrote to memory of 1540	2256	msedge.exe	88
PID 2256 wrote to memory of 1540	2256	msedge.exe	88
PID 2256 wrote to memory of 1540	2256	msedge.exe	88
PID 2256 wrote to memory of 1540	2256	msedge.exe	88
PID 2256 wrote to memory of 1540	2256	msedge.exe	88
PID 2256 wrote to memory of 1540	2256	msedge.exe	88
PID 2256 wrote to memory of 1540	2256	msedge.exe	88
PID 2256 wrote to memory of 1540	2256	msedge.exe	88
PID 2256 wrote to memory of 1540	2256	msedge.exe	88
PID 2256 wrote to memory of 1540	2256	msedge.exe	88
PID 2256 wrote to memory of 1540	2256	msedge.exe	88
PID 2256 wrote to memory of 1540	2256	msedge.exe	88
PID 2256 wrote to memory of 1540	2256	msedge.exe	88
PID 2256 wrote to memory of 1540	2256	msedge.exe	88
PID 2256 wrote to memory of 1540	2256	msedge.exe	88
PID 2256 wrote to memory of 1540	2256	msedge.exe	88
PID 2256 wrote to memory of 1540	2256	msedge.exe	88
PID 2256 wrote to memory of 1540	2256	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gofile.io/d/a1coun
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa949546f8,0x7ffa94954708,0x7ffa94954718
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,16932184573266568409,9552886553191689277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,16932184573266568409,9552886553191689277,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16932184573266568409,9552886553191689277,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16932184573266568409,9552886553191689277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16932184573266568409,9552886553191689277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16932184573266568409,9552886553191689277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16932184573266568409,9552886553191689277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16932184573266568409,9552886553191689277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16932184573266568409,9552886553191689277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16932184573266568409,9552886553191689277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16932184573266568409,9552886553191689277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16932184573266568409,9552886553191689277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16932184573266568409,9552886553191689277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2748 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16932184573266568409,9552886553191689277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16932184573266568409,9552886553191689277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16932184573266568409,9552886553191689277,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3524 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
91746379e314b064719e43e3422d0388

SHA1
65f1a2b5a93922d589142a6edf99b5b35d986dba

SHA256
0b3cf8ae20afd84c9bf06546e876c84922cb5800526df72a628479f4d5487df7

SHA512
a783d8d9613cf92020fc36fd27d384dbd4e105a1ebd02c4507bf7263e61ff5b377e6d1734b066700782fa64bcbeb11af31ac3972d404625cbdb587cfa3bc0808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ccf8b7b618672b2da2775b890d06c7af

SHA1
83717bc0ff28b8775a1360ef02882be22e4a5263

SHA256
ef08e2971a9ba903c9b91412275b39aabfd6d4aa5c46ade37d74ff86f0285420

SHA512
eb550889db8c4c0e7d79b2bd85c7d0e61b696df10ce3d76c48ab21b935c7ecc7b12403a00d6570e7d8e4121f72747242c2358f8f0823f804e704bd44ed603b97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
7fe9dee74523c857d3f6e946b75570a0

SHA1
d67fb063492aae7dfcb1532aba775c72b8f7362d

SHA256
e31f86bcc9c26cc12a9cce1e8f654253561c5187362b4605473d886a338ee174

SHA512
8f2c0c016810bafa55bbda1307a5db3a0e8ea3cf6205de261da4d87f6cd90d31c466b76ef38f5d576a5368f537127349c1aeb8089ba1d3e569349668451c4bac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
02bee27fe38ae5052a73444af42af876

SHA1
4ebad094dc732d2361ce9f131a78450528678a21

SHA256
88aac34157abfcfc360716dd2e4dcdb4a862ede99ebb4ed5c713cf96e97f871c

SHA512
50857f087f81f8778fd23361dec541f94548f7082213fef10b782138bab7a03c368a1fba0824fe3943da96ab7a864fd1fa2851325bf74c06310ff31a339456e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
317B

MD5
f7882637afc8b3a8573ee92354ac52fd

SHA1
57f51eab9658e1b2125ceb9f2542b238638210ca

SHA256
f283cbe13d4f8e24cbcab3dd49e62a50d45ca40080cccdb55d2b7e0ec2d90ae9

SHA512
25dc3f0569e9e4e01d11b8362e068f19590b4f81dfec23c89beba2edca96436a150d31f4c747622ff9484939ad98bb2e7a0b3553fe7388f49b0d3fb24c4a6baa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
387B

MD5
8aaf30a359dd6926925210be41c0a93b

SHA1
0d1bd09d45e8ca335cd887e40d92333fa8f87f11

SHA256
eee55773a43d4d1ea309d1a88e950690fb0c4544baa9bd7c771b2738cac63cfe

SHA512
19112fb24f47037392d00fc3b20d93f0f9ffa3bd1a3bc27d656f12698fbd5d81a83cb0b7d05e46e290427f8e06e8ea6b41bbe01c948398f85eea37d3c395ed93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
00421df1c9b175e6cd3730f904bb60a2

SHA1
a4d8f0be94bb158f8b646d25d37a7a16f5578508

SHA256
86dacfa721f8c36919de4ac8026fb27eb95c92b3dd9c04a36ddedde5b732dff8

SHA512
39d7f1cef5f6a4e87656e595acc30d459b115b037104d9353d7c05ab1d42fc9d429ed5a05a2586d1a3bad7cbc9c85d44d2b9f0241c226b548e0563f7b46e4077

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d3e44fc894ef898606a99f2b624f34b6

SHA1
4bc72de66274cf0c49e6cb971d2347cb3580aae3

SHA256
9ba343f64e28d1a7f706ac10c8d1f7adc07d7d5e9336ff8780d3eb081fba9c73

SHA512
9b56ea4ac147ada76edd690f038549e3d00c1c3c7d4b59096cb649e2fab4e4e4e82f103fb3ba035b92023e8c667dde0eb1060dd4957b0c78217d177ff8ec31de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a85f4218df7e18441daef13ca21966c3

SHA1
af1395cd7b29d4b57833f0e18bfbff247d0f7f77

SHA256
dbc5c237ec11aa4fc67ea76753a1125d04d6c8f7f9128c4df27d6a24f7bfe4e5

SHA512
37123bad5a2c49fc73eb7fd90cc3f3a7988b9fe544c00904ad74a45185d7c32b01141ff3ed16ecb415f34e0c01e2bf275c828d3d9c552ec7af135ccf6db2c25c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4753e215c2161f206d707eaf2a20a647

SHA1
24ddf382710f06a45f9eb13f6e5e44fe5da2d3f8

SHA256
36146456b64961e5cfeb58ff93f206ef58e86b3be8376fc1aee1c125920e2fda

SHA512
ab16c448812947fe0bc26180065b5468545f5d5bdd46f09fd25b4572032e27b895a5784485620f8db2bf9471ad6bb36ae2525e3cd961b65a50dfc7ecba08f81e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
84dd5648d40d8f6121751f0853f9db31

SHA1
28d1fe8e9035a8e86d228075b0c7259b7ecbb8b0

SHA256
f488fe333d61fa15083fae7c9528574532ea6a912d25d81e721be4df7146c63e

SHA512
0dd917dbecad9ecb897a02eacf7a67a6e773157b5a7c209bff61ee6cf4112fe8f546bf5c960da1c25e30708db8aebee495dd0c1d8c5494f3853e69d1661ec7ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5864fe.TMP

Filesize
370B

MD5
69e2711aef63e59ac4f4b0620415419e

SHA1
0ee6ecedeb97f4dabd40d873009d52f7a65a6745

SHA256
931ac8ea7c4a6a4132d5dc21f9dcad1f7a9ecadb812518e4aa751f1e645d53af

SHA512
317adff49c0928fd326d3cab99ce5b564de72eb07f531f47792a1da0c0bd7341ca20075d3cf86f199bbb854858208451eef9bb9592c2167346fdfdf5ab9fa7bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
89035ee307b1a8deac3f6191df32d9ea

SHA1
a0996fc82379d26315647e647f6c3d4d736a4c91

SHA256
075bc7deb84d58cff5f48a5a2ba46f4c15c7a3bc33441045b0ccac6b9481a5fa

SHA512
315aec8fa9fac59b1f2c6a01bef9db3148f2274910e101e7943cfa71a370b7eeb3db00874fafca45ae735bea9f208f990f402f4db073aade3952c58983e70143

Download Submit