hxxps://www[.]epicor[.]com/en-us/solutions/technology/epicor-industry-erp-cloud/

Analysis

max time kernel
96s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.epicor.com/en-us/solutions/technology/epicor-industry-erp-cloud/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
3584	identity_helper.exe
3584	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 4732	5100	msedge.exe	88
PID 5100 wrote to memory of 4732	5100	msedge.exe	88
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 1432	5100	msedge.exe	89
PID 5100 wrote to memory of 4564	5100	msedge.exe	90
PID 5100 wrote to memory of 4564	5100	msedge.exe	90
PID 5100 wrote to memory of 1792	5100	msedge.exe	91
PID 5100 wrote to memory of 1792	5100	msedge.exe	91
PID 5100 wrote to memory of 1792	5100	msedge.exe	91
PID 5100 wrote to memory of 1792	5100	msedge.exe	91
PID 5100 wrote to memory of 1792	5100	msedge.exe	91
PID 5100 wrote to memory of 1792	5100	msedge.exe	91
PID 5100 wrote to memory of 1792	5100	msedge.exe	91
PID 5100 wrote to memory of 1792	5100	msedge.exe	91
PID 5100 wrote to memory of 1792	5100	msedge.exe	91
PID 5100 wrote to memory of 1792	5100	msedge.exe	91
PID 5100 wrote to memory of 1792	5100	msedge.exe	91
PID 5100 wrote to memory of 1792	5100	msedge.exe	91
PID 5100 wrote to memory of 1792	5100	msedge.exe	91
PID 5100 wrote to memory of 1792	5100	msedge.exe	91
PID 5100 wrote to memory of 1792	5100	msedge.exe	91
PID 5100 wrote to memory of 1792	5100	msedge.exe	91
PID 5100 wrote to memory of 1792	5100	msedge.exe	91
PID 5100 wrote to memory of 1792	5100	msedge.exe	91
PID 5100 wrote to memory of 1792	5100	msedge.exe	91
PID 5100 wrote to memory of 1792	5100	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicor.com/en-us/solutions/technology/epicor-industry-erp-cloud/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe83646f8,0x7fffe8364708,0x7fffe8364718
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,197310920889006073,17580078203792702618,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,197310920889006073,17580078203792702618,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,197310920889006073,17580078203792702618,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,197310920889006073,17580078203792702618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2844 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,197310920889006073,17580078203792702618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,197310920889006073,17580078203792702618,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,197310920889006073,17580078203792702618,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,197310920889006073,17580078203792702618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,197310920889006073,17580078203792702618,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,197310920889006073,17580078203792702618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,197310920889006073,17580078203792702618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,197310920889006073,17580078203792702618,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,197310920889006073,17580078203792702618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:6044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
22KB

MD5
ecbc2176c50f1a278be48914e1b077f9

SHA1
ee80e38f76ea5bba69addb3b17b8c6cf6f868829

SHA256
a72a3b6211a20f24deded944528234cec5850e63588ba737f8f1280d270e5873

SHA512
1806e60b8278f9fd696c473d204adcb7bfd96de9f386509d2bb1716b51c2a9a92c42164a00a3e7799728b4370f61ddfdc3493ac96ba9120c7fd2de4c92b6ba56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
18KB

MD5
b3bca1058d30884416ff58b4fd95a9f3

SHA1
42076b1b17332aa559d95ab6860c97dd88860f04

SHA256
6cec265f1d946ea04f9d7e1ca14c1d9a747159109edab4a4abc2bcebc439aa0d

SHA512
c9517aba6aa8e441967321f6525e45eebd9b445fb15ed434a824236206514d0645cd45cb098bcda4c7cee4d91aa3dc11a876d9e637debbc78b17f8f2d7817ecc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
19KB

MD5
548432ed137182a28bd7d5123e0c949b

SHA1
2944a8b28bca38a0c8d119bd11e9887b2d074145

SHA256
f26834f434eb45d191b90750b776132602f87f50e0e9813a6a54f9795699770b

SHA512
28c6bfd2f4669c4147194ea21e648c0c2ea5ab2caacb81b51c317c927fc48c19a28fb8389762de7fed83b37b4eacc7680783aee32a9002217cbe8ab9cc68ab15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
27KB

MD5
0ea168851cec9bece6f6beaa664d2c7e

SHA1
be9fbe240f7af382d709d7cbce1a37b664c5c719

SHA256
242294d8449eddb708d01d3de7e2fb58ca2d9c7bd81fbea55c21a955b3e4e29b

SHA512
dbc14de7c927ade66eb8a5d574bfab229b6b8291bc9c45855568359a9151ff4aa1c488e67728e559ca409d796f9230130454d646e1ec3d3291bde3f1481caf83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
33KB

MD5
8802997e232ee8fb611eaf17dbac4173

SHA1
d51c0c923c93224442aad4d7c7637b85a74b2db5

SHA256
23cce557360458fdb156a8b4752aa5a4e5a77dcd3b46ae914a9fa9b894ddfc47

SHA512
1629deda21aabe41a7216e2ba7cf0e9837d4e36ea02a60362a4008ef29d9c96913d46ef1cdae44288f323e826fdfba90d3b4c4c70720b1493aad2aaf15aa27c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
24KB

MD5
bf6e79303c947442d68adc6f4211032c

SHA1
8d7ec41546d04caf1df38f4a519c4b2ff406cd4d

SHA256
158a7f41816a541da8fa7ab8c5cd1b71f0c215798b956c9d53a6d113ee60f673

SHA512
e244950c1803944c919c4a1ced2b5e57dad2d7da3d5be865ee4b310cf2e0f4b86d02dd5b23b53798d4d76c43d56607333e018811167d992fc56dea01780be582

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
23KB

MD5
dc9a173e999e4f30de3938f5ba8a00e9

SHA1
0e4bd44be851ce56951d003bde6991e60ec73c1b

SHA256
10be5b42d5ede270f02800d80d12c2af876c0fc0648fffaa4169b654c075254d

SHA512
be4782491da011cf1e683f7e5c59b5dddfdfcd954b69baf3a608508e7189486a9011f54d2df4fff4788e2694b158d909362a80e6bf707055c5def45d9fd8fe94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
67c7e8bff1e63f8b60b860d5e59c5e45

SHA1
6447d4c61492768e6feb0cc2ceb92916a879fa4e

SHA256
c29e091efc4bc68a4ba42638ece9cfb2b7dc76251110d1b642152f5bc2201ef4

SHA512
bff71d6d51631ed5985f9c40dbe0399979135e6ddf8af25604bd8a7546c217e7a7e6c95cbe9bb5b79a138f0ca40d5a1cd3b955dba81713229aff2291b7488333

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
973de468e9948eea199b72eefe559bc6

SHA1
430f0611cdd07fa19b8fad136cd4892e837b0a9d

SHA256
e321808c4ebf5fb9d69a8b491d06a03e2a50121726a28d370b7fdca3b82df96c

SHA512
06361aa3b1e5d089c8dec014d33cce62bc6bdf0cf0f7591790ffe88de21ec74864cd066684b0ced4637df186ed8b829d489ef88f75ab0e0fbe7ebdb703595201

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
38074d9998d32bd79cfb9aae4f2d538c

SHA1
716f437cb3b26896df39f3b9556640fbeaf4bbe0

SHA256
a1cb12938d3af0671c2bd16baf068dc3869765e274784a053922402224ceb369

SHA512
881121ff8daff430cec363d6e11e64de3f7776b7e12a9c7b37ffe16903d4f3fa6eea69a859491549374d69d50a15afe9900e912b313a03a09a7ad4068125bf21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
41632fc3977a1c063c4aecc24a05b3d2

SHA1
dda195a0c27cb25c937459c7d482d7275cf1cc88

SHA256
ad1d89cd5be5813d957ccfa79f0fceb91fed1f0a69c5e332beeb15bfbdf06a80

SHA512
2464461c0a2fa45c1b289bebf8a37a6a827cdba5f0b08cf70241456301c9540c12f0d5c182ee3dd1cf162d4bb54f18cd6f1c84ae0c93d9ae9d36a4f76c5c34c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
dee3e990abfd05e91bc950983f65083a

SHA1
c5b64b5467270b78d6a0515843e52f0763859176

SHA256
954b74e6fd71b8406113d771d79324a21e594559f435f650c3c4a344b0158845

SHA512
b0df9999de7e580903baad8d53255c1c0fbbc4a389b91677079daac63756756c9b60921f0e4da8e5b54fbff92f8aa2d648d88ed74d2bcefe95afd5a55a414707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\6052ebe54fc82031b107ccea192f8e84553034c7\index.txt.tmp

Filesize
157B

MD5
5ce86399893691c6f316b599334bef82

SHA1
3cb2100b9377509c3f798b783e6b2b47b0e8adac

SHA256
e3cdd56ab6a28aa01857547e40d56808a5600680e3de5fdedd8aa91ff7bdf455

SHA512
43eb0b04bee2f9ac6f9ae6af1ada4b6adea4ffd1ef2619040087ee604a9d1bf42bf25bef523f7adc0074f6a0946bd152fdf7e7d57396d40047e0bb326fe530cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\6052ebe54fc82031b107ccea192f8e84553034c7\index.txt.tmp

Filesize
150B

MD5
578d1c67d6afc1aa708de8f00d47d4dc

SHA1
05f3a271a9dc8dfbae80e02dce5949a22005a5d2

SHA256
c10d6ccb3cc464c1ef6f6bfdb8696458fa97d0699f42b2859400441a9a70a533

SHA512
87994a0b5cb42edd8ea34e8ada906c171af0eb00128e3499288de33dad32dc3f19d77d6ea18a2cb588429f24b7c71f8c9b090547f334f82ba8591738a6886532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\6052ebe54fc82031b107ccea192f8e84553034c7\index.txt~RFe5768cc.TMP

Filesize
91B

MD5
8bd23f5dd9a015dc2f61518b350b0b2b

SHA1
3965e49789640836c079101d6cd75002899800f0

SHA256
7ab11f1bf181be4e290e3fb4bb0b4301be2d3ac514ef757c8dacc435b03bc470

SHA512
569a225a8b307162feb1040a0ce46221dff743bb7637e5f9ede7bada0db28bc3998f6922994faf380a397e8a9ad92b6d5b68e3bb4c26a0b7d56736f67c73ecac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
07e7823243495d1909a85575b48f8d46

SHA1
1abaeba12c12c4bd91cb8f5042e81fc9937ca305

SHA256
a0230c693326bd37571b5addb1f9f9b7638a57211a00d92529d050b20ead7c6a

SHA512
ff3fa58ed74dfa9ae5f274146f3e5c0e7f086bb9e5c3ca856f5795926900f50944fe114fe4431cdb66e4b214b5fa820b031911d40e3d8ba284f96165bf4f9037

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
71380e3fedddbec3df473f6adf62be89

SHA1
b7651ed9bfad22eb596d142d8e0a312542b49bd9

SHA256
d369e8d173e5f0c5f46fa0ce1eba7b84542723b8089c386c4f094a72e327768f

SHA512
11ca9623133894d429237769a742e6438db38292580632a882b7a7f0bf5534759379bb4efb636ccf76803099036380c340b4c0002d768bcf4f5c6aa5d38fa127

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
ba1c0684ab3ef8a0e468f9b1474190ed

SHA1
9e740b8e008b761d05ce10060a1f143369f65936

SHA256
b406dde774964286528c472f0c0fe2bf25ada154daaa4601361d5162df962fbf

SHA512
b387744a6fc828ef5d5039d047025502d3a3d057cce7817cb9e64fa229944c098fd5b3f647bd11675be727261cb05b5930295b99bf4184f181a4d188611537f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
86ac30c998765692c7839e59833ff342

SHA1
c2dfdb8baa42fe0d6d9b45d79ae66ccd08859491

SHA256
65e2a3187974d3c512f8857b4067f2a97f0c4db29643d8269145bc08edd6cb6a

SHA512
8e504f8e276d43a90b085fb88a74f8fb792c85841d83412b97014ea08cc8b234fb5d4f221d3d68705a03e4f8e3f7c5dd1b8a2f1bbd0520d4482a4ca88b8f38b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
9be1ea2ab0b589b823ba09c61f56a526

SHA1
a54c227388687c1fb30a3445b910caa93cb61847

SHA256
8f1c365fec6ee92fef4639055040b8103f15e0b8be730ef693323e8e87d9281e

SHA512
12c0602fe7e8e89b6d5d45eac4e8ec64977e71f1731a6b79bb8bedffc6d28def0b157dc20f8ddc4b5125c49c1192893d2dd7970c06f2aa7d2d798e5b072b7455

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579ab9.TMP

Filesize
2KB

MD5
6e31b7bb57c0217780ca92d184bef5c9

SHA1
433544285a9c474f2880efd1eaf76e82180f6c64

SHA256
89f4d5c44c883192446f927e5188ec091cf7b5956e92e72607932e334481827a

SHA512
e7befb314f5aec3d53f0aa265f1ecc87ab85518bd31cf08c1c4b558920749ab87e1f4ed59efd8e5a03dc291591f2251ffd669adff2e361a920c00c48c1cd42e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6f2458e7d0dcf15d3a46c808831e4c0a

SHA1
da2bc504aafe2b6f512144b013d09b315f8ca72b

SHA256
e859c35914c0138ad0225795de57092f574a9b4ab9c04e6cdfd1bb375d190b46

SHA512
f5980962980a0a7d9f6dea2bb89c5c7625fb5dfe4743a419f194ee1333d9771759395f0665e8b9912621d0b0c66f4f243f609533b1f2b8d0c7ef6249353e6fb0

Download Submit