hxxp://email[.]csapp[.]cirkle[.]studio/c/eJxMyT1uAyEQQOHTQLniZxigoEjjewwwyCuvDQK2yO0jd6menr6aqgdyKDlpry06C-DlM9lgqKCJ2WtUxXofcqtWa6AAGg3LM8Vgq2NGX0BF5RxGhREbuFK9QxUEqLJojKOc83XxsfZdzy6v9Nx7LGF_hHkI8-iDP2-aL97josK9NZ6fto95f_F7_ypnopWJVu53JgHql569H6W__wIAAP__Sxo9rA

Resubmissions

22/04/2024, 08:26

240422-kb1tqshd57 1

22/04/2024, 08:23

240422-kagpgahe2w 1

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://email.csapp.cirkle.studio/c/eJxMyT1uAyEQQOHTQLniZxigoEjjewwwyCuvDQK2yO0jd6menr6aqgdyKDlpry06C-DlM9lgqKCJ2WtUxXofcqtWa6AAGg3LM8Vgq2NGX0BF5RxGhREbuFK9QxUEqLJojKOc83XxsfZdzy6v9Nx7LGF_hHkI8-iDP2-aL97josK9NZ6fto95f_F7_ypnopWJVu53JgHql569H6W__wIAAP__Sxo9rA

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe
2952	msedge.exe
2952	msedge.exe
2528	identity_helper.exe
2528	identity_helper.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 408	2952	msedge.exe	86
PID 2952 wrote to memory of 408	2952	msedge.exe	86
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 4524	2952	msedge.exe	87
PID 2952 wrote to memory of 3960	2952	msedge.exe	88
PID 2952 wrote to memory of 3960	2952	msedge.exe	88
PID 2952 wrote to memory of 3160	2952	msedge.exe	89
PID 2952 wrote to memory of 3160	2952	msedge.exe	89
PID 2952 wrote to memory of 3160	2952	msedge.exe	89
PID 2952 wrote to memory of 3160	2952	msedge.exe	89
PID 2952 wrote to memory of 3160	2952	msedge.exe	89
PID 2952 wrote to memory of 3160	2952	msedge.exe	89
PID 2952 wrote to memory of 3160	2952	msedge.exe	89
PID 2952 wrote to memory of 3160	2952	msedge.exe	89
PID 2952 wrote to memory of 3160	2952	msedge.exe	89
PID 2952 wrote to memory of 3160	2952	msedge.exe	89
PID 2952 wrote to memory of 3160	2952	msedge.exe	89
PID 2952 wrote to memory of 3160	2952	msedge.exe	89
PID 2952 wrote to memory of 3160	2952	msedge.exe	89
PID 2952 wrote to memory of 3160	2952	msedge.exe	89
PID 2952 wrote to memory of 3160	2952	msedge.exe	89
PID 2952 wrote to memory of 3160	2952	msedge.exe	89
PID 2952 wrote to memory of 3160	2952	msedge.exe	89
PID 2952 wrote to memory of 3160	2952	msedge.exe	89
PID 2952 wrote to memory of 3160	2952	msedge.exe	89
PID 2952 wrote to memory of 3160	2952	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://email.csapp.cirkle.studio/c/eJxMyT1uAyEQQOHTQLniZxigoEjjewwwyCuvDQK2yO0jd6menr6aqgdyKDlpry06C-DlM9lgqKCJ2WtUxXofcqtWa6AAGg3LM8Vgq2NGX0BF5RxGhREbuFK9QxUEqLJojKOc83XxsfZdzy6v9Nx7LGF_hHkI8-iDP2-aL97josK9NZ6fto95f_F7_ypnopWJVu53JgHql569H6W__wIAAP__Sxo9rA
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80dad46f8,0x7ff80dad4708,0x7ff80dad4718
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,18439568894796491880,10716385581220315055,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,18439568894796491880,10716385581220315055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2596 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,18439568894796491880,10716385581220315055,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18439568894796491880,10716385581220315055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18439568894796491880,10716385581220315055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18439568894796491880,10716385581220315055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,18439568894796491880,10716385581220315055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,18439568894796491880,10716385581220315055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18439568894796491880,10716385581220315055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18439568894796491880,10716385581220315055,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18439568894796491880,10716385581220315055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18439568894796491880,10716385581220315055,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,18439568894796491880,10716385581220315055,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3084 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18439568894796491880,10716385581220315055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18439568894796491880,10716385581220315055,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3052 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18439568894796491880,10716385581220315055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18439568894796491880,10716385581220315055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,18439568894796491880,10716385581220315055,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4912 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18439568894796491880,10716385581220315055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18439568894796491880,10716385581220315055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18439568894796491880,10716385581220315055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:5608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e36b219dcae7d32ec82cec3245512f80

SHA1
6b2bd46e4f6628d66f7ec4b5c399b8c9115a9466

SHA256
16bc6f47bbfbd4e54c3163dafe784486b72d0b78e6ea3593122edb338448a27b

SHA512
fc539c461d87141a180cf71bb6a636c75517e5e7226e76b71fd64e834dcacc88fcaaa92a9a00999bc0afc4fb93b7304b068000f14653c05ff03dd7baef3f225c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
559ff144c30d6a7102ec298fb7c261c4

SHA1
badecb08f9a6c849ce5b30c348156b45ac9120b9

SHA256
5444032cb994b90287c0262f2fba16f38e339073fd89aa3ab2592dfebc3e6f10

SHA512
3a45661fc29e312aa643a12447bffdab83128fe5124077a870090081af6aaa4cf0bd021889ab1df5cd40f44adb055b1394b31313515c2929f714824c89fd0f04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\885ca790-b8a9-4c91-8f06-fc06fc692112.tmp

Filesize
6KB

MD5
6a4fddc4341a52555d5a026b6a0b66b9

SHA1
0445a4375488be5833206df062543cd2c0cf0c40

SHA256
410fe377e5a111b0d726fb9fdb9d9cb14740db30e9bf7f55b4667370251b94cb

SHA512
0b2452a6be75a16075680fcf1f9cb623e5ea141f92f88b1132252a76192bc5060f1702fa1d0759b5031d631f1f1bf67c4d2c58f8bbfd39821e6b143f265c60b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
87fdead8fefe05626c0393986dd09923

SHA1
c300199268256191e8bbb49b21535d5cf745c43a

SHA256
da276a224733327598db31e9a2287699c95d7ab8b7708ca61f63d46c8d2fab5b

SHA512
eaeeea087bc5540dff7fe00954c633d32e7ff5197d5c59a4e3ec509f4ecedd29b0ec220dbf8f567a4854edab060c50d725ad2ccf31e1cc3538e81f573d665710

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
483B

MD5
6052ea64c775760ef77257f166ae973e

SHA1
45fd70ffa63cf7d60edac2e87815c14c281220db

SHA256
0d774605e10494d14adb221610b6856c01f18bc9fc03d0dacd4a261ca11da42a

SHA512
2a497cc20df7438c12c3cc246502fa07edf4e01b3272114e9b25ea38531bb558529d035f08989cb25a8d2b8f20d5cca6ad4e35de0762020c4ecda38997e81d7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c5acff3b7b176c6abebe6dde052c5b23

SHA1
4e605a6a544df555b92d7dcf8696f3224585e607

SHA256
d775b7612015c359f824a1219fb9ab2d50d7b6c8e455e75d1503b93452ca5b21

SHA512
4fcc54ea81398c9f8e4b3676ec69e303a41e0268c47c17c564f1b9d49f69a9a00c05e4d3f1ce272f9d48fcc1be2f0d286205d51794ca74e0f42436ed1638e4bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
26cde95e2abc1db2dde2953108a1f53a

SHA1
807a2fc0d8323b2b55cbed8ab18f7a23a52f8006

SHA256
ca77836a5c09bad1b8b4b7bc7699863a73516987c5d44a8dc8673384fbc99adf

SHA512
9b44d56ceda80eebb5e20167fe1fe3b9352b68ade534cc2c7de449f995d98837621149acf96dc02f3ef339c7d49c94bf3771e9f7e5f45333ff827334b67c77a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
285c151dd3d555e373d5705a2c8ea2c3

SHA1
e284fbbb25616303d7fbac1499a415b0791955df

SHA256
bf6040cd59ec81de37921d08db2c5bbde5f86baeea95bc61491a6fca59c072fc

SHA512
27a32d4ed9360ef5f3b6978b5ba31a9427762ffb86554b83e9ff07bde328e25fa52ad32c1a1e26fb24286df0584e35850f2183153fca82b222a6b06ff69b6117

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e7516a4781195b550082759c0b41d41d

SHA1
5dcac08f6554117f6d47c15d1f986adae3f1d5a0

SHA256
d7874a5fcd3b4630365ea4849f0a4bd56bf9d84a8f4abce0258a24a2cf815392

SHA512
de4c71d9c125c723046533287e28bca2bf499c5da825deb5c01353327dc83f3fa7cd1390277c2e99f733f2c1e8cc780fe579ce888066b70117d3de93d13061de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98472f4e2deaa80a20f9e03a8e3d93b3

SHA1
40821199abd1ced32237f27017dd4f8b5de8827b

SHA256
4b9a8be58e2182b1c7ee4334d2ff263e46e4179779dd98b61b59caee92e4e60c

SHA512
6ba4e84d714c74c2e9424d38c55dd4366ae7c533b9ebaf0ae6a899a9f8a612aa5feb9c9e9eb3ecfddce6cc032f448d8074e712b87c4364cd33d27ef1686543b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
612d4dd86373a2cde9cf578dba504494

SHA1
d80acbdb5a6f8c5e5b742c96ee283ab9debe885e

SHA256
4b7182186897cce1929dd5900bd47aab01a865147f51decd6bd51461e27e176a

SHA512
c4d81c44899ea22aaa46b4b53ee49dbee157370fa01f48e676d8976a1b9f6d5755c4ae185b89668930d136a8a4bc6e53a936a527c45332f4fe7c9d60fe55f518

Download Submit