hxxps://content[.]amanet[.]org/?m=CiGW[.]81UwlU3LD6ZH5M4ZoUXv03dAeWfC&r=hxxps://7vxyuahbb[.]cc[.]rs6[.]net/tn[.]jsp?f=001u-b3w_O4PTjpzIs2i0h5DErsPex8XNHYP0hbCQkJ6EO-RG95cdnbHIEGCTmwvqPc4xGiEs4EwHodQ8K3o5b0EOaaEuL5POTnAz0WbTWwmP1MlM8-zDGkhrPj_Gnxh0dWBTx14XZt0_HjUwT97srRioDy9je6h9GM&c=fhQbP84fbYlkb2ExIF0H6ylH7Xw5wt3GwwIzQX8hGN671BBCtDJOgQ==&ch=1zwWE_lSnhrzgaG-4UbhHfMkJ0Rwiy71g5sWrUKtsC9GPHp3o1LUrA==&__=[//]cgi/inddexfile/hrjkf/ertygf/FjL/cnNlbXBsZUB3aWxjby5vcmc=

Resubmissions

08-05-2024 20:04

240508-ytrwfada5v 1

07-05-2024 15:19

240507-sqdxhscf9y 1

Analysis

max time kernel
246s
max time network
248s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
07-05-2024 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://content.amanet.org/?m=CiGW.81UwlU3LD6ZH5M4ZoUXv03dAeWfC&r=https://7vxyuahbb.cc.rs6.net/tn.jsp?f=001u-b3w_O4PTjpzIs2i0h5DErsPex8XNHYP0hbCQkJ6EO-RG95cdnbHIEGCTmwvqPc4xGiEs4EwHodQ8K3o5b0EOaaEuL5POTnAz0WbTWwmP1MlM8-zDGkhrPj_Gnxh0dWBTx14XZt0_HjUwT97srRioDy9je6h9GM&c=fhQbP84fbYlkb2ExIF0H6ylH7Xw5wt3GwwIzQX8hGN671BBCtDJOgQ==&ch=1zwWE_lSnhrzgaG-4UbhHfMkJ0Rwiy71g5sWrUKtsC9GPHp3o1LUrA==&__=//cgi/inddexfile/hrjkf/ertygf/FjL/cnNlbXBsZUB3aWxjby5vcmc=

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
3744	msedge.exe
3744	msedge.exe
3908	identity_helper.exe
3908	identity_helper.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1424	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1424	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 716	4248	msedge.exe	80
PID 4248 wrote to memory of 716	4248	msedge.exe	80
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3352	4248	msedge.exe	82
PID 4248 wrote to memory of 3976	4248	msedge.exe	83
PID 4248 wrote to memory of 3976	4248	msedge.exe	83
PID 4248 wrote to memory of 2780	4248	msedge.exe	84
PID 4248 wrote to memory of 2780	4248	msedge.exe	84
PID 4248 wrote to memory of 2780	4248	msedge.exe	84
PID 4248 wrote to memory of 2780	4248	msedge.exe	84
PID 4248 wrote to memory of 2780	4248	msedge.exe	84
PID 4248 wrote to memory of 2780	4248	msedge.exe	84
PID 4248 wrote to memory of 2780	4248	msedge.exe	84
PID 4248 wrote to memory of 2780	4248	msedge.exe	84
PID 4248 wrote to memory of 2780	4248	msedge.exe	84
PID 4248 wrote to memory of 2780	4248	msedge.exe	84
PID 4248 wrote to memory of 2780	4248	msedge.exe	84
PID 4248 wrote to memory of 2780	4248	msedge.exe	84
PID 4248 wrote to memory of 2780	4248	msedge.exe	84
PID 4248 wrote to memory of 2780	4248	msedge.exe	84
PID 4248 wrote to memory of 2780	4248	msedge.exe	84
PID 4248 wrote to memory of 2780	4248	msedge.exe	84
PID 4248 wrote to memory of 2780	4248	msedge.exe	84
PID 4248 wrote to memory of 2780	4248	msedge.exe	84
PID 4248 wrote to memory of 2780	4248	msedge.exe	84
PID 4248 wrote to memory of 2780	4248	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://content.amanet.org/?m=CiGW.81UwlU3LD6ZH5M4ZoUXv03dAeWfC&r=https://7vxyuahbb.cc.rs6.net/tn.jsp?f=001u-b3w_O4PTjpzIs2i0h5DErsPex8XNHYP0hbCQkJ6EO-RG95cdnbHIEGCTmwvqPc4xGiEs4EwHodQ8K3o5b0EOaaEuL5POTnAz0WbTWwmP1MlM8-zDGkhrPj_Gnxh0dWBTx14XZt0_HjUwT97srRioDy9je6h9GM&c=fhQbP84fbYlkb2ExIF0H6ylH7Xw5wt3GwwIzQX8hGN671BBCtDJOgQ==&ch=1zwWE_lSnhrzgaG-4UbhHfMkJ0Rwiy71g5sWrUKtsC9GPHp3o1LUrA==&__=//cgi/inddexfile/hrjkf/ertygf/FjL/cnNlbXBsZUB3aWxjby5vcmc=
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd02073cb8,0x7ffd02073cc8,0x7ffd02073cd8
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,4399369731972892981,3375909094531662390,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,4399369731972892981,3375909094531662390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,4399369731972892981,3375909094531662390,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4399369731972892981,3375909094531662390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4399369731972892981,3375909094531662390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,4399369731972892981,3375909094531662390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4399369731972892981,3375909094531662390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4399369731972892981,3375909094531662390,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4399369731972892981,3375909094531662390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4399369731972892981,3375909094531662390,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,4399369731972892981,3375909094531662390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4399369731972892981,3375909094531662390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4399369731972892981,3375909094531662390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4399369731972892981,3375909094531662390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1324 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,4399369731972892981,3375909094531662390,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4399369731972892981,3375909094531662390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4399369731972892981,3375909094531662390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1880,4399369731972892981,3375909094531662390,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:4804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1876

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004D0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\751c268c-d886-4d67-a2d0-81c96bab7416.tmp

Filesize
11KB

MD5
fe3107b3df3eb8079ea872af3776f7f8

SHA1
ad29a8cfe8a663b814442d487a056aca6311c1c5

SHA256
02c7aac0287e609235edff84ac2c0169de96460d47701d36af079de5b101d554

SHA512
5a3998a627983cecd7ab8dcf6573688bad0f78b3824ce220b041d6c872ff2fb3ab549de0de2e378c7ac94c7f2747cc0d7cc4dbaa600054bffe6bafecbffbb309

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e027def9b55f3d49cde9fb82beba238

SHA1
64baabd8454c210162cbc3a90d6a2daaf87d856a

SHA256
9816e980b04f1fe7efaa4b9c83ff6a0fdd485ee65a884c001b43a0cad7c39d83

SHA512
a315e1336c5ec70cbb002969e539068ba92f3ec681b6d863db95227fd1808a778fd994e2fb03f28f0e401677aa5f7c66813e315b6b99a5065384c49586f9782e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0c5042350ee7871ccbfdc856bde96f3f

SHA1
90222f176bc96ec17d1bdad2d31bc994c000900c

SHA256
b8b1cb139d4d19a85adce0152fa3c4f6adfb73a322d7253820e848c6f82afc1b

SHA512
2efdb535fa6a06c4f9702b2129f2dd07c330e37fd10b492f2236007c660c1707773c22005d1e1fa580dbf633dc1a700ada3b7b611ef9accd9555a17a244f61ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\189dd520-a116-4828-b14e-c5a8cbce8384.tmp

Filesize
6KB

MD5
e82140ae8f4dd0f45b128de667c93f10

SHA1
8e12db3c6d7a2f916519f181d2588e809154aa84

SHA256
1b376d906a528940e203f4b6a1d73a92b5e198179694a321498a7adc5d72b1c5

SHA512
6f8f717b192a55ff9ffd0300cac95c52f5741598f9da1e8c041867c42653a0ad3661056330291480cc19edbfbf20de264c0bcba7fb904aff0de7b99259c2740a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
1d83c5e7d4cf96de2f9e88ec90f96ebb

SHA1
edecc7d4ebe4bd7cf723b58864791d53a040f8cd

SHA256
807e19a5ca91914ae9124a7850c1b1f2153a03e433bc0e5f649ad8e8c5d60575

SHA512
b63eafdefa384fb6f3054c2e6f946ae8ad65c680ea0053fe3d5d72814410058545481a440fd13b58408de13fc8ea3e437403b4ab560e86c17307fd4daa65be1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
492B

MD5
4559223a159e351cd260ef0d0a0957d9

SHA1
34e4b5544992db5758eef98ab2494788f5857554

SHA256
e377d0081676ad9c5dafa7b68e7fe5bd2fda6072af20d8d93f2f3a3504941a4c

SHA512
1cb2099723e73d05aaeb9918da83f0928c689b726ce56f889832806c06654e5f07871914319f61a26ba5e970a25e8a14b485b5a3153f6000ea30fcdcfebae4cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f8534b4bcb0093e23af64f620f3acbed

SHA1
40a758cacaca477ce9584abebea6dce64a2674ef

SHA256
c42e1ed4c2eaf84fb881b3ac726fcbf60f632c57496f80de956d899c513dfbf8

SHA512
594e0dba7fb4a2f460b3d9375aab077b094f051d87b823516dd4029af9087be7ad88ff2a261e82e889c4644feec7296a2c93d4946b6a5c05c10548018b826138

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4850ae10a7c0fa6e1036f1c5bfcc7b5b

SHA1
fcfeaf379f67205d793c9e857c9279148f9279c3

SHA256
df6985ed2e7c35a14c4160be41ecc12776a0e5d817200dd00321833c91ab4cce

SHA512
1763d1bceb8a7033fcd7d177527cac145625b4928dae939eca2da4624cd460a3b5745dbabe04cffb2a99c08ff7f9b38d59bdda33505fbe531a2f93d6e3cbc2e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c860dbc603dc3cc25463021b04eb10da

SHA1
b8089e07a9e9198f09f20a5c163da1ae0466c188

SHA256
e53014b59aa1a34dbdc63a4d826abbb0e48535dca8bf026f4b0f75ee46c0cc89

SHA512
033d720e0a7e84a38efd437be1a2c1edfeefc1535e92f5c203eb08b55695d4686759224b8fecdd0e2102fa12f640996dd5fa72ec4869e7fbfa1c7655ca66f9c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d70523b9511b3f76cc4ed7b3b7b2244e

SHA1
da71b6af2498505aaeede97367c8555c32ec4786

SHA256
7a6afb20e2645eab34d11c478aa73313e8a93a1ae614982b91940ee8de6c206f

SHA512
1804ff240666c1605d3a04c472f987a51ae30c39a2474b2be08a4291af8b8cc9e6c69510f8b6d0003cee466e3a643e4b09df1cd6032c9558e636d07e361440dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
5b501fcde3098342aa5c9817f79449d3

SHA1
d5f06f202ec0d0c55e3750babcd0865e9797cfbd

SHA256
469f0aa4f250e9ffb7a88dc48841cdc13eee78769a4b8048179a5939df63012b

SHA512
b80008bbcefd5135180ba47f77e7a76ebb302c5db493f5e89219961c7443de3fc69eae0c55932964474970b74436c9b5c51a8f2c15282cedcdd4e4da11e0a23d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
320d15cbf1c8f15c96916d90d0358144

SHA1
242486346d665b588414218bd0734a56ad8bdb86

SHA256
86b3ddf7ac725a276cdfc44b1ad5c0a97828ec7fe780b782aa9192fe5ef9792e

SHA512
fc46e6e82da141cd444daff28347763f531a0e20e735a85c960c02991a689b6f0e93773b3fc93e11a634792709ab3427bafd70300d2b045cf12636afd0e1d0d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5b0404.TMP

Filesize
372B

MD5
5455017bdb8d044f9f13e3cc1dbae5da

SHA1
5507e83039e005852f840de07d8ce040efda63ed

SHA256
db6248a133c6e5a15358384e827e994ee131d9ba0ae707a08285eb4c842ec71f

SHA512
a3597bf511e918d75f60516f0b53873a036790ce17cbfbaae34ca24f0cde3e12d54caa92eb07b03c950e4dd3ca1539f95409d8bdc3c504dd9cbc39caba06be95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9fdf723247c2c7f791104331b692dd90

SHA1
66d211c2c276744875e9202ff6856a28f152d75f

SHA256
d41697254e601018f45c5dba96df4a290774586f348e264b392471573e7fa94d

SHA512
daebb549c33afebaa42e589e9a3d0c1fc557c103ae980fdf29004f065607c9a44fe39b228d69d4b3964dc84abd0ba8f118248e849fa38598bd86f3cd7022547d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
90fb57eef0711e04e8e056e42d3f094f

SHA1
d79bc27f8d7bb8c1d9db336fcbe030f2acf2ffce

SHA256
b6aefc25283c65bd749dab2969a9c0241a69a81dd790c304fbe562f9385ed4c4

SHA512
0dc0c5625a1dcdf0121e28be02f81724a11ba18c2afca3f643b2ea6cb76149115f4ba7acddb63e238eebb3e89efdd34c54e798b28c9aa992b0f07f9c613d75b7

Download Submit