hxxp://moosefile[.]com

Analysis

max time kernel
598s
max time network
589s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://moosefile.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2264	msedge.exe
2264	msedge.exe
744	msedge.exe
744	msedge.exe
1932	identity_helper.exe
1932	identity_helper.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3204	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3204	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 208	744	msedge.exe	86
PID 744 wrote to memory of 208	744	msedge.exe	86
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 5028	744	msedge.exe	87
PID 744 wrote to memory of 2264	744	msedge.exe	88
PID 744 wrote to memory of 2264	744	msedge.exe	88
PID 744 wrote to memory of 3144	744	msedge.exe	89
PID 744 wrote to memory of 3144	744	msedge.exe	89
PID 744 wrote to memory of 3144	744	msedge.exe	89
PID 744 wrote to memory of 3144	744	msedge.exe	89
PID 744 wrote to memory of 3144	744	msedge.exe	89
PID 744 wrote to memory of 3144	744	msedge.exe	89
PID 744 wrote to memory of 3144	744	msedge.exe	89
PID 744 wrote to memory of 3144	744	msedge.exe	89
PID 744 wrote to memory of 3144	744	msedge.exe	89
PID 744 wrote to memory of 3144	744	msedge.exe	89
PID 744 wrote to memory of 3144	744	msedge.exe	89
PID 744 wrote to memory of 3144	744	msedge.exe	89
PID 744 wrote to memory of 3144	744	msedge.exe	89
PID 744 wrote to memory of 3144	744	msedge.exe	89
PID 744 wrote to memory of 3144	744	msedge.exe	89
PID 744 wrote to memory of 3144	744	msedge.exe	89
PID 744 wrote to memory of 3144	744	msedge.exe	89
PID 744 wrote to memory of 3144	744	msedge.exe	89
PID 744 wrote to memory of 3144	744	msedge.exe	89
PID 744 wrote to memory of 3144	744	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://moosefile.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe429c46f8,0x7ffe429c4708,0x7ffe429c4718
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,18318057313759604465,13018000473360000792,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,18318057313759604465,13018000473360000792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,18318057313759604465,13018000473360000792,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,18318057313759604465,13018000473360000792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,18318057313759604465,13018000473360000792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2224,18318057313759604465,13018000473360000792,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,18318057313759604465,13018000473360000792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,18318057313759604465,13018000473360000792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,18318057313759604465,13018000473360000792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,18318057313759604465,13018000473360000792,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,18318057313759604465,13018000473360000792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,18318057313759604465,13018000473360000792,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,18318057313759604465,13018000473360000792,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,18318057313759604465,13018000473360000792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2224,18318057313759604465,13018000473360000792,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:5516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:368

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504 0x508
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
68KB

MD5
84ec9489c10f4bb242717a9330af4b33

SHA1
789afa266890dcb80bbe2787e2a9fcd5093bc294

SHA256
1b00b6e622f154c4d93d667f34162fb656c5e5d498bd5388dd94c3004b881337

SHA512
85d929fcff105adbc05704f640a1a3fadd82b50466a77b28af0587ba242552037847064780c605a27c47f6faa4ad370b6f1e51e043f10deff0b07c85fc7ca39a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
65KB

MD5
cdfa38af76619486275064088d4b2d7d

SHA1
cbb7aa257b6f8bf25997ee23b8c54af9cc486174

SHA256
aadec2aa315f601a41c59593d679488eebb58b7db35f25562b74410c6debf714

SHA512
edeb36e7bf0f56e4cde4192969e4745ae313b06050479c96ede59fdf893c1b143091a4cdfcc99cf42e2d8603b192e4e684c72785d4dad36c88ca59e3890b5a59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
68KB

MD5
6751032da1f4bef5699999eb0237ad81

SHA1
146d2133eece1475309f08e93a80f26525adadbd

SHA256
57929f000a5c69b9a6adec866e85b92ffc2130957d54cf54633c913a69e6c7e8

SHA512
259d5466923ff27a0b0d3f6786d18372a1c4678cfd9cf9b13f2d4b080b99245fdff0e8b761b074741d984d853044664c6929da38062948b4304490fc3686dde7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
64KB

MD5
f1229839e581cb1711d08348d6426d72

SHA1
5c0730676558ad188ca89024cd3ca2b41e84a8c3

SHA256
405f3ad463df158258eabf5fc821c31453d7849a3fbc043f2e7400b0e9042498

SHA512
8fbdcdd67c838e0f6b484cf8abef37eb52b3a108081d8cc29acbb12956d462131869737f371f6c554be36b856c3d57f74ae38d64bbae99f10627113f414cd7d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
65KB

MD5
7a68496b76e316162a3d784382399fce

SHA1
b74e85f97f0661be252fdf8cdf6272c2ec42346f

SHA256
7c68dd61ca53b820dcf2db0a409abbbdf71af43b30fd8e1fffacbc42bde8fe67

SHA512
63828a9b5a48a9219314694b375a660a30b0dc2f16ef215bbafdd26b3fb80e38a8f1f29698c6dbc0728cc6c2f7ebfe3864f20f155e97c98f31a7b4c1d106dfe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
67KB

MD5
fb3857141c178186db3c40ff1436208f

SHA1
699326bdc2bd03eb69e04f468cad93dbf8c45b46

SHA256
97e31d26213ffb182c3ffd6fb9da9bc5fed8703d59a7a35b58b3781e4244279a

SHA512
8271d46cc6cff0e900658c527f2973930a03b8d9b631a59dc0f4ea6c5fb337a3dbc281635f949a5ddec1762761e7e2922db3229138ee106f0faf5d98fb6423d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
6f3ebf98ce6e8d60ebe7ee440b731442

SHA1
4a78f8b554f4f0240cc658c7b3487cd94ec956fb

SHA256
b2f0573da09a8149d5e0a75d9c9053a979a0b7134f404ae141b1a6728213b8f5

SHA512
dbc00718de27407a7f1636beeac5a097ed27f1d9919f64869efc1c1dd6cd9760862f198f4aec1e3eeca5a7a47fbf9b37b40f7b0f8b82a4d682d45fc0200cc1f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
8de3782838194c1c44b437b9116a64f2

SHA1
5e84d7b11bee7aa00fbf63697cfadb633cdab26c

SHA256
938dd5399c1aecbd362642d40747280aee9d480c2fcec627976dbd2f22797c24

SHA512
7ed250d17b4fb0f6519eb5ad0155d66b2082e65b0509e791c61c3173debcbf3c1a6005d4ad4c52d0e356bb756aebeb9e45ec9d9e898b6876d9d81b9d47b03db6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
260B

MD5
82fda3d55d8a84b7dcd3a06bc432362a

SHA1
394ddbce41465f28bd278515573ddaab6df2351c

SHA256
ec2557e33533d9cc34db8d561e99511569b58c137e5d7f3c5ac2b8f4b6c5cfb4

SHA512
c1062c881db9cb81658f5b2127b8624395ce64682cf7fdf4bf6fcf90587a4944ff49cdfc5622d28fd9668817fb8d6e3334751fa6526c8dabe0cb44fb66d50fa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0ebfec6171e1b745b1d07657b79bb8f2

SHA1
89368d9354d1ae030e9b54e70c719d2bf9c3bace

SHA256
16522535783495edd82242b9aadad1296edf7613a222258baf1b9b77bcba5ee3

SHA512
cfaa6a5420f964d223a8497f30246dd9992c5f8d7ee5a70e4c7d39067f63449a5ab8a4c51de94102cb7901c15eea8cc20eb5dbbaa04cc674f1b2d8f87ba4d53c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7206d388343d484f119e56380b521cf4

SHA1
38a7b9324e6b208883509c360be7d2acee22778a

SHA256
ae893b4b9f6856eb5563328a8a56308af97c267194246807ad43e0299a8daa1e

SHA512
52732e068ff6c4f134b6f3658a70dd8838a12d210fef4cdaa00e8877f6d99e0061ba526237c5622f4c5e8084b0566bdeb22f7d9a73683d88956695ee9fe63438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
504345e30bffe06164f4954d41b3f48c

SHA1
dc45fc61f31544d7e589d2d5dec030cd72e4ec27

SHA256
7c40146dde585d4c6434683a54857adee69bf13ac224d3ca47baa6127c39a084

SHA512
305bdf157ed2f173e7ce333801488ef86364b149b89fee341cf88c000896407d68cbaea2bf188910b6c707a74cc05ae0954440ba9629dd6de9425c37129e95a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e630624fb0325e1a3289f131b09c3bf8

SHA1
00800795b4a03efe9d74d2af56ee425b53865ed7

SHA256
cd1a727f3881f65009daa93f076a0186331feb262af4ad6c967989d9e2555f0d

SHA512
e99a7840ca0b9965c4c3d0cbfd7ebc93785af48a1a16d980bf36cd69d9f0a96c59084546f0bdc176c97e935f5deacadbf445755f5132d72f17059d7ef663fae6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
515f301641570c12812abaa1e91af58a

SHA1
31cb7ed47dc62abddce0d0b6d1bb0f636524f574

SHA256
62262fedad0f986d1c07832075b509b6d36e198d68e16c63db6de8121ee4816d

SHA512
3e2aeec0c6b31dee2f823a2c5b148240ec534350b67665d45ac9c16861f41c5a78c8495e2ac096baafb7f77e7db45464a81db103cf7fb2e0ec8322dddccdb087

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f1115096757c1c5677f438fb1063b7b3

SHA1
b6da3eba8f7aa3a333ac5664a1fb063731001347

SHA256
586a34fe2484e029f6801e5e075df5428be9c165528d63e4020dec6746eedaa2

SHA512
14200cadb30939134410008e2450be7cb703d4388e778bec154059c5adcc789ca9bdf4510e383ea3dc5dcf2677516c6c5c2edd38912b30b4b9399368eb5f230a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2b6a15fde37b46bfc46b63bff87b33d8

SHA1
48d0096b42aa8c8c810c68d5ce6faec1d2c96d29

SHA256
1a5aa4f6c562f35fb9018c346ed9d545e70cc67c0b8c6c741715670e2f86a696

SHA512
74d4b65f844e5664a8cb71bf0902c035909e34d1da6bbeea3a969f98aff9d3f1502593ca956c0cc1fcaf884ebdc110b8020634f1eaa576e9e33858a7f97320c4

Download Submit