hxxp://api[.]dev[.]mostaza[.]org/en[.]html

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://api.dev.mostaza.org/en.html

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1808	msedge.exe
1808	msedge.exe
4044	msedge.exe
4044	msedge.exe
2208	identity_helper.exe
2208	identity_helper.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 4064	4044	msedge.exe	85
PID 4044 wrote to memory of 4064	4044	msedge.exe	85
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 2244	4044	msedge.exe	86
PID 4044 wrote to memory of 1808	4044	msedge.exe	87
PID 4044 wrote to memory of 1808	4044	msedge.exe	87
PID 4044 wrote to memory of 4580	4044	msedge.exe	88
PID 4044 wrote to memory of 4580	4044	msedge.exe	88
PID 4044 wrote to memory of 4580	4044	msedge.exe	88
PID 4044 wrote to memory of 4580	4044	msedge.exe	88
PID 4044 wrote to memory of 4580	4044	msedge.exe	88
PID 4044 wrote to memory of 4580	4044	msedge.exe	88
PID 4044 wrote to memory of 4580	4044	msedge.exe	88
PID 4044 wrote to memory of 4580	4044	msedge.exe	88
PID 4044 wrote to memory of 4580	4044	msedge.exe	88
PID 4044 wrote to memory of 4580	4044	msedge.exe	88
PID 4044 wrote to memory of 4580	4044	msedge.exe	88
PID 4044 wrote to memory of 4580	4044	msedge.exe	88
PID 4044 wrote to memory of 4580	4044	msedge.exe	88
PID 4044 wrote to memory of 4580	4044	msedge.exe	88
PID 4044 wrote to memory of 4580	4044	msedge.exe	88
PID 4044 wrote to memory of 4580	4044	msedge.exe	88
PID 4044 wrote to memory of 4580	4044	msedge.exe	88
PID 4044 wrote to memory of 4580	4044	msedge.exe	88
PID 4044 wrote to memory of 4580	4044	msedge.exe	88
PID 4044 wrote to memory of 4580	4044	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://api.dev.mostaza.org/en.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6d1046f8,0x7ffd6d104708,0x7ffd6d104718
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,764032459713928048,17540467314020245351,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,764032459713928048,17540467314020245351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,764032459713928048,17540467314020245351,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,764032459713928048,17540467314020245351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,764032459713928048,17540467314020245351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,764032459713928048,17540467314020245351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,764032459713928048,17540467314020245351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,764032459713928048,17540467314020245351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,764032459713928048,17540467314020245351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3292 /prefetch:8
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,764032459713928048,17540467314020245351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,764032459713928048,17540467314020245351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,764032459713928048,17540467314020245351,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,764032459713928048,17540467314020245351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,764032459713928048,17540467314020245351,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,764032459713928048,17540467314020245351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,764032459713928048,17540467314020245351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,764032459713928048,17540467314020245351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,764032459713928048,17540467314020245351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2216,764032459713928048,17540467314020245351,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,764032459713928048,17540467314020245351,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\04d00e03-8f12-4844-b3ed-22eeadc6f31b.tmp

Filesize
7KB

MD5
e54ea32e1910be096d9a9e95c8a61750

SHA1
edec2d1de8e69814e23d05373efe6494e32e41a1

SHA256
a0d3e65dd17f2c5c249636531da92c16b1517360d181acd3d638f604e42b0c82

SHA512
3eca93cd794c9bc8c850e3db5ff6246bf73a7f7fc0090764c40292895d79c580391bb59bac241ebb4813533c1a817618aebec1cdcfc10923e68bb6d3fd85cac2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
6a6c16c1b286ef5cc8c113bb04ffc3d4

SHA1
031976dbbacc6a3e39d8d7fb7da84f234c0c8783

SHA256
8e54da7eaff68022842778a1000f0ccf92dbefecd3f3141f050d5a990b2ef0c3

SHA512
e0e176ad82afbb76fe40e64c997985cfcfd1774eb507d44547bcd0832db05fd861b0cf9e22aa94666f9674aa61122153c60dec45f669d2bc96e396e2bb0a6658

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
5b66e5df00729e6bf3709210b4105122

SHA1
34854930d4c716583aaa308453d5a2e4637e8380

SHA256
3cd5589a98bca39861652f2ec7c16d54c1f8fec3ba9b78c47d07e80a5bf5cb3a

SHA512
7a7627e9d3948048331d6934456b11d162313dbc2ec495281330f6887673bfd22c2ad7b931446d5f5d7309ba1bc8c4f7da641d66c9b1cc1942985bcafd049c34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d30aa2294bce0028f3a4ee3ec1d80fdd

SHA1
a7223e6a17092463125024034f5a83165b0c75de

SHA256
c825a90f2602b8249b758c42a9fc3afa56b61b3b4f3fbf13761dafcbac2bc37c

SHA512
e6c22c85dad1a8d91cf4629754c30814f7c57c48c8b45602cd2029a2eba17707c39f2d2ddd8aac1c414de810f4ef79834499381e83a7b35945d925b0211c8445

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
32b8a5fa2e9fff75abf7cb6e88bccd48

SHA1
93ba336d8d1c102160b4c22b9da5389adfd990b2

SHA256
20b923cc5b5bad36098606e66a01be2573adbe4aa0612d195e56e6ff7cff2593

SHA512
9ec65e3c77e5e6d08b6d4bc8bfc63ca3d54803c49250b1800e9333b1d4294bc79020b88b0a09210b2bd9342276b3d078791b9f97ee01ddb1980d3a840889a195

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d75c599133db983054fab784b623be70

SHA1
ba2aef6cfafe3b019e0a368b06588e98a4bfadad

SHA256
b1f05fd790fa70f9d33bce02e9169be34351de7750cf401133d110e814ba46a7

SHA512
e4be011a2ebe4f26935e55d362d6b9b3bf799f1c0322b11c89970c31718c28a47810618094dbf0786f1a5e2bd375e73abde6d5dfb49ef6648cb3b1e8fb06a5c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e32c68c1fb4336e7795b02d88d6f3a1

SHA1
b06ce0650095d882a02cc5601812e25071b5ed62

SHA256
9d898b44803ef69e67a09029223160c74288c853f2ec98a65e8b1b40f94077ee

SHA512
2f8a4fc710baa65082bb3187583310704ad53471a88bd5e386d67104f1d345daf9dcea9eb04fee6faa0b16327c44d48f868fcbc388452351ffe381e9e8eabfbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
bbf601952c4d051f8f9fcc17e1e51712

SHA1
60dff535d6ffa75bed83def075d4f4380eedf83d

SHA256
3fa65dbe2cf212c7aa3da9a815a672e137f79835caddf073e8a83196a46888a4

SHA512
ddd3594b4bba5edb46dc110eb726b9f41eb2f0dee2d1391e4464def4906a8ef7e529eb59f3b4043d4eba9ab81df408612a9a608f976fe5a686856dbe909714d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58148d.TMP

Filesize
204B

MD5
611a1181689893d3eb6fe6692ac9caab

SHA1
acbd1ed2e9716af9f87e226236fd384daf800926

SHA256
24a022fa3879db39c5184ee3af02b71be733776ab15186c748d56599760029eb

SHA512
6aea656249b6b22fd703ba4b2961175cb3c83a3235c4609c5ff0dbcf425db1aa7aa3d4c126656e25421dbdc04983eddcad170fce65e213a614b6a129d3db87a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
51fffbef340c215bb9b21c5b8ce97fe5

SHA1
18bbadb2529cfc5960a3ea061089cf24fe40814b

SHA256
fffac607c7373cfb88204a70ce42dfa1b52423f43ea13bf6004dd25ad1b13674

SHA512
f1379fc85f81d74b779730f9ef93887e5458bf8c013736e62df1be9598a30d21d431614b02a7e714691098396953208a1285850652f18c776dc5cf89d4cda19a

Download Submit