hxxps://cdn[.]discordapp[.]com/attachments/954822498329981009/1230597122265583686/RAGEPluginHook_1_109_1337_16563[.]zip?ex=66620a61&is=6660b8e1&hm=d1f2a1405309fc83153eca9348ad1ed4b2705763a691a1e59dff00b463b74e75&

Analysis

max time kernel
1437s
max time network
1445s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/954822498329981009/1230597122265583686/RAGEPluginHook_1_109_1337_16563.zip?ex=66620a61&is=6660b8e1&hm=d1f2a1405309fc83153eca9348ad1ed4b2705763a691a1e59dff00b463b74e75&

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{9905F1AB-A3BD-4708-9FDE-93199220A8D3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2160	msedge.exe
2160	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2012	2160	msedge.exe	115
PID 2160 wrote to memory of 2012	2160	msedge.exe	115
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 1576	2160	msedge.exe	116
PID 2160 wrote to memory of 3660	2160	msedge.exe	117
PID 2160 wrote to memory of 3660	2160	msedge.exe	117
PID 2160 wrote to memory of 3452	2160	msedge.exe	118
PID 2160 wrote to memory of 3452	2160	msedge.exe	118
PID 2160 wrote to memory of 3452	2160	msedge.exe	118
PID 2160 wrote to memory of 3452	2160	msedge.exe	118
PID 2160 wrote to memory of 3452	2160	msedge.exe	118
PID 2160 wrote to memory of 3452	2160	msedge.exe	118
PID 2160 wrote to memory of 3452	2160	msedge.exe	118
PID 2160 wrote to memory of 3452	2160	msedge.exe	118
PID 2160 wrote to memory of 3452	2160	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/954822498329981009/1230597122265583686/RAGEPluginHook_1_109_1337_16563.zip?ex=66620a61&is=6660b8e1&hm=d1f2a1405309fc83153eca9348ad1ed4b2705763a691a1e59dff00b463b74e75&
1⤵
PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=4100 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:1
1⤵
PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5356 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:1
1⤵
PID:2348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5032 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:3680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=5376 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=6020 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:1
1⤵
PID:2440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=6220 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:1
1⤵
PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4960 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4496 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5676 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --mojo-platform-channel-handle=6480 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:4660

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x44c 0x150
1⤵
PID:2688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5032 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:4556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=6380 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:3100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5364 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:1788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff825262e98,0x7ff825262ea4,0x7ff825262eb0
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2276 --field-trial-handle=2280,i,7796787342574214222,495052077930837731,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2312 --field-trial-handle=2280,i,7796787342574214222,495052077930837731,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2484 --field-trial-handle=2280,i,7796787342574214222,495052077930837731,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4416 --field-trial-handle=2280,i,7796787342574214222,495052077930837731,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4416 --field-trial-handle=2280,i,7796787342574214222,495052077930837731,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4480 --field-trial-handle=2280,i,7796787342574214222,495052077930837731,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4608 --field-trial-handle=2280,i,7796787342574214222,495052077930837731,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4108 --field-trial-handle=2280,i,7796787342574214222,495052077930837731,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=756 --field-trial-handle=2280,i,7796787342574214222,495052077930837731,262144 --variations-seed-version /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1044 --field-trial-handle=2280,i,7796787342574214222,495052077930837731,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1384 --field-trial-handle=2280,i,7796787342574214222,495052077930837731,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:232

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
776a381aa0163e2a3d29cf2baf7bb9a3

SHA1
e8d31ecf0fe9d9b1181803f52825e8a671663c0e

SHA256
c15f2825f4639fbbf82f8025f49f0209e8b152bc32ae0958dacae3a60735ea67

SHA512
33718e76dc08d236c6f8f7d4ef2647cef2c4df53142ee7060d45e7c324c48491e0215bd16ceb943eef1a194e7115b8dd6c067aec43ad56385dce14350330d23a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
e8e2c61240e72523c686739d80a70da2

SHA1
aa5181721a4a25cb212a29ce9a41b763adca537c

SHA256
fea1896503d947e5b83936203460beb76e7cecd545f043d4a97dd6efa191608c

SHA512
dd0c3b73fc40ed4e312ae19b925557f05432fd4f47d1fcd11c833dea0f0396035405477c71c626df37e5bb2ca238a51d199d1bc6f952d20649e80894eda5a354

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
18128333485a68273124e02f73d85b3c

SHA1
c1b6ea332101665e97ab2ee0701367ba9fb21fbd

SHA256
96770ec287a8e24d21476e29ca644c8ae19c0738c78b4f0d8e1352d4f6d4e73e

SHA512
f6810a3495637f24617e119d2d4fba6d37b1346d62b0e30c595961fd34401e6203fbe3028c04a996af9fddd061808cff6490ac9fb9c82b0812dc06525bc99482

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
9e56d2ad42f2cb29cf820da311d4237d

SHA1
41b57c0ff71912fbfd63e9bb6061ae50a8ec8c30

SHA256
dd1c3d5f63f56ccb748955ae2d0cec0599804fdb375e551a5064168faff849bf

SHA512
3bde5b25efbb790f85aaf8a33fbda1b742cc69ca45befe6b59dcb86c8dd5f9043049a931919454bea1624aa0897e5fb6f96a4b72e2cdeedf471949853ef7e01d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
30KB

MD5
ce50a8de0686183ebe524098043afdf1

SHA1
4ff9b9163a4051f3eebaf7df2c904ca1d477fa03

SHA256
7c466f98dcced1ba1e468c4eefc9569a660b228e8236afadaa1a2a285989b271

SHA512
be274e7dc8c0eba5c995a49220b1ce4ed4c13f997635bb79f18d1ac373324f0c953cfb5186e0c4734107aaba73f38f73f1bb4e85221797175e9b8f1ad30806e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\af9c52da-b59c-450e-a8c0-d17ef0dfa29d.tmp

Filesize
11KB

MD5
8fcd787ac904ffc0231a2eb230bc3744

SHA1
d08a35d190aafb420e514ea88b70b3824468f904

SHA256
d0c77dd86a6b4723ee5d95602441a87f64fdaf3f91bc1367cbe0081303462a60

SHA512
6a483915fe3963b3b2f5ea656f3168e18c306201dc5fe22ded08c4e459c979cdc4522b1d0706aa1d7e26fbdbaa42d444c1c9efff8f075d9f8a9b55aee346ed55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
76KB

MD5
6878a4caabb1313452cb922821fb2938

SHA1
a0c4af97279713986c8fb8b8fc2042a9ef6f9109

SHA256
2266a9c2fdf802a6ca03d4822bb017fc58b1029a4d7fa146140c1d72b6bf30b4

SHA512
b62434464d7676bde96130434b07e0e45394dcc4a51c9702fec138a93102b4e0f7809a875bd75f054f93eda1e7fb9aad882c3a613d6096c571dc99bdfe268d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
66KB

MD5
565a0e9e0359e4ab6babb16820f41078

SHA1
69301e4649845dd935da873dcaf921f7dada03d6

SHA256
82fb01e5d13182b8ea643fd24eb30b926485cc2ab30dcbac363699c1bcf46b82

SHA512
6e465f46a53cc67edae81094e06c24c86ca856b481e51f66096c8045a8f91c579508216b5c824dab4f11b0e71707184f7a31275e33829c4f24f7dc30957d685f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
56a2d999f78bcf2a95c3bb10b0731679

SHA1
bb16932df8f63feaaf7716a5f9138d061e0fc4f9

SHA256
0a7f305aae76b7cbc35f922f3b5cfcdf1f84bae436f0daf28abd21a7f501e88c

SHA512
f82636f8a79faf6ecf61df17b3e8d070b852b13a3a7813d716b7ae9e16f13925d13ccfdffb554e92de64bdd44877c13da04f0268846fad35a16d36bc247043e6

Download Submit