457bb5c1fd1beff4504e495396c739ff59432ecfffd380452812e7b0216b5cdc

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2024 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

457bb5c1fd1beff4504e495396c739ff59432ecfffd380452812e7b0216b5cdc.exe
Size

39.2MB
MD5

706c6dedf279f61d8b00eef8b1d240f3
SHA1

e82d6b7508ff69fe1d99e626c1613a459144a795
SHA256

457bb5c1fd1beff4504e495396c739ff59432ecfffd380452812e7b0216b5cdc
SHA512

0e863d0b342c3b5e52fec0341874e203c1299a4ae245e906805efd32f43739702b4b1b7ce4462ba762c9cba977eb8334a703b7dbea85d888ffb5abb53a008324
SSDEEP

786432:Dsl6iTfRwFOU8ofAl2jpyUuMLcDxvVqyaPZR:mf2V89l2YnCcD1+R

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	457bb5c1fd1beff4504e495396c739ff59432ecfffd380452812e7b0216b5cdc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4456	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 951802.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe
4456	msedge.exe
4456	msedge.exe
3612	identity_helper.exe
3612	identity_helper.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 4456	2100	457bb5c1fd1beff4504e495396c739ff59432ecfffd380452812e7b0216b5cdc.exe	90
PID 2100 wrote to memory of 4456	2100	457bb5c1fd1beff4504e495396c739ff59432ecfffd380452812e7b0216b5cdc.exe	90
PID 4456 wrote to memory of 3044	4456	msedge.exe	91
PID 4456 wrote to memory of 3044	4456	msedge.exe	91
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 1340	4456	msedge.exe	92
PID 4456 wrote to memory of 2092	4456	msedge.exe	93
PID 4456 wrote to memory of 2092	4456	msedge.exe	93
PID 4456 wrote to memory of 1428	4456	msedge.exe	94
PID 4456 wrote to memory of 1428	4456	msedge.exe	94
PID 4456 wrote to memory of 1428	4456	msedge.exe	94
PID 4456 wrote to memory of 1428	4456	msedge.exe	94
PID 4456 wrote to memory of 1428	4456	msedge.exe	94
PID 4456 wrote to memory of 1428	4456	msedge.exe	94
PID 4456 wrote to memory of 1428	4456	msedge.exe	94
PID 4456 wrote to memory of 1428	4456	msedge.exe	94
PID 4456 wrote to memory of 1428	4456	msedge.exe	94
PID 4456 wrote to memory of 1428	4456	msedge.exe	94
PID 4456 wrote to memory of 1428	4456	msedge.exe	94
PID 4456 wrote to memory of 1428	4456	msedge.exe	94
PID 4456 wrote to memory of 1428	4456	msedge.exe	94
PID 4456 wrote to memory of 1428	4456	msedge.exe	94
PID 4456 wrote to memory of 1428	4456	msedge.exe	94
PID 4456 wrote to memory of 1428	4456	msedge.exe	94
PID 4456 wrote to memory of 1428	4456	msedge.exe	94
PID 4456 wrote to memory of 1428	4456	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\457bb5c1fd1beff4504e495396c739ff59432ecfffd380452812e7b0216b5cdc.exe
"C:\Users\Admin\AppData\Local\Temp\457bb5c1fd1beff4504e495396c739ff59432ecfffd380452812e7b0216b5cdc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=7.0.10&gui=true
  2⤵
  - System Time Discovery
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff911bd46f8,0x7ff911bd4708,0x7ff911bd4718
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14440691293955706225,15162251675249063931,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:1340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,14440691293955706225,15162251675249063931,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,14440691293955706225,15162251675249063931,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14440691293955706225,15162251675249063931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14440691293955706225,15162251675249063931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14440691293955706225,15162251675249063931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,14440691293955706225,15162251675249063931,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5160 /prefetch:8
    3⤵
    PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14440691293955706225,15162251675249063931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
    3⤵
    PID:924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2104,14440691293955706225,15162251675249063931,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5684 /prefetch:8
    3⤵
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14440691293955706225,15162251675249063931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14440691293955706225,15162251675249063931,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14440691293955706225,15162251675249063931,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14440691293955706225,15162251675249063931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
    3⤵
    PID:1456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14440691293955706225,15162251675249063931,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
    3⤵
    PID:1804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14440691293955706225,15162251675249063931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
    3⤵
    PID:5352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14440691293955706225,15162251675249063931,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
    3⤵
    PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14440691293955706225,15162251675249063931,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4756 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
74148ec2383645d88cf78b4cab3f76c9

SHA1
44ffe398633290d7fcf046503a3aef0686da0737

SHA256
f9725e0854ea135379761b348b0daeb3251f598cc928a5dbd08976de6387fe4d

SHA512
c8db2fe7e1f670c903247fe56de11e4761e4fcbd8abcad8ae63614a0403c03f0bf7e6e704c0ef51983838fb20ac3263834268a7080223d9a67e777db304b13a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1002B

MD5
f54c8dab64c420b96fcf9f696643558a

SHA1
39d1354d6e4adad9527834e3abea8f7d67ef1217

SHA256
de4d19eee04adbd97efd780f2592eb06687a03b61fab2567a5e8cb07a00a7c8f

SHA512
332bfcd1156a380cbd2bf03a29eedb9474295c4abc2e53a0546a676b5257dc33afd7a647d1e95dab05110fc9ac845031ca8ac32ced3c096040f5487e03a01b32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0d0996e6ad71a0c5976f31cc89bed062

SHA1
183be306aad0a52d3882e524859f97b4b116e442

SHA256
aafc02cad64d634b25edcb95227cf1ddf010e6c995d99637b132944cc628ac08

SHA512
27805f98f4e55763601f92b574f0b7afce094bd67e275d9f8e44bd6eb6a5f7dd6c3d681ff1ea0b98b962bbf2535a3b9be12ac23b0d5b13b72b99ba5322f78144

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b49bb37e7d694dc889a7244875a2f988

SHA1
c1e37ea8fb3c8a0d7a1dfb3485e8b96ef3087360

SHA256
f87a2d59bcd587dd30cbfc70a8616317a3da9818db3a5535e98566624e59de1f

SHA512
26f19628526c66ee2dc2e690e80fe8a227b785b71e32783f339007a8aa8f4ae32d00669a79bb41832bf3427194dfe58d07fc116a20ca533dcdf621271affaeb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
b65f9198ca926a73f5338bf7940c0c0d

SHA1
370470bd56e1ab474b22de39be9fba124f0e1895

SHA256
3d7ac1a7ea438bcabbb0634bc1d88365106d98db67272c7d0d0d6bc4beea98cf

SHA512
e0ab48c40d4b7fe70a44a662e385b472a5c981e04fe086ecde367d9e60894182fb18e6e683db0f5ca3c62455f73b174dadaf9ea74ea9ebaf3b172b679a541eab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
beaa78a028890a1ef3d1c6ac4f0823a1

SHA1
817c69f2b35126d1be1dc0c1bbb77093d392de82

SHA256
b1abfe84491a0698e5cd7afa93d9df6b4bac2be7b44e112f2f8cfbfc98edb2da

SHA512
1415d42f863ccfe6dded9b70021c004bd8d61e83573f5b0c3df3a74bc218656dda5b3b925631a1042f77aea318d19b849f8749c0f54e5224b8f8ba5a263a41a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589863.TMP

Filesize
539B

MD5
6466fc4ba867b246e0babd81ab400313

SHA1
08e36822edcc85ff82eb014cb9baef427a016e76

SHA256
b58c301d13fffc7c7153857cfec9ebbf1c8f8dc97cb6260e07dea0ea7c069220

SHA512
5b0658e0a310b6f6162304f3a7c1275265f475893f5eff80404282025a4c5b60d789ac7f28ee3b651674ffd4fe19c2f51a9207ad7315bbe95a5261541a29da61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
30112e571ea18c5cbe368592bd865941

SHA1
3a5ed0b4a753a4a12a67ad310606658de9f496fc

SHA256
870961c4f034f59930b8972996c5edbc3f8b5efb4f9a94f9ab510b0567007b9f

SHA512
6d25d7b0c3fe2bf60cb34fc819ce8397612d699a6348afdc27cd64de33bb0f8f0737f451777e301ec4535249538211daf7d083a110d9632d39dd7e2f112e738a

Download Submit