457bb5c1fd1beff4504e495396c739ff59432ecfffd380452812e7b0216b5cdc

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2024 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

457bb5c1fd1beff4504e495396c739ff59432ecfffd380452812e7b0216b5cdc.exe
Size

39.2MB
MD5

706c6dedf279f61d8b00eef8b1d240f3
SHA1

e82d6b7508ff69fe1d99e626c1613a459144a795
SHA256

457bb5c1fd1beff4504e495396c739ff59432ecfffd380452812e7b0216b5cdc
SHA512

0e863d0b342c3b5e52fec0341874e203c1299a4ae245e906805efd32f43739702b4b1b7ce4462ba762c9cba977eb8334a703b7dbea85d888ffb5abb53a008324
SSDEEP

786432:Dsl6iTfRwFOU8ofAl2jpyUuMLcDxvVqyaPZR:mf2V89l2YnCcD1+R

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	457bb5c1fd1beff4504e495396c739ff59432ecfffd380452812e7b0216b5cdc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2804	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 693016.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
2804	msedge.exe
2804	msedge.exe
4812	identity_helper.exe
4812	identity_helper.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2804	2264	457bb5c1fd1beff4504e495396c739ff59432ecfffd380452812e7b0216b5cdc.exe	93
PID 2264 wrote to memory of 2804	2264	457bb5c1fd1beff4504e495396c739ff59432ecfffd380452812e7b0216b5cdc.exe	93
PID 2804 wrote to memory of 1560	2804	msedge.exe	94
PID 2804 wrote to memory of 1560	2804	msedge.exe	94
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1572	2804	msedge.exe	95
PID 2804 wrote to memory of 1612	2804	msedge.exe	96
PID 2804 wrote to memory of 1612	2804	msedge.exe	96
PID 2804 wrote to memory of 620	2804	msedge.exe	97
PID 2804 wrote to memory of 620	2804	msedge.exe	97
PID 2804 wrote to memory of 620	2804	msedge.exe	97
PID 2804 wrote to memory of 620	2804	msedge.exe	97
PID 2804 wrote to memory of 620	2804	msedge.exe	97
PID 2804 wrote to memory of 620	2804	msedge.exe	97
PID 2804 wrote to memory of 620	2804	msedge.exe	97
PID 2804 wrote to memory of 620	2804	msedge.exe	97
PID 2804 wrote to memory of 620	2804	msedge.exe	97
PID 2804 wrote to memory of 620	2804	msedge.exe	97
PID 2804 wrote to memory of 620	2804	msedge.exe	97
PID 2804 wrote to memory of 620	2804	msedge.exe	97
PID 2804 wrote to memory of 620	2804	msedge.exe	97
PID 2804 wrote to memory of 620	2804	msedge.exe	97
PID 2804 wrote to memory of 620	2804	msedge.exe	97
PID 2804 wrote to memory of 620	2804	msedge.exe	97
PID 2804 wrote to memory of 620	2804	msedge.exe	97
PID 2804 wrote to memory of 620	2804	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\457bb5c1fd1beff4504e495396c739ff59432ecfffd380452812e7b0216b5cdc.exe
"C:\Users\Admin\AppData\Local\Temp\457bb5c1fd1beff4504e495396c739ff59432ecfffd380452812e7b0216b5cdc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=7.0.10&gui=true
  2⤵
  - System Time Discovery
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff89ef546f8,0x7ff89ef54708,0x7ff89ef54718
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,3300839023529217714,3167740759199455963,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,3300839023529217714,3167740759199455963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,3300839023529217714,3167740759199455963,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
    3⤵
    PID:620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3300839023529217714,3167740759199455963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
    3⤵
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3300839023529217714,3167740759199455963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:3508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3300839023529217714,3167740759199455963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,3300839023529217714,3167740759199455963,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5216 /prefetch:8
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3300839023529217714,3167740759199455963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
    3⤵
    PID:3552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,3300839023529217714,3167740759199455963,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5792 /prefetch:8
    3⤵
    PID:456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3300839023529217714,3167740759199455963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,3300839023529217714,3167740759199455963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:8
    3⤵
    PID:2176
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,3300839023529217714,3167740759199455963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3300839023529217714,3167740759199455963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
    3⤵
    PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3300839023529217714,3167740759199455963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3300839023529217714,3167740759199455963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
    3⤵
    PID:5348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3300839023529217714,3167740759199455963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
    3⤵
    PID:5356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,3300839023529217714,3167740759199455963,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2320 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
0ee157da7678474b6c0847706862b262

SHA1
fcb233088b3f00479105bcb318cbe790d9a23996

SHA256
30d4b67532be798f7056da3f359fd3b39cd36dd155e95c75d7006d572492b421

SHA512
3c0439fc3827ab44791cb03f2a4caef6f0250b1c91e8f36a4d5682923f2ed97a6fb48917d8bd7407075c81de9168f3be272bd2bd33d6467fb9f8ef03f765e5c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1002B

MD5
b5c55e7dd3a0cbe17bd43a5cecdfbc36

SHA1
eafbb34257f07c0e69238a89483927c1ce41fdbc

SHA256
afa293b96e2c0c988b950219adbb163e5316539285d41d0d7aad110ff0882f8a

SHA512
791b952bea97b37b9dfd2463d298581265efc8ec27e69e71a8ad91cfe299b18e81fa78e88b67f76591135d588b9d8d144e8631862fca6ead8674aa8be969dc86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e52151a9aefc49615b187653f0dc65bf

SHA1
3b1ce96b256c3272f831df4f6cadd4e90ed7efb7

SHA256
1cf813efd49b27b607fe1c85d19a8ccd9f876e3fc1645363ff7aac398c823cc4

SHA512
49ed4e5c44536326784ebd2fad8cb145b46e35b361c96dfa0e378e077790613fcc56b125aac596b344214d0d1f4a65941de0649dd4e36073e1bcc34451037cdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5f9726327dfd908886b6bc779e5122f2

SHA1
11ef6dbe7d6c57d283f9df14e9e2db8ba8084cfe

SHA256
c6e85a7d904906700750230a2b788a026e45f68a0b8413ab1502247ffea68651

SHA512
c0552c7bc3196d523b026921f64d1be3406749d665a03de834b115a9651d262fba31448018a0942783e8a19876ae0fbcf4a83febe721efb945f900d765bbc10a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
c1fc036e607fb88fa1de55cabeb40737

SHA1
71d3a7ab97f2042907c3b50a843e9250c8437600

SHA256
68a149cf0f92c91712c933143d57d77ab402734dd7c29278adb4538616bf738d

SHA512
5d1d805e8815adf384ca0834f1b66e9de092ac08985f0ec11707edc6bd0c130f6e7e6264f424d9454a85156ded3c4d30ccedb4bd7ac5baf83fcec0ae68773152

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
c2c37ff934b9ef39fae23fa2fd3a34b4

SHA1
d461a8511d7cde863dd1aa9a1a9bba09bfffd312

SHA256
7b999b4698ce88e8f1ff1cd084fec04e61c2cc262916134c5dbb1ab9c0c928ac

SHA512
bb3be7433bf984737025eb4a6b3784778c736d3cfd672004d1b4f595b67cd903913857a88e4fdedde9bab1bf033dfd339b5cad67586b4702504006d2752803e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b0fc.TMP

Filesize
537B

MD5
659f895c1524174d99df1832a75f8660

SHA1
45eec22fd2021e149efc92a37ad1609657443b2b

SHA256
1a136ad7fd36a8e008b7536277e1832639e7c18e490cb6aab473c6c4a5443382

SHA512
6919b8322edbd6516410cee7133431f93337d37f8211327c42df790c806ad741fd2249e57cafeea7fb49585d74748297e1d570b236cf9289574fc1e65e51c84d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
daec9bd92c231ce2e0bcc539b1911684

SHA1
50f8a1a632984965c191d77da32425e800a1f038

SHA256
35f5ab9064d6f37b819bd05dd3afc7195edf004f7d57317476d14e4f91f1751d

SHA512
e628a7984f9947b5bd0e27851c4a187a4538671415cfec0278c508417754887e9f27e65b98d37893d2ded78a9c891d5a84f8d5ee90aaa5b2f33e34f602912247

Download Submit