bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa

Resubmissions

03/08/2024, 17:39

240803-v8nksazfrk 3

03/08/2024, 16:07

240803-tktlfssgph 1

03/08/2024, 16:02

240803-tg6rlsybnj 1

Analysis

max time kernel
982s
max time network
986s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42.zip
Size

41KB
MD5

1df9a18b18332f153918030b7b516615
SHA1

6c42c62696616b72bbfc88a4be4ead57aa7bc503
SHA256

bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa
SHA512

6382ca9c307d66ab7566acf78b1afd44b18b24d766253e1dc1cb3a3c0be96ecf1f2042d6bd3332d49078ffee571cf98869c1284c1d3e5c1c7dc3e4c64f71af80
SSDEEP

768:hzyVr8GSKL6O3QOXk/0u3wqOghrFCezL1VFJdbq2QTJTw02Q:hGx8DKXE//ZhhCirFi2cwK

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-786284298-625481688-3210388970-1000\{CD4A7AD1-6936-4E07-9CBC-825CEDD06994}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
1628	msedge.exe
1628	msedge.exe
1712	msedge.exe
1712	msedge.exe
2884	identity_helper.exe
2884	identity_helper.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 320	1628	msedge.exe	89
PID 1628 wrote to memory of 320	1628	msedge.exe	89
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 1992	1628	msedge.exe	90
PID 1628 wrote to memory of 2692	1628	msedge.exe	91
PID 1628 wrote to memory of 2692	1628	msedge.exe	91
PID 1628 wrote to memory of 968	1628	msedge.exe	92
PID 1628 wrote to memory of 968	1628	msedge.exe	92
PID 1628 wrote to memory of 968	1628	msedge.exe	92
PID 1628 wrote to memory of 968	1628	msedge.exe	92
PID 1628 wrote to memory of 968	1628	msedge.exe	92
PID 1628 wrote to memory of 968	1628	msedge.exe	92
PID 1628 wrote to memory of 968	1628	msedge.exe	92
PID 1628 wrote to memory of 968	1628	msedge.exe	92
PID 1628 wrote to memory of 968	1628	msedge.exe	92
PID 1628 wrote to memory of 968	1628	msedge.exe	92
PID 1628 wrote to memory of 968	1628	msedge.exe	92
PID 1628 wrote to memory of 968	1628	msedge.exe	92
PID 1628 wrote to memory of 968	1628	msedge.exe	92
PID 1628 wrote to memory of 968	1628	msedge.exe	92
PID 1628 wrote to memory of 968	1628	msedge.exe	92
PID 1628 wrote to memory of 968	1628	msedge.exe	92
PID 1628 wrote to memory of 968	1628	msedge.exe	92
PID 1628 wrote to memory of 968	1628	msedge.exe	92
PID 1628 wrote to memory of 968	1628	msedge.exe	92
PID 1628 wrote to memory of 968	1628	msedge.exe	92

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\42.zip
1⤵
PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc0ffe46f8,0x7ffc0ffe4708,0x7ffc0ffe4718
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,15801786742554730824,4387402555626261809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,15801786742554730824,4387402555626261809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,15801786742554730824,4387402555626261809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15801786742554730824,4387402555626261809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15801786742554730824,4387402555626261809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15801786742554730824,4387402555626261809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15801786742554730824,4387402555626261809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15801786742554730824,4387402555626261809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2040 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15801786742554730824,4387402555626261809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2168,15801786742554730824,4387402555626261809,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3144 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2168,15801786742554730824,4387402555626261809,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2056 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15801786742554730824,4387402555626261809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,15801786742554730824,4387402555626261809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,15801786742554730824,4387402555626261809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15801786742554730824,4387402555626261809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15801786742554730824,4387402555626261809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15801786742554730824,4387402555626261809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15801786742554730824,4387402555626261809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,15801786742554730824,4387402555626261809,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4384 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4773e1b5e7154b5aefa4b7eef1c86edd

SHA1
c6b816438587e52e0a591fe82754322715928398

SHA256
19dbcc848e0361b5f54551dc392778d395fde4537f839c880372cf51a9b2c221

SHA512
77a4ee8b05bc6407e469284b2280282e30b66d210b01212c0b6ccdf5086d2aa0f292298d8b20d85c8e69a06ccfb38e8eda6fea292dc486c4dac721382c0c2417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
696B

MD5
c80f94df9191e40e5b41e31db2797759

SHA1
8b16d18729b7eddf50b82afd7c9e8012dc103841

SHA256
fde3336d8ddde4e55f062d202b392872cc7ceef3f048068ffacae4646a48f874

SHA512
1f4bfe5d4ebc188a1a9a48b5fa2285cbfabab6f265a5f7434ca9a65575e4e5e8bbd77a1a88364e6aed8dd8975a91322b6794c458456620afc87bbcd859155987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9cd6a131c4248bafff592140f990de55

SHA1
08bdbe4312c185ae6838dd20ce15014c0d62a681

SHA256
269e75c355c50daebd1f0ebc19707e6eaabc7cd2c6306fc7757c7e35c3b94c6c

SHA512
0152a0e335cda8a6d5c1424892bc722938476cd7f514bffde7b8caa8d239c97e9d35031ae9608f70f9429208f885b2995884625e81fa0062d3f954633e818d96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c4478b6bd4abdcae18e688e90c22338e

SHA1
7e22c675dc3506b895139b120b51da71142554b3

SHA256
201ba56a2ad26bef2da97493573107cb87e9e17497e003e4f93e6768d29bf1a6

SHA512
9c278fd1ca1bbc56636b25c561834fcc410e5fd7ade5de4f16247b99bbcc1b9f40acbb4ebb9aea319cfb9b8bbcc7e71a276cb5968c0b2ba4a511f3ed500ada8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c21dcd649547db9929e51468d58f0a42

SHA1
0b32aab2e42267b84b850ff463bc762e9b162006

SHA256
19a0518c48fd97c8cd4ab4366d087ab70e0ac837318e41b553263992b05fa3c7

SHA512
b108523befe0aad434552b75970771578acc6fffa00d461358ff4ad0b82a53a3b1efb29ac3a51bcf8d0c6eb04040e42a713ad20166e92c23937f5ebf6c0094b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\edfa82a3-6ae8-4590-95d5-38d32835c3fa.tmp

Filesize
6KB

MD5
6a7a28d7236f0fffd29488309ae3a9fc

SHA1
ff5d1219fbdf01fa19f0947fe9e482d984d75ae0

SHA256
37d2dfcacf4ce557599655bb75a6f4ff419c12909eb6ba63e95d9a8b588c7da3

SHA512
52bc1ee1f5a4e94a6872d89d0b369a116ccb6ef49da0b7bb27827336b8f7b395d41bd900dd61cc9f340d1c5c8427c066d8806dbe7d9a335658ebdb27c4239dae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
deb393ca7d4396d8a01d52f788de489c

SHA1
09ed34eb49b1153cb93bd3f0af176f0e4f79dfc5

SHA256
f54e7513e92f2a85dd1d2b827a8766536548f6e0c4f98a8fd89717de1679434f

SHA512
265d1af680673b8bae5e24e04c8ff3528d5a522680a7dc42c6ec84925a3607e43108c5f95c60ced7f0cb869153b0faa35ac33eaff43b52801c72dd72dc1a387b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
78b50bace499e7a48348ddc460e57bdb

SHA1
7a8f52fb12c7b02590cca81c42e702f5cc21af14

SHA256
5d1abb72177994d7d6d8dabb6f1fd56a1e1b67aa537feeb7218ba35ea0c602fe

SHA512
bd2b5b238061d652f71de1b9aa813752c3f83dfcb309007aeebf4012dfb73906aa14b456c26dcd7bf8eb6cbf442cd5337de8dc9b1da3e00c831556f9a655f3a2

Download Submit