hxxps://github[.]com/Sxady/script/releases/tag/Download

Resubmissions

08/08/2024, 13:03

240808-qab2waxdqd 3

08/08/2024, 12:59

240808-p8gvcatekp 3

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Sxady/script/releases/tag/Download

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-786284298-625481688-3210388970-1000\{0F24E9BD-BA82-4054-BE1F-68C28DE9CA26}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
4200	msedge.exe
4200	msedge.exe
5024	identity_helper.exe
5024	identity_helper.exe
4592	msedge.exe
4592	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 4936	4200	msedge.exe	82
PID 4200 wrote to memory of 4936	4200	msedge.exe	82
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 4500	4200	msedge.exe	83
PID 4200 wrote to memory of 1936	4200	msedge.exe	84
PID 4200 wrote to memory of 1936	4200	msedge.exe	84
PID 4200 wrote to memory of 4248	4200	msedge.exe	85
PID 4200 wrote to memory of 4248	4200	msedge.exe	85
PID 4200 wrote to memory of 4248	4200	msedge.exe	85
PID 4200 wrote to memory of 4248	4200	msedge.exe	85
PID 4200 wrote to memory of 4248	4200	msedge.exe	85
PID 4200 wrote to memory of 4248	4200	msedge.exe	85
PID 4200 wrote to memory of 4248	4200	msedge.exe	85
PID 4200 wrote to memory of 4248	4200	msedge.exe	85
PID 4200 wrote to memory of 4248	4200	msedge.exe	85
PID 4200 wrote to memory of 4248	4200	msedge.exe	85
PID 4200 wrote to memory of 4248	4200	msedge.exe	85
PID 4200 wrote to memory of 4248	4200	msedge.exe	85
PID 4200 wrote to memory of 4248	4200	msedge.exe	85
PID 4200 wrote to memory of 4248	4200	msedge.exe	85
PID 4200 wrote to memory of 4248	4200	msedge.exe	85
PID 4200 wrote to memory of 4248	4200	msedge.exe	85
PID 4200 wrote to memory of 4248	4200	msedge.exe	85
PID 4200 wrote to memory of 4248	4200	msedge.exe	85
PID 4200 wrote to memory of 4248	4200	msedge.exe	85
PID 4200 wrote to memory of 4248	4200	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Sxady/script/releases/tag/Download
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe024c46f8,0x7ffe024c4708,0x7ffe024c4718
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,12417871082724614417,1361124382019703102,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,12417871082724614417,1361124382019703102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,12417871082724614417,1361124382019703102,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12417871082724614417,1361124382019703102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12417871082724614417,1361124382019703102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,12417871082724614417,1361124382019703102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,12417871082724614417,1361124382019703102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12417871082724614417,1361124382019703102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12417871082724614417,1361124382019703102,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12417871082724614417,1361124382019703102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12417871082724614417,1361124382019703102,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12417871082724614417,1361124382019703102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12417871082724614417,1361124382019703102,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12417871082724614417,1361124382019703102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12417871082724614417,1361124382019703102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1792 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12417871082724614417,1361124382019703102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2120,12417871082724614417,1361124382019703102,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2236 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2120,12417871082724614417,1361124382019703102,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12417871082724614417,1361124382019703102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,12417871082724614417,1361124382019703102,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4948 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
41230fa8278433427538d9bcbfb2988b

SHA1
1750db67b39afe38f9247371694ca66ac60368d5

SHA256
afa593173bb963d18d7ad0686d320a090892aafafe2141375d0282d63c943301

SHA512
ab83f326f745c95c513156a80e8a5c3154d42aa664b6c910e23515b8c67860dbb63f032758c65acb26dac3a5e736cec1409cb7464323614beaae42168f115518

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
6c9fff0181640e3893561e7d9d7db0d3

SHA1
f32760bde40bd3f62b162634350e6be22625f0f6

SHA256
e1d81f3450b5e76b8e2cd9e2a795642fa08223ad24974da46030087fdc75d94c

SHA512
c65061fc7987e25581d1ec4fcff7e5868305912298f812d2bab83679b48872851db706690d762c18d1966f1f4ab00705d5864f25e7c8abc4625d33e202b029cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
971B

MD5
2120f47118437dc026d2f821e6fd691e

SHA1
1c70f98f3e682c3ca6b1dc2b14e671fdd088409c

SHA256
a43068180f05e2e1fddc627377f7867278a38be015887ba0915ecc48efec3b32

SHA512
c81900d6abfcc58e0d3a8742906e3ed732d55a34a15b2450433ff343e9b4e4141ca09880afb18e9416f7fa8ec563eff7aad08d16fe8207ee8e13bd5b7b08d7bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
78554157e823128c9ca487f9a807f5e0

SHA1
9dc4669bd5a7823ef71b41182b72e14077d2eb52

SHA256
0e4d319cbf2eecfa0733093d8542bca68b5b66af78820be9fb72771aadee644c

SHA512
7fa65a34de7b2e4ea8c357525f5d0de1591cc34d1b5951c1857982d3b7013112a281d48a3e98b93271e3a2ff108eafa9a6fd3a5cdd2c6a0e0fda00da6ee3b87e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5c2942ab88a62efc1220aff34a19b9bc

SHA1
d2ca6e11966b447c28d1434d9367eb8688ebff4e

SHA256
832b9d11607c82ac2df07737fd2c39d7d703a682760a37233902c69b1bf38885

SHA512
ec3005abd486953a25840dcc44b68f88a248fe0e9d44a45c06f658d57c266017422c3a604375a19363330fc58d6f1a72bf16ba3729f28db06cc47667a2fbaeb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5798d5d2189bed9ecde203fbf80e1b96

SHA1
9a8fee0542a30ac90c1a5d0d4c407b8e3a5c3a94

SHA256
10171c226f6064404be0675fac5901052abbce6d49542dc2aae50ccac218b547

SHA512
ff82c5705f96c03f710aef6d567dce94d8b6ef4ebaf2005c5c06809f65f6c52b32648e2cc6349d39e4c52844efe661bf99d87ae0c3dd446fcf910d47b154fab3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f18d1707b87e0fcf7b41761d2ae493e8

SHA1
c542c4b36fd552f3fe7ce3d4ab950ac6cd6a368f

SHA256
501cee30a8926963ea34d776b1bf3de3e1c4f92eca53a7df2717b302e43bb71d

SHA512
1ca2bab07969a57111acbffc4addd349efca7717077a9b91109ace4ab4e2c5871bcc55a8c93cbd653e4d01ca662869deb86f39a13b7fcc3c06ceb2cb9ff1db48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
9752e374b3b89ac4c435da3ca16bb08f

SHA1
827e8ec00a646ae99c57d850dd4ebcaae5e440b8

SHA256
7f72c16b9b59f0be437b1087a68f946eb34d53a8e002c4ad82af2829d9316cfc

SHA512
685ef145ee05736a96ea8a86d41cc5a468e3648209e833bf085564083b0aca02f2ce5b7e7f45fe2368b8b8ccd0e78deb96eaf9e991bc65a7dd65e407370d84e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3a2330a63bb61ba94116eee7cfeec41a

SHA1
28cf826bd52c2959b0f24dc7b0274e37030c544e

SHA256
c07456da52898c6de0eeed64ca7f90ec8b475a428ad64ee1aab31172cf395178

SHA512
94f6dc8034e0377229780a54168b83b9876d89427830cd791a6107b59c2681fe7412a5279da5e38d086e7aec6c5c0190edbe5f90032eabd4f95728f25b6c3688

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
4c619a5ccc4fe7de2e8407eef935e091

SHA1
352121dadbfa34c3bc016d966fbdafe701ad9173

SHA256
bb57e69062a2a0d7ddda45bee93121ead0732e9f87fb6d56e03ae8e2d4dd1be9

SHA512
5d70752b7b95dbe80d6435fa277b1f9a3f14b85d7f2fe1101f4d6b5601b026d478cd2194010e658b99824e2938e5bdc13d4b402f0986553d3c9986c088441114

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f58b.TMP

Filesize
706B

MD5
a95174b48c1aa3659784cbd6252eccaf

SHA1
df31660665d6d6c5071796db4dd82f1e66afe459

SHA256
7d55cdeceadb001dcd395ab3d1ad81276aa3b875bcb43ea28cb4e2238749b008

SHA512
0bec412e86f812272ab324c24cf96a120af1eace234bb96327c306cb50a9a3b039e4f139339db8f256bf100ddef6a217ea8073c7bc89c71fdbd2a7509af87814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e0417421-4993-49f7-a043-5f86fa0426ab.tmp

Filesize
7KB

MD5
4d90484713d10f6161777e3f2fc2bfcc

SHA1
09ab652b35b66d45f8576605b7b0ada60da662c0

SHA256
b7d8cfea28717ba3559236d5a29424d8acfff189e2a0810f8a28025a0b352275

SHA512
d31a2e7f70133d177511c1a7e345d26dc9ca5d330f74f41609f0d3bdc7444e0bc3e3d3d24f1c653a2ec0c42a366438ac76326d8bc0ad062bfb295aef4d1e5563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6cfe329df84323b7b32aa2ef2e7b2397

SHA1
2c2cbe5c22ae7be3cccacbfc26c97f51211cd94c

SHA256
a9b271353ddd9e4e754effba9b4aef371ea571c7de282c8dfe469ca21ea807ca

SHA512
86d8be25146992b67af9570cfef372771002cb3ab30f95200ceae5eba30ad4850878818640f7645aa707381bc40227d4dc0582c7f1ea7b194b550f8eb850376f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit