b78c67f56b7af5533a502fef2ed9b0ce4c9d507214a74f7d0501611941197b75

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b78c67f56b7af5533a502fef2ed9b0ce4c9d507214a74f7d0501611941197b75.exe
Size

7.9MB
MD5

d23710b05767ac5d4e1d4754f468599e
SHA1

6fbe21034afe7850a1e608ea67460c25aebb4232
SHA256

b78c67f56b7af5533a502fef2ed9b0ce4c9d507214a74f7d0501611941197b75
SHA512

e021881e5050b14ab78bcaa686d180b88ac620876cd45525b7648b04a8b672010832a3e8f40221c1e6420b9f6ceda1918a2cc04eb56db9dde39aae3c63dc8a37
SSDEEP

49152:3w6bme1pELMSe6zca78NfGBN3Adr5wUt8VfMh01K:3wsmspEwSKNNr5wUtMMh01K

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b78c67f56b7af5533a502fef2ed9b0ce4c9d507214a74f7d0501611941197b75.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
4204	msedge.exe
4204	msedge.exe
1804	identity_helper.exe
1804	identity_helper.exe
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 4204	4812	b78c67f56b7af5533a502fef2ed9b0ce4c9d507214a74f7d0501611941197b75.exe	93
PID 4812 wrote to memory of 4204	4812	b78c67f56b7af5533a502fef2ed9b0ce4c9d507214a74f7d0501611941197b75.exe	93
PID 4204 wrote to memory of 2064	4204	msedge.exe	94
PID 4204 wrote to memory of 2064	4204	msedge.exe	94
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 4268	4204	msedge.exe	95
PID 4204 wrote to memory of 2284	4204	msedge.exe	96
PID 4204 wrote to memory of 2284	4204	msedge.exe	96
PID 4204 wrote to memory of 3568	4204	msedge.exe	97
PID 4204 wrote to memory of 3568	4204	msedge.exe	97
PID 4204 wrote to memory of 3568	4204	msedge.exe	97
PID 4204 wrote to memory of 3568	4204	msedge.exe	97
PID 4204 wrote to memory of 3568	4204	msedge.exe	97
PID 4204 wrote to memory of 3568	4204	msedge.exe	97
PID 4204 wrote to memory of 3568	4204	msedge.exe	97
PID 4204 wrote to memory of 3568	4204	msedge.exe	97
PID 4204 wrote to memory of 3568	4204	msedge.exe	97
PID 4204 wrote to memory of 3568	4204	msedge.exe	97
PID 4204 wrote to memory of 3568	4204	msedge.exe	97
PID 4204 wrote to memory of 3568	4204	msedge.exe	97
PID 4204 wrote to memory of 3568	4204	msedge.exe	97
PID 4204 wrote to memory of 3568	4204	msedge.exe	97
PID 4204 wrote to memory of 3568	4204	msedge.exe	97
PID 4204 wrote to memory of 3568	4204	msedge.exe	97
PID 4204 wrote to memory of 3568	4204	msedge.exe	97
PID 4204 wrote to memory of 3568	4204	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\b78c67f56b7af5533a502fef2ed9b0ce4c9d507214a74f7d0501611941197b75.exe
"C:\Users\Admin\AppData\Local\Temp\b78c67f56b7af5533a502fef2ed9b0ce4c9d507214a74f7d0501611941197b75.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b78c67f56b7af5533a502fef2ed9b0ce4c9d507214a74f7d0501611941197b75.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xfc,0x108,0x7ff9a94346f8,0x7ff9a9434708,0x7ff9a9434718
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,6549458483121323565,9020413099871403605,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
    3⤵
    PID:4268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,6549458483121323565,9020413099871403605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,6549458483121323565,9020413099871403605,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
    3⤵
    PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6549458483121323565,9020413099871403605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6549458483121323565,9020413099871403605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6549458483121323565,9020413099871403605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
    3⤵
    PID:3740
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,6549458483121323565,9020413099871403605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,6549458483121323565,9020413099871403605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6549458483121323565,9020413099871403605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:1796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6549458483121323565,9020413099871403605,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
    3⤵
    PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6549458483121323565,9020413099871403605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6549458483121323565,9020413099871403605,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6549458483121323565,9020413099871403605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
    3⤵
    PID:1020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6549458483121323565,9020413099871403605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,6549458483121323565,9020413099871403605,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1332 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b78c67f56b7af5533a502fef2ed9b0ce4c9d507214a74f7d0501611941197b75.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a94346f8,0x7ff9a9434708,0x7ff9a9434718
    3⤵
    PID:3864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2f96cc5d-aae6-482e-b4d3-0993fd471755.tmp

Filesize
6KB

MD5
3ba082bedac3b83585a5f645c9e1807f

SHA1
1dbb4ef16dd85c4bf2fcbb07f4ad351bdf5b6e6e

SHA256
ae811df56864c8dab1396c6d5462ec73726310e344a6f8e2f0ebf2e27262de33

SHA512
a90cb0af28751ef89100648ee11610978b2a889f95eed15cc3a84c87f0397b3c021d835f059aec6f5d6117d7691e0e8ec6f36457000a85797278e75326547401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
4c0cd8931f2e00a837350ec8f2b9054a

SHA1
81f01643279237f34b94bd18ebb404491d5978b4

SHA256
a5210e57508e756d7e5da4370f18c93ec67575be97b4ecaa958ab8681191f764

SHA512
d3deca18fc549c9ca3437ab4d8b4f8ee1d6a3e3e4065c105918bfc2905b5fe37294b9f5c7f2f0a85fb0c33fc8b3febc130e31b0e213bd7c1d9649af8734da0fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e705fe45069a4718c708c44f17083f6c

SHA1
8150d3ec4ccf3bf4d3cf66280f30d581058882b5

SHA256
60917b4d7bad1009610d12a9ce9aca5bf6a4ed663222d1551955b3f44d4fb31a

SHA512
d6a347bdfae26a28cca3cfcb969dc541335a1e8d29889c0554f01dc52592b33bc2cedf2dd190f039b5eddeb0c881226b26acfe569160513d700d635a42798a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c1519c9045c4bec7c71e6e3814be0bf6

SHA1
aba511264e01d54e7fdc830a1d71b65022698876

SHA256
7f7389cb60a12c1f52f867c8d1c4c2b1e1b4128910ae050faa81daee66ceeaa7

SHA512
9fad0494ce1eec318b361e4f3f88bab977233c5f30997215c3092571d8eaa0a4d49821fbb1693d496c9e4f34443907bfad6bf949fc413174676a80135e32c77a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
618db45c48646942a6de4dc092215a36

SHA1
05f7e5cc2ac1094b3e147520d451e88014926064

SHA256
e8a766ec4280cdb93c081239b065c88e37dd6c792db3956e9cea6e768e72de4e

SHA512
ff4e6c179bf37d8a85d599acfd8ef87cb4bf3e15c1052e89c1dc86a03775b29012c6810c259935521f35f7fcf4d78bc3e718b6e2107c5b0b08b4e31557806fdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580ab9.TMP

Filesize
371B

MD5
0b84eb9ca6d6307dd9b61777909bdceb

SHA1
0e3b5c6a3e7ee5fc1eab1a0eccdf533e2256b616

SHA256
e52749e6ea94e2e5e6bd281e90bf37f76fb2d0fe9a51e3bbc3322c1d7159d3c3

SHA512
f56e0385f10a661857ecaa7ac148cecee16dc31e0f8ee8109ab37eff19db9be3dfbab683ebb3238a25f5bbb66a1bed3e85a9db3a5fea1f431eec3352a8c21d27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fb1ec3bd-bca6-450e-aa6f-fbbea6b5cb03.tmp

Filesize
11KB

MD5
47a28b70a27bf97d360024164e09e9a2

SHA1
a0e75aa06e755b60772932b1471fa931f6040808

SHA256
ee85255f8cdcc8100e1fc243fa865c29f0840e18594d3523db0880f4fd9022b2

SHA512
567e9152c59b518e163e3b8c8523ce19a9d6bd2fe8a4a133262a1a0af80b3941442228edc16bdcbed5c2db1407290bfa7a4f92676fa803a884ac2fc71a792f3a

Download Submit