hxxp://aes[.]org[.]co

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-es
resource tags

arch:x64arch:x86image:win10v2004-20240802-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
02-09-2024 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://aes.org.co

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
2472	msedge.exe
2472	msedge.exe
1820	identity_helper.exe
1820	identity_helper.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 3896	2472	msedge.exe	84
PID 2472 wrote to memory of 3896	2472	msedge.exe	84
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 2956	2472	msedge.exe	85
PID 2472 wrote to memory of 4908	2472	msedge.exe	86
PID 2472 wrote to memory of 4908	2472	msedge.exe	86
PID 2472 wrote to memory of 1124	2472	msedge.exe	87
PID 2472 wrote to memory of 1124	2472	msedge.exe	87
PID 2472 wrote to memory of 1124	2472	msedge.exe	87
PID 2472 wrote to memory of 1124	2472	msedge.exe	87
PID 2472 wrote to memory of 1124	2472	msedge.exe	87
PID 2472 wrote to memory of 1124	2472	msedge.exe	87
PID 2472 wrote to memory of 1124	2472	msedge.exe	87
PID 2472 wrote to memory of 1124	2472	msedge.exe	87
PID 2472 wrote to memory of 1124	2472	msedge.exe	87
PID 2472 wrote to memory of 1124	2472	msedge.exe	87
PID 2472 wrote to memory of 1124	2472	msedge.exe	87
PID 2472 wrote to memory of 1124	2472	msedge.exe	87
PID 2472 wrote to memory of 1124	2472	msedge.exe	87
PID 2472 wrote to memory of 1124	2472	msedge.exe	87
PID 2472 wrote to memory of 1124	2472	msedge.exe	87
PID 2472 wrote to memory of 1124	2472	msedge.exe	87
PID 2472 wrote to memory of 1124	2472	msedge.exe	87
PID 2472 wrote to memory of 1124	2472	msedge.exe	87
PID 2472 wrote to memory of 1124	2472	msedge.exe	87
PID 2472 wrote to memory of 1124	2472	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://aes.org.co
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca65646f8,0x7ffca6564708,0x7ffca6564718
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,17677498009627673010,3280378547054972446,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,17677498009627673010,3280378547054972446,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,17677498009627673010,3280378547054972446,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17677498009627673010,3280378547054972446,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17677498009627673010,3280378547054972446,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17677498009627673010,3280378547054972446,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17677498009627673010,3280378547054972446,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17677498009627673010,3280378547054972446,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17677498009627673010,3280378547054972446,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,17677498009627673010,3280378547054972446,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,17677498009627673010,3280378547054972446,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17677498009627673010,3280378547054972446,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17677498009627673010,3280378547054972446,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17677498009627673010,3280378547054972446,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17677498009627673010,3280378547054972446,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17677498009627673010,3280378547054972446,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17677498009627673010,3280378547054972446,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17677498009627673010,3280378547054972446,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17677498009627673010,3280378547054972446,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,17677498009627673010,3280378547054972446,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,17677498009627673010,3280378547054972446,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1360 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
94KB

MD5
308cb3337d40b0dc9c24d5a94d8a798a

SHA1
95d8e99c2df61833d40dc61150b98f75de12e1cd

SHA256
40c82fd63b073de3a5d785d98e05dc8ecf85d4043a451a8a78d80c4b736930db

SHA512
ed0479ed6cf63bf634af9dfc9ffe59094d950314dd22a401638ed23cfdc98dd1ad6d262e33b0fc8f8eb23feeb16505a2e1e04934cce35a3c4c29ce43ff3dcf23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cb7ca89e04f1acc088b99c1a47cc4d2c

SHA1
ba287301c33f7c940a8554e2a1be05fd08873fb3

SHA256
840e5ac90aacb18c0f8ec6231d88fe456f3072f592ce67fb4f6ffd350062ed74

SHA512
32ce696f748cb96d14302399e1fb8458d7f2dc97b2fdf7eaf1db65367aa6b11962b099ef0368d4b0fdf03532833710ed7d8c8e9e22eda76a555170a254b5033a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e708645a5d6534365f3f8ca45a228546

SHA1
3b986c20b7fcf2bfb6f381f90dee9fef1dbb1086

SHA256
7ff39829958c2805aa0ba44c32143bea6bdf80e1e01c2670fef69f5e69a05533

SHA512
97ede151c875e4a5dc4bf552e9e2e0e914baf0707a85fb7dc05bbf0b6f182260dae44fb08e6ba415dea490989f1c56408502c8c5fac7ccebc20c10d285ff065d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
620a64c4b77bf13c30bc1712ebed5825

SHA1
2bcb1a564620122291773d985279c30953f0a1a7

SHA256
05edb7ebc59634ba89407f57a8453e533a78d1957f1b36cbd3e34ee883011c6f

SHA512
72b539304dfd7c9ab1ed665e5b8ab5269625f48399f7884d6c931c709ef4b1992b5ab52c09f2039c9f2647171b5fcf6943760df77c984c2d016ddc3c19247be6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
65e24226cb803f9dc1437dac8fd4e7bb

SHA1
2b535e2b7dede57665793a10e345b5effd865a66

SHA256
5d2e3f7e2c49ee47835aaff5eb3f561aa976b33370974de8582d539bb853aa8d

SHA512
a4a951af149739f184cba8f88e4465541b659a0f4963b1b038b3f4113d03d72baaca9225f31fb1612a0ddfa016cd8fe616b078280759599851c162e719e7a2b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6c082fb9f26acad7db10b030ecf67f19

SHA1
9bc4cebf32cfb8647ccd892ae274cbb210cb188a

SHA256
a3d24e73692fa43436a213fa6c8c9380b0da114478f089fccd3b0cdb7df7f92b

SHA512
8de407f38cb167d58b8e48f6e1c52084478ab7a20c530c78bc3c685d4740bbe45eb1782d3e3d032975689b6fef61783a2b3bef29a22bd8df84350c3071adbb57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cc1ce9286e0874058a5c74d2a29382c5

SHA1
e751b35a9c76ad6abdd95d808f0e4ca0dc1b7383

SHA256
73946ef41be27a536cddf67d1550db6776c4eb9fcd6231b90678ea67b434367c

SHA512
c46b331207cb8807a2aa3fa90c437756e7dfb9bcc1bbc568b8247a3e88be32c9b1d9c96aef1d8d5c57f0e02f834a65124c5d1211011516644bec29fd0903c7dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
053523f61091fe24429b9d67d9feed99

SHA1
6241c6fcb9238124c630204f1e21629e224e4450

SHA256
4bfd3cbe47758e8d9200abf028dd24e99b1eab5ed2e5ece7f836dc47a898bdf6

SHA512
169b36cb34944ee418c30664bd1139990976d02de37d97ecb2e05a9cc320378ae957b541846401f1a97f0247be3da37246101c5d4939209027877a6ed3584dc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
95df7a9b98e392da1d9a2c44fb77ee5f

SHA1
d5e2a38d5ee57a4ff76eca62de729eba2c1ee335

SHA256
9285fbe06a30c34ff1d900701c310ed68ae9d8a04cf016bff93b217bd17c2055

SHA512
2cce727795054a8f0101b14b4cc771883308ca45cdbfbdcbdb6235b03e52fa358b9c840a9af1c8666bc4f1dace14492c162e2b3ff5b06c263127629b747c937d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d2f73cccfaf57f1eca51da0aa292cf26

SHA1
48159735e4ff4c10e5e95e26ef68461d2553749f

SHA256
e398bcc147ff947956b12e267755ab364908054b7ac4cef8e9f215fc1824df97

SHA512
4e2ff844f2a97d396c24f0334509a3ea503bad171cc3de761686fb0cd092df0a9ce29f2eb8365c266520a67daf634ce8db691333eda1b20282fb85af1483211e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5885f4.TMP

Filesize
1KB

MD5
c466da5605294771c23c8757a582f94a

SHA1
efaff6335561cf1561b4ad138a213f03cd3ea0d3

SHA256
59b79e68b1f229ad8a1734123ed05a791507c3fcdf15d865b48cbd1be55d3a4d

SHA512
66ece6d577bb2734d0a9cb1eabc1e0caa8628bda29e2ab8c6792fe1b31733f45f9b055c3281148dfd52a77bc7675a8c0cc09b5bbfedc0b328b0f64a33df0c5fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e3772e274ccb0a270705f5f58a83f5da

SHA1
00829d5afc6bf864308a9a745824f1ca41a2ccfb

SHA256
ef4691f9dad3b1b11f4e15de80045c7a1605dee6a7abbcd791225b0f4ee59310

SHA512
e0f8acd1afca0cfb8ba68fbd6ced556d96d67928db936e9fd344df07411d934af11d7ea63510a6ea9172430eaf5653a6dd44fb03558cec9cb43b2ca58ca70a4a

Download Submit