hxxps://igotchuseasonings[.]com/_t/c/A1020005-17F9FF4D17AC91B0-76F853B7?l=AACkfU8A%2BEWIr638OVMqA2mrOuC4wdq3Ar9xIGrOYEM6IiKtU30YrN8cNct3J6F2c03sVDBmAB7%2FSzNxWHE%2FjNg1%2BGufSTHWiu%2FsGTDsYsyL7zDV4u96q5LEcLujjBYW3i6TlWqQADhH8Z%2BJ9IqJngnxFByebxef4tLSbi%2FMKTuaEEJFc9kxUWV2ePMby583u7UGW3BoKFj4FS%2FoAeQperlfZJGmmd4bPxzufMHoZi20xr7vBGRBKAfBVGUzYMLmoIn1kAaPQg8s6XyNu86g4%2BtqjnW0uTq9XCS5CcdIinVhjrIyaeyTM%2BoA49DmzhkQV3n9Fx9tB%2BEyCrj8QUqNbrToRiSvYCvHCkCLSne%2FLP9xoS9N741HV%2BEfziPLpcovUkHhn5613Kt%2BnTcxKssTILhWjXpbKWRFj19w%2BQRk1fHg7GaaSQbGxijANfSBvNv9HeXPaQuUfBIz7AgfXqUsOvNezNgP3A%3D%3D&c=AAATPG%2BJCFCD%2BhmB23SqjAFpTleD8BVAtqlk3gujkFaRzxwTE2BEMeP3itW5n22LHypbeI5f3mN8nBBW3B%2B7KFim9oKOOVWLo881RVR5FcNmYYNaVaBw3NEkOpaIlJ63Z5124UtUubH%2BtTiSZ9dM0F7WbxSg3Sjl0LqWL9CpbHlHiB3ThN01ezQotTRDtWpDFNQ3dd6rt1AnJMzZG3wBTF4dqjpYUHMyaNUaZpvh6rIvVAqJuKw0280JW6LABz0bRAhJQOpn%2BxIFx5aeS7y5pDVL0jAunQUtTKjZXSEIcaj8UIr9hRJ6Cg7DMP8mVkTxBCwsr0cvuynyl07nD5VoG6nAfx%2BjNo9z1ORfcNevY4oP8nRHTxWO7PGf1iCxHw89NnzFB%2B0Ves163Nf4SQ%2BUeLa9rVcrBHAhse2WVhqdypUm3OlP%2BlTFCMFK2SqeY2lsbMwBqsSZGV%2FTDJFdrfs4SDNOWFIuTtbpkPgVd7NG8Lbpa8BS7TJ7tTVdYl7%2BJRiHUVFi6M7l5ludsUjAecfN%2FUHGA2mRQoVN43e2oRTaDB48T%2Fd%2ByzBxdVs4F4DwcpiJJVpUL1M%2F5eK%2BxGWSkXjCguizxzF1GgQNf8zUTJFAjx0B%2F8MZCgdOdEgI9G6z4C85iS5AAtj77aKt

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://igotchuseasonings.com/_t/c/A1020005-17F9FF4D17AC91B0-76F853B7?l=AACkfU8A%2BEWIr638OVMqA2mrOuC4wdq3Ar9xIGrOYEM6IiKtU30YrN8cNct3J6F2c03sVDBmAB7%2FSzNxWHE%2FjNg1%2BGufSTHWiu%2FsGTDsYsyL7zDV4u96q5LEcLujjBYW3i6TlWqQADhH8Z%2BJ9IqJngnxFByebxef4tLSbi%2FMKTuaEEJFc9kxUWV2ePMby583u7UGW3BoKFj4FS%2FoAeQperlfZJGmmd4bPxzufMHoZi20xr7vBGRBKAfBVGUzYMLmoIn1kAaPQg8s6XyNu86g4%2BtqjnW0uTq9XCS5CcdIinVhjrIyaeyTM%2BoA49DmzhkQV3n9Fx9tB%2BEyCrj8QUqNbrToRiSvYCvHCkCLSne%2FLP9xoS9N741HV%2BEfziPLpcovUkHhn5613Kt%2BnTcxKssTILhWjXpbKWRFj19w%2BQRk1fHg7GaaSQbGxijANfSBvNv9HeXPaQuUfBIz7AgfXqUsOvNezNgP3A%3D%3D&c=AAATPG%2BJCFCD%2BhmB23SqjAFpTleD8BVAtqlk3gujkFaRzxwTE2BEMeP3itW5n22LHypbeI5f3mN8nBBW3B%2B7KFim9oKOOVWLo881RVR5FcNmYYNaVaBw3NEkOpaIlJ63Z5124UtUubH%2BtTiSZ9dM0F7WbxSg3Sjl0LqWL9CpbHlHiB3ThN01ezQotTRDtWpDFNQ3dd6rt1AnJMzZG3wBTF4dqjpYUHMyaNUaZpvh6rIvVAqJuKw0280JW6LABz0bRAhJQOpn%2BxIFx5aeS7y5pDVL0jAunQUtTKjZXSEIcaj8UIr9hRJ6Cg7DMP8mVkTxBCwsr0cvuynyl07nD5VoG6nAfx%2BjNo9z1ORfcNevY4oP8nRHTxWO7PGf1iCxHw89NnzFB%2B0Ves163Nf4SQ%2BUeLa9rVcrBHAhse2WVhqdypUm3OlP%2BlTFCMFK2SqeY2lsbMwBqsSZGV%2FTDJFdrfs4SDNOWFIuTtbpkPgVd7NG8Lbpa8BS7TJ7tTVdYl7%2BJRiHUVFi6M7l5ludsUjAecfN%2FUHGA2mRQoVN43e2oRTaDB48T%2Fd%2ByzBxdVs4F4DwcpiJJVpUL1M%2F5eK%2BxGWSkXjCguizxzF1GgQNf8zUTJFAjx0B%2F8MZCgdOdEgI9G6z4C85iS5AAtj77aKt

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1384	msedge.exe
1384	msedge.exe
3624	msedge.exe
3624	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 996	3624	msedge.exe	82
PID 3624 wrote to memory of 996	3624	msedge.exe	82
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 4612	3624	msedge.exe	83
PID 3624 wrote to memory of 1384	3624	msedge.exe	84
PID 3624 wrote to memory of 1384	3624	msedge.exe	84
PID 3624 wrote to memory of 696	3624	msedge.exe	85
PID 3624 wrote to memory of 696	3624	msedge.exe	85
PID 3624 wrote to memory of 696	3624	msedge.exe	85
PID 3624 wrote to memory of 696	3624	msedge.exe	85
PID 3624 wrote to memory of 696	3624	msedge.exe	85
PID 3624 wrote to memory of 696	3624	msedge.exe	85
PID 3624 wrote to memory of 696	3624	msedge.exe	85
PID 3624 wrote to memory of 696	3624	msedge.exe	85
PID 3624 wrote to memory of 696	3624	msedge.exe	85
PID 3624 wrote to memory of 696	3624	msedge.exe	85
PID 3624 wrote to memory of 696	3624	msedge.exe	85
PID 3624 wrote to memory of 696	3624	msedge.exe	85
PID 3624 wrote to memory of 696	3624	msedge.exe	85
PID 3624 wrote to memory of 696	3624	msedge.exe	85
PID 3624 wrote to memory of 696	3624	msedge.exe	85
PID 3624 wrote to memory of 696	3624	msedge.exe	85
PID 3624 wrote to memory of 696	3624	msedge.exe	85
PID 3624 wrote to memory of 696	3624	msedge.exe	85
PID 3624 wrote to memory of 696	3624	msedge.exe	85
PID 3624 wrote to memory of 696	3624	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://igotchuseasonings.com/_t/c/A1020005-17F9FF4D17AC91B0-76F853B7?l=AACkfU8A%2BEWIr638OVMqA2mrOuC4wdq3Ar9xIGrOYEM6IiKtU30YrN8cNct3J6F2c03sVDBmAB7%2FSzNxWHE%2FjNg1%2BGufSTHWiu%2FsGTDsYsyL7zDV4u96q5LEcLujjBYW3i6TlWqQADhH8Z%2BJ9IqJngnxFByebxef4tLSbi%2FMKTuaEEJFc9kxUWV2ePMby583u7UGW3BoKFj4FS%2FoAeQperlfZJGmmd4bPxzufMHoZi20xr7vBGRBKAfBVGUzYMLmoIn1kAaPQg8s6XyNu86g4%2BtqjnW0uTq9XCS5CcdIinVhjrIyaeyTM%2BoA49DmzhkQV3n9Fx9tB%2BEyCrj8QUqNbrToRiSvYCvHCkCLSne%2FLP9xoS9N741HV%2BEfziPLpcovUkHhn5613Kt%2BnTcxKssTILhWjXpbKWRFj19w%2BQRk1fHg7GaaSQbGxijANfSBvNv9HeXPaQuUfBIz7AgfXqUsOvNezNgP3A%3D%3D&c=AAATPG%2BJCFCD%2BhmB23SqjAFpTleD8BVAtqlk3gujkFaRzxwTE2BEMeP3itW5n22LHypbeI5f3mN8nBBW3B%2B7KFim9oKOOVWLo881RVR5FcNmYYNaVaBw3NEkOpaIlJ63Z5124UtUubH%2BtTiSZ9dM0F7WbxSg3Sjl0LqWL9CpbHlHiB3ThN01ezQotTRDtWpDFNQ3dd6rt1AnJMzZG3wBTF4dqjpYUHMyaNUaZpvh6rIvVAqJuKw0280JW6LABz0bRAhJQOpn%2BxIFx5aeS7y5pDVL0jAunQUtTKjZXSEIcaj8UIr9hRJ6Cg7DMP8mVkTxBCwsr0cvuynyl07nD5VoG6nAfx%2BjNo9z1ORfcNevY4oP8nRHTxWO7PGf1iCxHw89NnzFB%2B0Ves163Nf4SQ%2BUeLa9rVcrBHAhse2WVhqdypUm3OlP%2BlTFCMFK2SqeY2lsbMwBqsSZGV%2FTDJFdrfs4SDNOWFIuTtbpkPgVd7NG8Lbpa8BS7TJ7tTVdYl7%2BJRiHUVFi6M7l5ludsUjAecfN%2FUHGA2mRQoVN43e2oRTaDB48T%2Fd%2ByzBxdVs4F4DwcpiJJVpUL1M%2F5eK%2BxGWSkXjCguizxzF1GgQNf8zUTJFAjx0B%2F8MZCgdOdEgI9G6z4C85iS5AAtj77aKt
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb062446f8,0x7ffb06244708,0x7ffb06244718
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,3290066791748443895,7550562692902716812,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,3290066791748443895,7550562692902716812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,3290066791748443895,7550562692902716812,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3290066791748443895,7550562692902716812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3290066791748443895,7550562692902716812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,3290066791748443895,7550562692902716812,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3420a52c-9f1e-4c0a-a654-5f7bc3cca683.tmp

Filesize
7KB

MD5
687daefae015fd1586d7f4202d94ba16

SHA1
00ce716dbea640e17492e1c426ef959e8cff9d0c

SHA256
15a30bafff4f719186b89be41dd5ede2eae949b31fe81bf0815bf3a70bb42640

SHA512
5a5e52ee0ca3faad8bd9ad03a7b9dafffeda22ff794aaa0e9f5e9791307d82676a4eef52c75aa6565b5c9a2418b429ceb5fa11b75feb13c1e309c7abf105fe47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
258607737aaab7bc5a3e5bc820e2b20e

SHA1
763871b5a14142930915bb5825914fa4af463f8c

SHA256
fb5c10beb1fc52b14c02681a9d285796e5e67fb94e01848670b4220dc01ef6d8

SHA512
694d2fefcfd09146f03ef96ae19074061147aadb01feb358ef509e4d8b04af5ec89c29acab4266264c5317952979519bc6d6f8a2442363e052a3722620081565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
451a2dc7d6b27a14f0047fd56fd3abee

SHA1
8c751dc4a938f74bf8855f380a959b9238f1890f

SHA256
eca60073cefc3d0f7ce07647a3cf58501908f081cdf169d6dfc597fc7818e3d5

SHA512
facf149673cf55246420ec231a009af0032f25cc26d859a9475db568f6f2da75e923ed6070fdb1e770d415dddd1b3be359f0961b41f09d679bf42a9cdab8f438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
76250ad26113bfa369157ae2a2173156

SHA1
ae6b52035ee90ae025501d1e3fd76dcdc9db1b5d

SHA256
d7b67d6c8bc6482dac886109830672defb0cf4e2066b814cc703c971bb8954df

SHA512
e33818c48bfa27cedb6d3826b371d04a2835b4b2ab5d7643e3dfbd6543b0242c4727d9aee47476a42a3fefca7ca14e695e93a5b604552141c96f7b214f5d516a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
de2397a351d1602d7e1a3676b2868817

SHA1
ce404a6d2d4581dce1ed5ed79219232b83cc4ae4

SHA256
2fe733c6830a7aed315c1d528847569e854f3a0e06f5ca19984fef4b566aa93c

SHA512
3f34aec2865d87b179410516d7866bb257fd378650d4696c8478b9f20df69168fd771f5a4c0db0be7ed6cffff86a30ad883e222583ff1463a20c484c94f687d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b269f3ccf34728dff2f2df68bd71be74

SHA1
be36f6ff12e1fb3631b03e8c109979da5cd22777

SHA256
6d4525da5e71f421ca52a356433e75e5027e32fa45af2302e05e1114aea2a972

SHA512
9933f0068bbe1a892760d2af47622ebfd8d7ea93bddd89c5d4f36de0519f4d7f459d92991e6ae71a4c9c6aa113102d5e83b7d137d61af62778de28089d3bfe95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f4ab08a1d19e9f503f161d84349304e1

SHA1
e1f8bd38d7ba85b5fe6785681f803d03420740ef

SHA256
af159578e71bb16abe24aa3e24c51bc1218ebd402a9f7ebcff676c0c391275cd

SHA512
5b2ee81fb5be48a85b30e6b6d7a1c7184ae17d811e5d32c48f5f00c197c17faf436c10ae7c94d45027baf01d6eb785a0619ddbe2e38281375d9da8ebde7ab1b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
773cb0698b31624f8616875a5f6f0fac

SHA1
23c4c668d3ff2e8bb031753b5ffc229f30a26641

SHA256
352c7a2867a2a1e70c19be4faa1898c7e2ec3f39d496c18658d45bd9158f9d0e

SHA512
cf04c9fa3095e17bc8f891f22955eb529b3da787e7cd353c5c5d30db24a92a5e2f4e97efa8861c57b5e01db11f986a6b91692d69ffcfd444a30b692e062f48b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
18aa9d0669101cbb8b9528525a08800b

SHA1
52f4ad72512f53561c36ca661b87490ec5dd6cfd

SHA256
0cf90394dcafb9559b99222b2349296903fd22f7747a9a12a2f67a7482683fa8

SHA512
5f84fb82819b3077aca2b30f38b17c268b41a9abf4f18a73696cbfc16ee8be81654e6b57b2fb4b695e44727911b55d3e0d55ec989f268a733723a55c8ce165d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe63f785.TMP

Filesize
370B

MD5
e13736762ec502f875ed92ddb9692c1a

SHA1
e2dc76fca7fa959e24ed877d2885c6015c5a1d96

SHA256
bcd670ca77ca78562f87663f5279b2cd599cecda46af293a392077ce54f68a06

SHA512
20befeb0211667f37389ad8813f67f74f141130f0b8ca6d00436a6bf86965f77cde65ab46d0079eaca727625b40843b5bedaca5482913be669854262546f2da5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fd7f7355c5ce5703053afc3802434ffa

SHA1
88590394b51a031adbe9521dcd12984c68d32b81

SHA256
72b71d0a848a8e73007efffe37d4e6d4e35097c9f6c62e12e4d2bb4007333fd9

SHA512
448b88c858fe1c981652e054205dde56511ce04ec929af30a439a3f748f1303b12cdd8aefa01db323cc60c9adb354a6b1767de57b6a5dfd0bafbfc72be4760d6

Download Submit