hxxps://www[.]edgenexus[.]io/?kw=load%20balancing%20software&cpn=16570888761&utm_term=load%20balancing%20software&utm_campaign=Search%20-%20UK&utm_source=adwords&utm_medium=ppc&hsa_acc=4154058708&hsa_cam=16570888761&hsa_grp=136194098764&hsa_ad=587970669014&hsa_src=g&hsa_tgt=kwd-326575076551&hsa_kw=load%20balancing%20software&hsa_mt=p&hsa_net=adwords&hsa_ver=3&gad_source=1&gbraid=0AAAAAD_NyvWO35c1XuCrN-wICq3vxLVlk&gclid=CjwKCAjwx4O4BhAnEiwA42SbVBRLvyb_DOH61pgjutcPLo1KgdZdKq91oxRCyFVW0IUtiQJl1g0ISxoCH-wQAvD_BwE

Analysis

max time kernel
427s
max time network
439s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.edgenexus.io/?kw=load%20balancing%20software&cpn=16570888761&utm_term=load%20balancing%20software&utm_campaign=Search%20-%20UK&utm_source=adwords&utm_medium=ppc&hsa_acc=4154058708&hsa_cam=16570888761&hsa_grp=136194098764&hsa_ad=587970669014&hsa_src=g&hsa_tgt=kwd-326575076551&hsa_kw=load%20balancing%20software&hsa_mt=p&hsa_net=adwords&hsa_ver=3&gad_source=1&gbraid=0AAAAAD_NyvWO35c1XuCrN-wICq3vxLVlk&gclid=CjwKCAjwx4O4BhAnEiwA42SbVBRLvyb_DOH61pgjutcPLo1KgdZdKq91oxRCyFVW0IUtiQJl1g0ISxoCH-wQAvD_BwE

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
4452	msedge.exe
4452	msedge.exe
3904	identity_helper.exe
3904	identity_helper.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3100	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3100	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 1096	4452	msedge.exe	82
PID 4452 wrote to memory of 1096	4452	msedge.exe	82
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1564	4452	msedge.exe	83
PID 4452 wrote to memory of 1660	4452	msedge.exe	84
PID 4452 wrote to memory of 1660	4452	msedge.exe	84
PID 4452 wrote to memory of 3820	4452	msedge.exe	85
PID 4452 wrote to memory of 3820	4452	msedge.exe	85
PID 4452 wrote to memory of 3820	4452	msedge.exe	85
PID 4452 wrote to memory of 3820	4452	msedge.exe	85
PID 4452 wrote to memory of 3820	4452	msedge.exe	85
PID 4452 wrote to memory of 3820	4452	msedge.exe	85
PID 4452 wrote to memory of 3820	4452	msedge.exe	85
PID 4452 wrote to memory of 3820	4452	msedge.exe	85
PID 4452 wrote to memory of 3820	4452	msedge.exe	85
PID 4452 wrote to memory of 3820	4452	msedge.exe	85
PID 4452 wrote to memory of 3820	4452	msedge.exe	85
PID 4452 wrote to memory of 3820	4452	msedge.exe	85
PID 4452 wrote to memory of 3820	4452	msedge.exe	85
PID 4452 wrote to memory of 3820	4452	msedge.exe	85
PID 4452 wrote to memory of 3820	4452	msedge.exe	85
PID 4452 wrote to memory of 3820	4452	msedge.exe	85
PID 4452 wrote to memory of 3820	4452	msedge.exe	85
PID 4452 wrote to memory of 3820	4452	msedge.exe	85
PID 4452 wrote to memory of 3820	4452	msedge.exe	85
PID 4452 wrote to memory of 3820	4452	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.edgenexus.io/?kw=load%20balancing%20software&cpn=16570888761&utm_term=load%20balancing%20software&utm_campaign=Search%20-%20UK&utm_source=adwords&utm_medium=ppc&hsa_acc=4154058708&hsa_cam=16570888761&hsa_grp=136194098764&hsa_ad=587970669014&hsa_src=g&hsa_tgt=kwd-326575076551&hsa_kw=load%20balancing%20software&hsa_mt=p&hsa_net=adwords&hsa_ver=3&gad_source=1&gbraid=0AAAAAD_NyvWO35c1XuCrN-wICq3vxLVlk&gclid=CjwKCAjwx4O4BhAnEiwA42SbVBRLvyb_DOH61pgjutcPLo1KgdZdKq91oxRCyFVW0IUtiQJl1g0ISxoCH-wQAvD_BwE
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc196c46f8,0x7ffc196c4708,0x7ffc196c4718
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,3775565140913852198,2119674618296283136,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,3775565140913852198,2119674618296283136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,3775565140913852198,2119674618296283136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3775565140913852198,2119674618296283136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3775565140913852198,2119674618296283136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3775565140913852198,2119674618296283136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3775565140913852198,2119674618296283136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3775565140913852198,2119674618296283136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,3775565140913852198,2119674618296283136,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,3775565140913852198,2119674618296283136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,3775565140913852198,2119674618296283136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3775565140913852198,2119674618296283136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3775565140913852198,2119674618296283136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3775565140913852198,2119674618296283136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2292 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3775565140913852198,2119674618296283136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,3775565140913852198,2119674618296283136,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3392

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c 0x4ac
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8013931b-eb78-4226-b2a0-abde8870a7d0.tmp

Filesize
3KB

MD5
d19808b1b7b180de87d952b7b33ba1f4

SHA1
916349e60bd71e61781a427ff5b423d402e6fd9a

SHA256
1ffa21e6634c7cf9cc336fc4dcb62c40dc21d0873fc700847bcb9a9ae6177057

SHA512
b5bbe7274459b1f52d5a083faa4b07ebaf9ac00238f1daa6ce800a324bb8510e69ac7c45e7a63b500e19946069486b2a37af0305222676cc6c6d08811841e8e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

Filesize
213KB

MD5
f942900ff0a10f251d338c612c456948

SHA1
4a283d3c8f3dc491e43c430d97c3489ee7a3d320

SHA256
38b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6

SHA512
9b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c515a44b7716e8cd_0

Filesize
232B

MD5
206423bfc7c1f00745f08d8556f9d7d6

SHA1
07912764407c5c7c20ac4706ace7ee7e194a8a49

SHA256
2da99152de7b7d8a7ac56f4593c129ef3e941e145a462a27d1ff04092687ca99

SHA512
4c85602c2c231ebdcfdc687fc90a96296232e85d9f0bafe6508d06dc69414a01ad125823290c98462d41555c1ca281b31eb9389299fb0a2fa799a91b096d5944

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ac01d37dbd3eab4aeaa2d32e1fef068c

SHA1
b04d0f195f9e569f4aafdbacc01338272fd36ebd

SHA256
68327ff41641de0a0f6bca76e017d71da68a75dfe226adb81a40066f9dc0a189

SHA512
e913851423d1965b3bb47b4e93c338a93128472f6bd623b7f831eaf41f18dc1ce3b4adeb51e68fd64fae5bbf4d9f8aaf71c67ad21b76a8b5173806c0200d320e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9db452b746236cb53666e8979289e6dd

SHA1
22aa01029d2350cc178e4c1fa7f44274943b3432

SHA256
a439222dc283f0d781c98aacc42a41ec911147cc6eac040f15a0cf4692aa4b81

SHA512
d3c1df4eb3fb7df98c64d0425af5a9dd907b276c06b1e558e0a09fd5d4b7dcab79470730d1062510a2260963c4bdd9b45bf8e1b271c0495c9d4953445c7e9b48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
d91d497f22d5e12276d260166b407566

SHA1
1f6116cb9d3003c224e5ac601d23a2a77994ff2c

SHA256
79779bdf7fdf0f5f54296fa0fc3929b61dd28c7a389e509e86de0fdd65e86017

SHA512
dbfc470066bc7ff8c146d02bced42acb6b3daec6ce2de2a5ca6a4e3fc4cfb8b0798916aa4faa45eb78b7a5fcaafbc4a45266e7773fde6b407b04f7c3ff123a4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6eebb55b1fe17b22a90b0f0cd9d4cb5d

SHA1
c4c997cf8d9f18d7ed37dc5f821312e2657a516c

SHA256
3e7edb9fa21da8b6ab121fb6802523cb206907e5c63a2b14ca1b77ccba1904f5

SHA512
70b4b021cd43fc3f5ec635580db4e01f36881866aee666fc65543d886bdf93e8569af9f6513e73400300c1ab34e123956a2f6ea62cbc6f6ca0fdee6a5c6ad8e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
746c585abb79b68bbd784b0aa62460f2

SHA1
6e45d36b0ba0b482a3c488488865e781a69a9c37

SHA256
897e2f1839395aa7d5cc875c7589562d6fcbe803b0fb4d3f9694c95d8407d877

SHA512
791d7528a7ea4036341fe5b3e6e48899f4eadb1dd1e02c524cbc1ab0909e38fe016deee5951e0adbc0e9515dbeb7777e70688a11a6bff45362c641e7b6faabcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
efd948958bb80bfb159cdca22b02424d

SHA1
6526b6a464e4a8a6176b1c7731615b884af1d655

SHA256
82aa5b1da677d8d0ee56c34cb5e36aaf83f90c6b10c7051fac8fb0f80ea8bdeb

SHA512
8db34322f03a56b8fab954b3c0cd0eb694a5ceb9989d73db9749de824ce011323824893004c79247ad032275d228808e757affb11c4cd83e23a7f3945a915403

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
5e849bcb35260739e989370935097343

SHA1
8b1f0e5cef55b0c805350e6e22784b348d7e88a6

SHA256
4fa06aaa86a95657355569f44e3936ec681d388fac47f67c4b0a7ce00fb59997

SHA512
33e3ce0f781b9da658b0fdead49cd2e1068fcc86830833492f63b8074ea102b9f735059dd353de8c88a4c7ad3242890824683ed66895841d55db23942cd815bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
f486adad2d0b3108772481485c2403aa

SHA1
fb3fe6a7b8e17de94dca0d2c4a7d7cfbe8523c1e

SHA256
ff98b08e8334201e80dd8315f940bd1891a1bf56aa56e16fc18ab41b010e97b0

SHA512
0c50ebee14a93227a92a01a30da2f100547e9cb37c248f66c968cc91311078d9bd628cd0e67aa56954f3378b47e10259bb174efa4d84ef651ca9ce6aed8bdac2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
be59759a3b32c9456a7ad396826ded70

SHA1
8b711062518af0436b86986458302252a5a845ae

SHA256
16040292e878a60eea695b91ccca935c75ae1c3dcee49492a4068da8a731d9ef

SHA512
e1a3bf839b6413439d6c23e9b3282afba4ccd41c1a9ea971b5211d3e1e9933ce60ee7bda45e0fead993afc475df9e33a5f736a94b8b5bb8e42529eef3a542956

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6d24cb46afdefbc8f65f5638f452a897

SHA1
df76ba0adc6d6ed6feb8d650f69c8635f14344e1

SHA256
8f6e1a13d1e3ed53e5606e02300c1838d2d9c23a2168a8696db475972405de4c

SHA512
1e99b132302dcfabd61075248872f88cfa1584a8176ed871ea6d0473af91643ad1c2b175316d1f8fc1d22320a0c5f3d3d3a896c4ead2e068c2a25af8769c3285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c12f126b6cdf01cafd6c4d4a0285a0f7

SHA1
debd396f178d670394fee3c63af854718d83c581

SHA256
13db4075d21eaa62353fe9be78de884aae00fc3fd07de32e7fd31685a8e95d0a

SHA512
0a8997c7261ded08314e8fdb38df53d80f32f01f5eab42d3d23ea26bf840f0d7e0385f1a09414484110af701cbf43943ae1ab704f664d226f01bec18ba174c51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
ebf50744b3e1db1735fc1fced9e74aeb

SHA1
35f9297b8ea52e51d5636d15bd7f042c11f868ec

SHA256
265a419c1023f78e38acd02d477d1e1b24b9d2404b2744cc547958c993616e55

SHA512
ee99319043e17e5dc182c626b6a140135f412db2152266a12c90bb904560a7697afd9dfb81564c13c9353dd4518552411abde1f6b8a922c9229222de8e121aea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585d8c.TMP

Filesize
2KB

MD5
74d809786ce603742aaef177a3d56152

SHA1
28321aca687ccf0618989927a48e84a9954e905f

SHA256
895955b14cfc63b75050a1cf51b7af0b441b40a225e289f00d28d192661dcb03

SHA512
c418d965f25b6c194e750616e73bc7f5ddfd00366d32d4a9096ed38755183a77fb118833938b8fc65e4a6dd1a880379c0d71bdbe10e5e85811f4a63168c0b8c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3d33718c09d03ec54fd9fbb0b16a18bb

SHA1
d2489d41a4e9b125281a7e2766333caff67e7ac4

SHA256
8da3ade2f5a09805458f1771ceb100f9be75cb94558d3b57bb106060b6d9c9c4

SHA512
5053f71715dfe3206fb9eada943ee136b67c60b055ebac736b9f4788da213f97829b01a420142bb0545cb999a5ce136906b2de21e9ccfd8874035c4a8f281189

Download Submit