hxxp://aza[.]bbsgroupe[.]com/payp/

Analysis

max time kernel
575s
max time network
564s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2024, 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://aza.bbsgroupe.com/payp/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe
4016	msedge.exe
4016	msedge.exe
4540	identity_helper.exe
4540	identity_helper.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 1968	4016	msedge.exe	83
PID 4016 wrote to memory of 1968	4016	msedge.exe	83
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 1460	4016	msedge.exe	84
PID 4016 wrote to memory of 3400	4016	msedge.exe	85
PID 4016 wrote to memory of 3400	4016	msedge.exe	85
PID 4016 wrote to memory of 764	4016	msedge.exe	86
PID 4016 wrote to memory of 764	4016	msedge.exe	86
PID 4016 wrote to memory of 764	4016	msedge.exe	86
PID 4016 wrote to memory of 764	4016	msedge.exe	86
PID 4016 wrote to memory of 764	4016	msedge.exe	86
PID 4016 wrote to memory of 764	4016	msedge.exe	86
PID 4016 wrote to memory of 764	4016	msedge.exe	86
PID 4016 wrote to memory of 764	4016	msedge.exe	86
PID 4016 wrote to memory of 764	4016	msedge.exe	86
PID 4016 wrote to memory of 764	4016	msedge.exe	86
PID 4016 wrote to memory of 764	4016	msedge.exe	86
PID 4016 wrote to memory of 764	4016	msedge.exe	86
PID 4016 wrote to memory of 764	4016	msedge.exe	86
PID 4016 wrote to memory of 764	4016	msedge.exe	86
PID 4016 wrote to memory of 764	4016	msedge.exe	86
PID 4016 wrote to memory of 764	4016	msedge.exe	86
PID 4016 wrote to memory of 764	4016	msedge.exe	86
PID 4016 wrote to memory of 764	4016	msedge.exe	86
PID 4016 wrote to memory of 764	4016	msedge.exe	86
PID 4016 wrote to memory of 764	4016	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://aza.bbsgroupe.com/payp/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb773746f8,0x7ffb77374708,0x7ffb77374718
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7138635844839531598,16251122942294573742,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,7138635844839531598,16251122942294573742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,7138635844839531598,16251122942294573742,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7138635844839531598,16251122942294573742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7138635844839531598,16251122942294573742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7138635844839531598,16251122942294573742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7138635844839531598,16251122942294573742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7138635844839531598,16251122942294573742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7138635844839531598,16251122942294573742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7138635844839531598,16251122942294573742,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7138635844839531598,16251122942294573742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7138635844839531598,16251122942294573742,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7138635844839531598,16251122942294573742,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4796 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7138635844839531598,16251122942294573742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,7138635844839531598,16251122942294573742,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:2792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
41KB

MD5
e319c7af7370ac080fbc66374603ed3a

SHA1
4f0cd3c48c2e82a167384d967c210bdacc6904f9

SHA256
5ad4c276af3ac5349ee9280f8a8144a30d33217542e065864c8b424a08365132

SHA512
4681a68a428e15d09010e2b2edba61e22808da1b77856f3ff842ebd022a1b801dfbb7cbb2eb8c1b6c39ae397d20892a3b7af054650f2899d0d16fc12d3d1a011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
289d94935b3c3e2e845d9f94d5061699

SHA1
26c4d252fbd87f89e244e85fef83699590992aa6

SHA256
e13a4391e502b1a6cd8045c16adbf10e839e0f3547f1eff8838e5508cb4b8d3d

SHA512
4c45c36f09dfce1aedcb188668fe84f3936f7827c958afd51f92fc4a01616471f265b61809f04704a5b77b697a1b1762fcc511650df5e4ac64f38c592bf03b10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
4ffa8a48d612dab04ca0dd1c62b7fbaf

SHA1
754b7fbc024c97785a92d049fdb6c7c254172c10

SHA256
184f304081f2312c89814c10bc10c058569238b17f58f62da09375bf730872f2

SHA512
de0ef5f6cac1aeec31c791b9d1f9604e61e04e440ad23e3b2d3eb406097791ad26da392f0072b4e558e5e6308d98ad3557b52650a69c0ca765d0860668995fe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
d6cb27e88cf7c9fff064a2a7b201383b

SHA1
243d3d814814f59d3db14ac603d34dcd72115aaf

SHA256
ba41f285a1d854449f99b52a0128292d1854705ba4076c5c8d72196e71c08f6b

SHA512
019171cb9000ffa70a6f39fe3f630464fda2fce0df2afe8d374b1779fb3282cf048f84f4d21757fd9c19ca1db39944988c225ce33821ea3be3cd21ae73aed4a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
bab7c220efecd506f4e050071c8beae6

SHA1
94341ec023991da26f3278fbacc69262e605593f

SHA256
1b19444b89c24dfe73794f4b0972359c683f78c9f240f5af7ee6204935247b08

SHA512
2be8b376694ea4af8463ec251dd2dd72b5fad99bedc0859fb235ea6d72bac3147d0efe31139fbc73fd7d7a9a19238967df0b729ebb71a2b8bcd10435abe129ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
995B

MD5
845f677515f6ecb59f8d14c70547a078

SHA1
1a076a710ae7ed946447cd757baf91458241c613

SHA256
bbca76467ec9948974d5d6fa98954d78ebf857ddca7f28199743565510a9b2ba

SHA512
dfa59146d908031e2c5105392eac609163f15d57eedad4a04637844f8d77480b557fc1140ab790dd4557c8f28a655e73f685385262b688ba3585b46e5785c6cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
894B

MD5
3f70c0699d6ad769b839688ad4f38172

SHA1
73b124ee3ef2f23ade5e07270088545c6f23c73d

SHA256
5e433edebe1e9fbb43f851eee6f06beac01e8d2d558a3da96750b896cc9a51bb

SHA512
8139e289fa6b9b54493d7511c01e18cb6284ae127da0e62741680124d3aa58527c3225163568286fa66e78f521ce403ca8ca3ba6a832e5f9ed3c619a94af46fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
925B

MD5
48cd695e014a0338dc8954a0ec6daf59

SHA1
2a127bb2aef85f7eac080ee007e8f48db83a89fc

SHA256
4372f0b5e503a2e5e8f59952f1b53d9b22c6f173fcc2465c4b5b964ae75a86d4

SHA512
9ab094455c7d8549b6ee1cdf5bbe325abd08240c7d52ad17f24eb0c8991e5b942a79d7be6e233e83aedcff8d451c301ae629e4a07193d42eaf2906a63d8a8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
995B

MD5
ea3db7b715754b72220dc5988afae646

SHA1
e5da43c60fa59c01f7f264782716950918584b28

SHA256
e3d341d768bcf9f02c2566f80c85d6f3949a189edbe62368e9eb1e2fa1d7be1d

SHA512
c82357c1cffb49acac1d586960363087e00895db6d58a7bd6fc35c11a8e42d878748717ea0bfb235b3c8e067426ae4717c69f8fc5f7271116497124fb03b616a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1957f0bd364b96d67c3ab16133cab6a

SHA1
ac3a81f5eb19c5e5af3ad82ce0cf677798e61ac9

SHA256
723735fc1e872b21e9282759c31a3f5397aa369e4d209b6f7aa204248b8430fe

SHA512
75cddc6b4c6970de03033b58804ad45dd9c1c1baa35a1fc28ef7864831dda94beb6d60b458f58bf2c71d88786146f0f2a34f7dcecf1aa490fe8c3be2fc76411f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
af2e694f6bedc21ace2c5c7b48de9f5c

SHA1
35437bdf2ae5748138cfc8bfc2c76ade00582c2a

SHA256
e97cb924738a82cf5835afc6d2e9f5f183fa88e99a58b14cf8f012c77a3de3ac

SHA512
b37814cf4739392f2aa8c68c5e3adac1717e346bbb2d27371bf3072b8f4b0b85d9f53ef89a55ff02658c355c049b0d0e425561d2718648f88daaecb382b0d565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6be4dd760164da2764bc684175227ff4

SHA1
7582dc3265924606e80d61ee709ae2eb9f67204e

SHA256
ec317525a6f2eee9407a2c515c6be39c2ee2fee986d793cb27df2d532990594a

SHA512
36e97b34e1b49a0de891e224de51ed578bab2bf5588dd9889ef9e2bee2f0a069bf51c5df5f410a0e0aff05482c0a44b7c183fafff0b555bebbb99d13dc06ef1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7a81f185ddac5dcb345c87ceb90abe70

SHA1
2b6fdda8e016ccd149dc4ee4fea9051f26b0aa5e

SHA256
8b37b74a139b2581c36e6d250b822e4d05a68be0133e2a56ed9e406699dbcedf

SHA512
0d2eeb7664d94a435443722e30c50afa079fa1d6b2ec285737c944a37a49c91beb17f31ee17aaba4bf1c9cec3f77a696b28449e867faab92e9d54fc4a67b535d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fbb524d0a804a14529325ad84a168ad2

SHA1
afc8e466735f03132b7c2af7f167d0d18765f05f

SHA256
1e5ce7817f6fe23f57d3463eafebe8fe91a7f7b2ec079077dcf2a4adebd957fe

SHA512
ee4c3f09e38ce63060781e92fd5d4e4af7421ca94f0f54f442a7cdcacca8f4fda31fac036ec63143e4e5ca50314ae93cc1466fb51f8cca25d21a8f6fcf40ed69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c3cc53ed31bbb84d510858a409e66c14

SHA1
a5df40523ba0f6f9f27ce48fa3c0a0f453fe35c7

SHA256
1185dfc926829e86d5620ff83979daf873173a23179de62ea3c9ee18b1098330

SHA512
ff7d39185469c88e9c4c1a001f0a68aba1d6c13bb9ffe1928dace88f62b1323129329cd7b04716511a9c2c045d1e886eff24a9dc3bff5c71201d95bd1bf23dfc

Download Submit