hxxp://noescape[.]exe

max time kernel
960s
max time network
964s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
24-12-2024 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://noescape.exe

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1928	msedge.exe
1928	msedge.exe
3056	msedge.exe
3056	msedge.exe
1588	identity_helper.exe
1588	identity_helper.exe
4568	msedge.exe
4568	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2280	3056	msedge.exe	79
PID 3056 wrote to memory of 2280	3056	msedge.exe	79
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 4840	3056	msedge.exe	80
PID 3056 wrote to memory of 1928	3056	msedge.exe	81
PID 3056 wrote to memory of 1928	3056	msedge.exe	81
PID 3056 wrote to memory of 3720	3056	msedge.exe	82
PID 3056 wrote to memory of 3720	3056	msedge.exe	82
PID 3056 wrote to memory of 3720	3056	msedge.exe	82
PID 3056 wrote to memory of 3720	3056	msedge.exe	82
PID 3056 wrote to memory of 3720	3056	msedge.exe	82
PID 3056 wrote to memory of 3720	3056	msedge.exe	82
PID 3056 wrote to memory of 3720	3056	msedge.exe	82
PID 3056 wrote to memory of 3720	3056	msedge.exe	82
PID 3056 wrote to memory of 3720	3056	msedge.exe	82
PID 3056 wrote to memory of 3720	3056	msedge.exe	82
PID 3056 wrote to memory of 3720	3056	msedge.exe	82
PID 3056 wrote to memory of 3720	3056	msedge.exe	82
PID 3056 wrote to memory of 3720	3056	msedge.exe	82
PID 3056 wrote to memory of 3720	3056	msedge.exe	82
PID 3056 wrote to memory of 3720	3056	msedge.exe	82
PID 3056 wrote to memory of 3720	3056	msedge.exe	82
PID 3056 wrote to memory of 3720	3056	msedge.exe	82
PID 3056 wrote to memory of 3720	3056	msedge.exe	82
PID 3056 wrote to memory of 3720	3056	msedge.exe	82
PID 3056 wrote to memory of 3720	3056	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://noescape.exe
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc19bb3cb8,0x7ffc19bb3cc8,0x7ffc19bb3cd8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,13252962805541899255,17114477499282017490,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,13252962805541899255,17114477499282017490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,13252962805541899255,17114477499282017490,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13252962805541899255,17114477499282017490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13252962805541899255,17114477499282017490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13252962805541899255,17114477499282017490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13252962805541899255,17114477499282017490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,13252962805541899255,17114477499282017490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13252962805541899255,17114477499282017490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13252962805541899255,17114477499282017490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13252962805541899255,17114477499282017490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13252962805541899255,17114477499282017490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,13252962805541899255,17114477499282017490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13252962805541899255,17114477499282017490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13252962805541899255,17114477499282017490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13252962805541899255,17114477499282017490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13252962805541899255,17114477499282017490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,13252962805541899255,17114477499282017490,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13252962805541899255,17114477499282017490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:4052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
28c6b1ef637f3b65fefaef49513dec8e

SHA1
ee7b4f66d7c1688818649a39bd65da5a9797c91d

SHA256
bf1ea3b55b12f0bf4e5a081bea43d608e406057e9abde824fbdd594c346be673

SHA512
1edf7a3a14b08b6d99d18018b5d12dfbc0da3d7f8726f2c9a0a9fbfcea6665bc35d8d1a374cf422c562d3f670bdea54f1108f76630eb78411dde3419bd45355d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
8bb126bee47d37c81a383588c8cddb55

SHA1
b91ed7995b8482e3a53418e7ef0b84aafb89576a

SHA256
d7008c99e829202cbfef959ad38ca8f6928615fbc5a648def3636029dee1aff6

SHA512
66e332959f3763337b16053e90de5a1011c39462ce4b461844602af3b39e3ed5235e9c9ef8c50e268c9cee0c04c3fa30d310bbfd56fde2bb812420f62df226a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
674e0f5b6b86193300b742c481f1dd9c

SHA1
ea846097c499d97e0d9261d9c5e4b2383103441b

SHA256
7b6ed59cef9f2fd076f17cf7b3721092d82c10419b59328c9319cd1c29e71f62

SHA512
f363cf51122b5b57c8440384c9cbb7c6317049b13bdd53f4faa9abf9f68ad440d8b80c61a02ccee22b343f7b15a39b0ab9331775248e8ea98221590101a37c8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b0ed2b8e3700388af33c902ee999b8db

SHA1
3acaf68aab69a26550a01a414e6f4f83b0608ee8

SHA256
0224fa898bd3a6fffc90ab88e8eb906b04ff919e59522fbefe65e458f1a62856

SHA512
99ba317808b99f3ff879f61d05f118b057a34315ed2794b676add94978d6dd45bd29f0b44a2e7230796eea6cec4a0a36ffa6f2db78926f864b51b7513ea9a52a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f950c9740c943a403ee68f3dbccf3f34

SHA1
df7e2049f94369d72e6887f23a2a30ec2af96a0b

SHA256
cf994292e0ea9bbecbfc4249044c900e13da1263f54aea2b6e2fccd4ef5860f0

SHA512
1eb1757ec4d1fe4083a9efe98b99465be9a9f7b4d6fb42cbd26769afdf2467a7bf865c9b1f03d985abbc5093af8d8e3beb17c39aa327ee3eef7f4db83fc0fe8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a177e2d049343808e44b1b06bb622f78

SHA1
a8764d0aa38df033fa85bc411d7a48202bdb7156

SHA256
3de91ac4787a88c882c5306dc57d656cad0d98ed4a98437e4b4737999a29684b

SHA512
f7c08d7355f2bd841e1ca58bca5d95b86204ca10340aacab70fecef2af55f0c68299d914b72b38d6241c2b93f906b2c1898f86e99a891c1b97708556b54670a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f4185d2e06ff1dd3c5ecdd21211acbfb

SHA1
1f5af564e1ceb3c8c32c9449c9afc54624a753df

SHA256
ef96cbc722007e205e9b481db964051ade2e14fe5db6aef17f0ab8f01d3e55f8

SHA512
a423c6972a11dfcdea016a7e8ad90a29e8fdc93a424d3664cb4e54f0e43754f7dee5134c720d03d32fbcca9f65a3623d55a0b2673a14588afd8520abf8ffdde4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
02990b65552045bba69c560cf56f2cc8

SHA1
e23656cf38aefb40fd30773ca7e4355ece73cffe

SHA256
e905f9a15ee6107162b2ecf8b454051809de2f15a482b3b31106b8daf2837810

SHA512
a89bbea568c840f5b527cb25a24c48d6ccdc06a854b5816999727a1db819166e62a92e6b2d363f367635cce47cf2d3661a62fcb818e8afbe65f8574961b84b42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b5e63dd0b49713e79dc958e3ba7f463c

SHA1
82c473c69352605b63b5e2d3a69ab92f0f56ba16

SHA256
ba4abe2c8a2625fe00686d3429b6de6b9157cf58b6dc855dadef20cddb789436

SHA512
e174517df27c9a92ab21251b8190462dd59ea62f87e51dde0c293b4840c32b9f17de2c4b48425f70f9af728e209459e0ba222133026d4a405d979f0b2e6b973a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0

Filesize
2KB

MD5
68d04f7a5004e519bd691f13aa494e0e

SHA1
22b9cc4cc6909e96d79ecd3e9b03451c2a037a0a

SHA256
faf12f12366227d771427f5658ce1de41d3ab1fa5590bfb8b46d49614f2b55ad

SHA512
840f1332d6276a5a903fe67d9282c2325d1d7aa41ab5b516939d4f6fd2dd959e06e94b7a30254deac83a502d102a8a7ea9a9bde8a88c4e48a315b03eddcfa657

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
5ca18a9b1e476445f9c0740f2e1bca7f

SHA1
9a9b7926327dadbdd2e2b63c13edc4d40ee3e185

SHA256
05ce31f9eab70f8ffe6a91873fb05401659712af379675d9bd55d7b2f130d970

SHA512
89d5ac5b31bb1c9950116b5add2f5f3c56e3fb103f11a286dfedc3041ce527653db04e64f9e7949683542b34f69a0f82ca0027e84b9f06920eaf78119791d629

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57dc08.TMP

Filesize
48B

MD5
b10987c1ad5071107d2aa596c13ca08d

SHA1
d48ead761e2e82e8bfa5497453da3ce4bd71e99b

SHA256
b1b4c72382197d4fdda331622a3dc5212dc01c34331df378c6fbd70f800b13a6

SHA512
59d8c362fb872353dfbd45df7406422ffcb1df7a5bbe643ecd02ad7be7ee4ceb705b5a0ed387fc31f71012e85894705ef3472b293ec977b37dfa8d21b31c58ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
db15ec7ce5bea5450efed1b9623daa7b

SHA1
14644aface36cbc6490810b803b112fe572086e3

SHA256
d6a690995e0b4f51ecee6c8cdfd8ec917503dd1419f449920c174c8642848edb

SHA512
df3f9234d47fe84bd604544fd37b6e406eedc23b8e9020aa8972ef2f840ab417d79b7cd9b3d17b3ce5016b97cf0c11d2121d7a05bb8d94c7683567b653a9a935

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
42ac6d52a5361d5d4d5735ac3b728f1f

SHA1
56704dedf877b4c05d605baa9b3ef70f375499bb

SHA256
48375978c69df8cdd1069a01ef2e65b0e6436f9f95e20f4798692d40ebb7e103

SHA512
c705187b9dd27a4a319289ee898085b8f08474b839a90c83981c47fec0a81a4b0c0c137956231523269deea2812145a94113ab33bd275f5cad8b4309d1b87a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
3978b51bd9186481df201a8c438f6f37

SHA1
78ec9dda2bfa811096a03db03c9f1f9f7662308f

SHA256
c9ed12eb2f12849051c1f242c2a0ad03261e926da6f055c2f61f83897f2aff76

SHA512
da17d796169633cada608d3e2136b01d52d0cbdc123492132513f17624dcb2c2e2f5bae078405033a7dfec65a83469c6a4a85878639f7fa9f395255dcac09afa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58296c.TMP

Filesize
537B

MD5
bbc7af5c0f87047d2d96c43e92968310

SHA1
047cbea6071e15e1aa871436aaff27d11939ebd8

SHA256
59c52d9d352943749e5105a81ab2da064048907404648f2303e5a41de659260c

SHA512
d81289eb08b5ece13e476f67476a232d1d28655f9e418418abe5d21932888bf787ec63f2e4f05a3733f31caa8790f60f94a00e27bfadce0f0915101c4542b58e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ca6271eac162a63af3c3f51347ee0c13

SHA1
be7903e4a3c14437ded1032f78c2cf1ac3a91983

SHA256
489a616777b30ffea3eff4f62b81f9ec9af541b72fb867c856650682ff113b38

SHA512
6836701f762d91517ac1a511481df722ad79008cdafe568f00bb803be24a1b0e622aac79a2d92510a80b1de10db8006115aa26bbbf2ba8f66db2919bca0724b5

Download Submit