92e4e850eb030e73692a3ee3bcb2dbdebfa31d76736c346a6d2978653dfedc7e

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2024 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92e4e850eb030e73692a3ee3bcb2dbdebfa31d76736c346a6d2978653dfedc7e.exe
Size

82KB
MD5

add6b42a90941c5b7ad6893a27cd5904
SHA1

7e67f6d0cad9660955e167c6e6f3c3042b704af6
SHA256

92e4e850eb030e73692a3ee3bcb2dbdebfa31d76736c346a6d2978653dfedc7e
SHA512

d76b02e6b23fbf1a5c24ad315ffe7219bc83ad86e1ca36aac91d562ac01b7fa4ca8755b3d1d8bbef71326b121ba9e2307512accb1f2413eb7fb88094f3a089c2
SSDEEP

1536:juScq5TA5c2qEa3W3bgXSymhdPx2CZPJMVCZPJJQnIrH6zTXFQwDztE4zEc1:ju3CTA5c2uW3bgsdxzPJhPJUIezjF+45

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	92e4e850eb030e73692a3ee3bcb2dbdebfa31d76736c346a6d2978653dfedc7e.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
5000	msedge.exe
5000	msedge.exe
3336	identity_helper.exe
3336	identity_helper.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 5000	4316	92e4e850eb030e73692a3ee3bcb2dbdebfa31d76736c346a6d2978653dfedc7e.exe	87
PID 4316 wrote to memory of 5000	4316	92e4e850eb030e73692a3ee3bcb2dbdebfa31d76736c346a6d2978653dfedc7e.exe	87
PID 5000 wrote to memory of 2920	5000	msedge.exe	88
PID 5000 wrote to memory of 2920	5000	msedge.exe	88
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 3432	5000	msedge.exe	89
PID 5000 wrote to memory of 1892	5000	msedge.exe	90
PID 5000 wrote to memory of 1892	5000	msedge.exe	90
PID 5000 wrote to memory of 3112	5000	msedge.exe	91
PID 5000 wrote to memory of 3112	5000	msedge.exe	91
PID 5000 wrote to memory of 3112	5000	msedge.exe	91
PID 5000 wrote to memory of 3112	5000	msedge.exe	91
PID 5000 wrote to memory of 3112	5000	msedge.exe	91
PID 5000 wrote to memory of 3112	5000	msedge.exe	91
PID 5000 wrote to memory of 3112	5000	msedge.exe	91
PID 5000 wrote to memory of 3112	5000	msedge.exe	91
PID 5000 wrote to memory of 3112	5000	msedge.exe	91
PID 5000 wrote to memory of 3112	5000	msedge.exe	91
PID 5000 wrote to memory of 3112	5000	msedge.exe	91
PID 5000 wrote to memory of 3112	5000	msedge.exe	91
PID 5000 wrote to memory of 3112	5000	msedge.exe	91
PID 5000 wrote to memory of 3112	5000	msedge.exe	91
PID 5000 wrote to memory of 3112	5000	msedge.exe	91
PID 5000 wrote to memory of 3112	5000	msedge.exe	91
PID 5000 wrote to memory of 3112	5000	msedge.exe	91
PID 5000 wrote to memory of 3112	5000	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\92e4e850eb030e73692a3ee3bcb2dbdebfa31d76736c346a6d2978653dfedc7e.exe
"C:\Users\Admin\AppData\Local\Temp\92e4e850eb030e73692a3ee3bcb2dbdebfa31d76736c346a6d2978653dfedc7e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=92e4e850eb030e73692a3ee3bcb2dbdebfa31d76736c346a6d2978653dfedc7e.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffeea0046f8,0x7ffeea004708,0x7ffeea004718
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12832664003884493521,15092095648721406169,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,12832664003884493521,15092095648721406169,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,12832664003884493521,15092095648721406169,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
    3⤵
    PID:3112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12832664003884493521,15092095648721406169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:1012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12832664003884493521,15092095648721406169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12832664003884493521,15092095648721406169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12832664003884493521,15092095648721406169,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3488 /prefetch:8
    3⤵
    PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12832664003884493521,15092095648721406169,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3488 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12832664003884493521,15092095648721406169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12832664003884493521,15092095648721406169,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12832664003884493521,15092095648721406169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
    3⤵
    PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12832664003884493521,15092095648721406169,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:2060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12832664003884493521,15092095648721406169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12832664003884493521,15092095648721406169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12832664003884493521,15092095648721406169,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=92e4e850eb030e73692a3ee3bcb2dbdebfa31d76736c346a6d2978653dfedc7e.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeea0046f8,0x7ffeea004708,0x7ffeea004718
    3⤵
    PID:5088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9439a301-0b05-4779-9133-9be70c6a08d1.tmp

Filesize
5KB

MD5
ff368932f8e62bf8dd7828696aac7b87

SHA1
e7b9c3eab3273b66c078532de61d126ac904c691

SHA256
d8bdf90248af40ae116de206fbf5ab61aa401ce49b4d25182763ee53ade237d1

SHA512
afc13d4221692f45b5ae50eda71fb9ac3c1529dfc60c044f0daae9322e24cfd2715a2873a91d3d8271fefae344e0804f1845649a2658514ce7a8fb318aa008ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
454734edad8cd883ec1a8da4b27c2a20

SHA1
a276598227d5036b2dfd14bf46e2eb146fd92b9c

SHA256
919dd9e39625c9a8443f1cabfb03aa1ddbb365e7fb5a7ff85f48c1426d66a7f6

SHA512
df89239a4f08628f965183050348512805442e460c79255c9fe1375d5d402692e90bdca533af9f33c21cc6300c12bbf50a5cb6d09df2c39b349a03cec71c75dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e3a62f04ee22fb79f358a6f15bc4f47b

SHA1
1582644f88bc1d9906139d82d6daff67d5e00313

SHA256
3d5d2fe52e861b8bcce7e0d0cc231c1b1ac55bca232e0245062bddac65fbd8ad

SHA512
ea834090b27d496785d06520a39feabd684e9fede09994fd502a762d135477e7b5e82cd8e032e2bf03a18a6f56b9ad054baae1e035728f80e2dba3cf86e7a559

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
23d18c25f7427fdfcff55cd64f280237

SHA1
3649a242e9c42ad05baac04eb77033438c47fcca

SHA256
894c402ab7b95f87a7ad8de68aa09cfe929f85f6f3f84fbfb59b68fc67e49de1

SHA512
1a04e05be988ca904137e80b0b042144ad11b094c9efb8b2f349dde9393134163b52e0d537429ae9a9b292ea203e887837a13e217c3c700b1267d2edbd7b6ccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
6f28bf9940fe0d7032123ef63a67b16d

SHA1
5bf668f24218646ba81d437d617d5e9e175743e6

SHA256
c516dc4a128c4a70e64e40c3f9b32151e386ad2561202c2e1042ac4d72347f2d

SHA512
9d441a43fdc4587b36ba62c5de9956252fa72bde070de0072e1c734cda03b7700fa2c252a9ee0aca7efc7e968b037f48dae9c0db7f9b6339b7b60474b6e33ec0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58295d.TMP

Filesize
371B

MD5
e45ba01526e84453905597e66f55ff92

SHA1
603b67ec6d56ffe972e889a2d7752c5abb24e9dc

SHA256
0371c164a44ec1abe5fa372f195373a46c237da871ef32e5559b2ab65aa7acc4

SHA512
0522d088b787eef23f1d45357c7f11097be9e63d53f1c131635bbb4f114b6badc35f7c4c42b12983c877df4c73a5357888f7782a23bd460e4399c0c6e9e97cb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a49ce77b7d5c7b98a40a1964bf3d4a08

SHA1
b47b4ee335a7a31d8a5beced4e791de2537c9926

SHA256
e91a439816160ee6e090c80b081e42808cc4165902e2a3086e7699a38a73946a

SHA512
82854cc2347b8d1077e87cf5e8e328e62800c8304b2ef452a441438ca11eb8fcfbbd98fe7ad3efb5cd01caae064aaf0f8d0f541ba96c9b1a24a5a8c1321de995

Download Submit