30c217930b807be8186a24a3e4d1b66f418e3e9652b3991486d21fdfbfe9020c

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2025 09:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[H]aaBX Public Hack V1 (MPGH.NET).dll
Size

8KB
MD5

f2c3b304b4c136c7b2fd41efca025be7
SHA1

2c19db1adeee436c60a2938a927c66c1060fa109
SHA256

ac5174c7071d4471f98760a5ee789eb0ddd2e8cb6bec5906ae1189b6118f9308
SHA512

4c4b76c2c4026d17f1dcf94800cd5fa34a8a75178ca3664b994c5003be7f070e6679a7a33d22d5f3f2eca3400c376e537ae519c8b522a675aca19f5291fbd91e
SSDEEP

192:fTdp1Vr7VNGJD5fAJvv9OekQaNFRe3X3PGR6Js2:5lvVqGX9Oek5NrCnPGe

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3588	msedge.exe
3588	msedge.exe
4024	msedge.exe
4024	msedge.exe
456	identity_helper.exe
456	identity_helper.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 3044	5096	rundll32.exe	82
PID 5096 wrote to memory of 3044	5096	rundll32.exe	82
PID 5096 wrote to memory of 3044	5096	rundll32.exe	82
PID 3044 wrote to memory of 3152	3044	rundll32.exe	87
PID 3044 wrote to memory of 3152	3044	rundll32.exe	87
PID 3044 wrote to memory of 3152	3044	rundll32.exe	87
PID 3152 wrote to memory of 4024	3152	cmd.exe	89
PID 3152 wrote to memory of 4024	3152	cmd.exe	89
PID 4024 wrote to memory of 1376	4024	msedge.exe	91
PID 4024 wrote to memory of 1376	4024	msedge.exe	91
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 1732	4024	msedge.exe	92
PID 4024 wrote to memory of 3588	4024	msedge.exe	93
PID 4024 wrote to memory of 3588	4024	msedge.exe	93
PID 4024 wrote to memory of 2648	4024	msedge.exe	94
PID 4024 wrote to memory of 2648	4024	msedge.exe	94
PID 4024 wrote to memory of 2648	4024	msedge.exe	94
PID 4024 wrote to memory of 2648	4024	msedge.exe	94
PID 4024 wrote to memory of 2648	4024	msedge.exe	94
PID 4024 wrote to memory of 2648	4024	msedge.exe	94
PID 4024 wrote to memory of 2648	4024	msedge.exe	94
PID 4024 wrote to memory of 2648	4024	msedge.exe	94
PID 4024 wrote to memory of 2648	4024	msedge.exe	94
PID 4024 wrote to memory of 2648	4024	msedge.exe	94
PID 4024 wrote to memory of 2648	4024	msedge.exe	94
PID 4024 wrote to memory of 2648	4024	msedge.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\[H]aaBX Public Hack V1 (MPGH.NET).dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\[H]aaBX Public Hack V1 (MPGH.NET).dll",#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c start http://www.mpgh.net/forum/members/1402528--h-aabx.html
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.mpgh.net/forum/members/1402528--h-aabx.html
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff708646f8,0x7fff70864708,0x7fff70864718
        5⤵
        
        PID:1376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18153582880692743625,7235765497403503264,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
        5⤵
        
        PID:1732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,18153582880692743625,7235765497403503264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,18153582880692743625,7235765497403503264,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
        5⤵
        
        PID:2648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18153582880692743625,7235765497403503264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
        5⤵
        
        PID:3024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18153582880692743625,7235765497403503264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
        5⤵
        
        PID:2668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18153582880692743625,7235765497403503264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
        5⤵
        
        PID:1168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,18153582880692743625,7235765497403503264,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3956 /prefetch:8
        5⤵
        
        PID:4632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18153582880692743625,7235765497403503264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
        5⤵
        
        PID:3972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18153582880692743625,7235765497403503264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18153582880692743625,7235765497403503264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
        5⤵
        
        PID:1852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18153582880692743625,7235765497403503264,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
        5⤵
        
        PID:2024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18153582880692743625,7235765497403503264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
        5⤵
        
        PID:4916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18153582880692743625,7235765497403503264,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
        5⤵
        
        PID:2248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18153582880692743625,7235765497403503264,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5988 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1992

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x46c 0x3c4
1⤵
PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
1464914ff534c4cd30e61a4579e7dda8

SHA1
8b356099555f8c8283c40999fafa7664978dad36

SHA256
400f24cf113047b1ecbd284c92fc774db9eb9937f0b72e1e101c59d362defe1b

SHA512
dcfdbad304e81d51a7ec94b873ee819d505ffa2546c1e835a18799e30c66eddbd8c34353a4c1a3170fdda31c9ba5c806097d3088b1823b0b2b1fbe841ef9cc42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
ef4894a25b1c9a7f0efff81a399f08c9

SHA1
ec9bd693d6886819ba6742612793c3565504a5b3

SHA256
0a91891c5a7b89c29df39f89b1658243ebdfe83e8f8f956b167d8e247b35e18b

SHA512
aec9dbc910fa3374f00937bd8c57200939a7bc2d4890cd2949a12a64207bbc9d2293412b53b175802881866bacc196922c32dd85c98b75aa0e94fec574ee3882

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d46c46b90beff61b649b6eae1ff6a87c

SHA1
d2b83548ce1e18368cc6fb2a0b06af7047ff232f

SHA256
6507423885d7ea7374f891dd44dfa20ddd589d8982414908e51bd442ba6609d3

SHA512
4c3adbf38bfe0aac451a46f2881c678cb67bafa3fc9e251eb49b485898e4dad6cf21b1b20c71af7bf281024de5135ab3a1f4eacdab4217a2700b2f7037ad3c62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3ef172e5e2cd7fd7aa2371a09025aeb4

SHA1
3ff379f645bc817c8446ddecd7386d24dbcadbd9

SHA256
db4e7412db79ce6a87519ef419335cf341149e1b388dc965d83df2beb6896f91

SHA512
5799f291014d1a99dc8d13d4b55c8616d90bf270fa01fac01f8b1d895b74503ecce940cac651726fac49ed32961cd86be9cdc35d368ffbd533497c20b5de0049

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7d69edbc2bfd4285b5ac5e8a06068bf2

SHA1
48b4f3dc11ff8ec7220872689c9852919a2c911e

SHA256
acd962a38526cc4d3586cbb35e13e0c5e8efd9c62d2c646afaac2ddac2124d76

SHA512
11f52a3c61efef850da666d943ed25a77081c0f4076409249334be0569b8b7d3c527e1c5ad51590a46a1641fdd1a646440320a3c30d822e13868bf8c9e60e4c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f7b2493d-4251-4f9b-a26f-52c1e4d96ac1.tmp

Filesize
370B

MD5
6ca8ca1cac39f71ad9074d5578a7b29d

SHA1
734123419ee729737fc29d8074442774bdc39484

SHA256
fcd50c5d227714f053fc055f49e330a4c75aa2eb1c3a0803158711260aaeaf9e

SHA512
42299d26d803bbe0cb444f891e272cb858a2ec75dbd44bba3b31d2bfcc6b616cd9ec91a1a4ad9dfbf0a4ad7fdbc479be0c886f17c9525c7665ac8423f465d7b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e9352a6e8339597c95ade0f7fb5c5b0c

SHA1
d8bf808c509bfb7b777daadbed22fa8a42e9f882

SHA256
80a43e415277298746d18d4a49593185b6c9dec3f678afafb90714355d59d1c1

SHA512
49209ca5dd0371a6e416718573e341ace0d381a36911a9b2d23ade8dcdcb6d526b9015aa22b8a7815923c88c5499c522ad45abbdae7a1059520362c39bb37e47

Download Submit