2d97f74db917842db3751a7a7f5ea98428cb8ecc482b61e9e35525e9f869d95f

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2023, 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

541f9d3b8a2c1909a22ded581a042b92bfe9688f19887853c6d363823baa522e.exe
Size

30.3MB
MD5

f1f4e5b1fee87e3f5c9a9acab413ac2e
SHA1

59f298a3ecfff597e0f66f99c240e922c860e853
SHA256

541f9d3b8a2c1909a22ded581a042b92bfe9688f19887853c6d363823baa522e
SHA512

3810f39cf09e9651f3fc52c22c335d8ed6f78635950ceb31e65ac2bada578b904529cd2bb3fe4380aac5a16f6c373d1f37d6897e8a138d7320429772607e5c6b
SSDEEP

393216:esIkUsPzThci2CsLVWXb1thPvJm8W5olGa4YH:6kodCmWr1v7ZlGgH

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 738536.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
3132	msedge.exe
3132	msedge.exe
4404	identity_helper.exe
4404	identity_helper.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 3132	4404	541f9d3b8a2c1909a22ded581a042b92bfe9688f19887853c6d363823baa522e.exe	85
PID 4404 wrote to memory of 3132	4404	541f9d3b8a2c1909a22ded581a042b92bfe9688f19887853c6d363823baa522e.exe	85
PID 3132 wrote to memory of 4916	3132	msedge.exe	86
PID 3132 wrote to memory of 4916	3132	msedge.exe	86
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 4164	3132	msedge.exe	88
PID 3132 wrote to memory of 2848	3132	msedge.exe	87
PID 3132 wrote to memory of 2848	3132	msedge.exe	87
PID 3132 wrote to memory of 3632	3132	msedge.exe	89
PID 3132 wrote to memory of 3632	3132	msedge.exe	89
PID 3132 wrote to memory of 3632	3132	msedge.exe	89
PID 3132 wrote to memory of 3632	3132	msedge.exe	89
PID 3132 wrote to memory of 3632	3132	msedge.exe	89
PID 3132 wrote to memory of 3632	3132	msedge.exe	89
PID 3132 wrote to memory of 3632	3132	msedge.exe	89
PID 3132 wrote to memory of 3632	3132	msedge.exe	89
PID 3132 wrote to memory of 3632	3132	msedge.exe	89
PID 3132 wrote to memory of 3632	3132	msedge.exe	89
PID 3132 wrote to memory of 3632	3132	msedge.exe	89
PID 3132 wrote to memory of 3632	3132	msedge.exe	89
PID 3132 wrote to memory of 3632	3132	msedge.exe	89
PID 3132 wrote to memory of 3632	3132	msedge.exe	89
PID 3132 wrote to memory of 3632	3132	msedge.exe	89
PID 3132 wrote to memory of 3632	3132	msedge.exe	89
PID 3132 wrote to memory of 3632	3132	msedge.exe	89
PID 3132 wrote to memory of 3632	3132	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\541f9d3b8a2c1909a22ded581a042b92bfe9688f19887853c6d363823baa522e.exe
"C:\Users\Admin\AppData\Local\Temp\541f9d3b8a2c1909a22ded581a042b92bfe9688f19887853c6d363823baa522e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=6.0.20&gui=true
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c23946f8,0x7ff9c2394708,0x7ff9c2394718
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
    3⤵
    PID:4164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
    3⤵
    PID:3632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
    3⤵
    PID:2120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
    3⤵
    PID:2700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
    3⤵
    PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5112 /prefetch:8
    3⤵
    PID:1156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5464 /prefetch:8
    3⤵
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:8
    3⤵
    PID:668
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
    3⤵
    PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
    3⤵
    PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17824821734687634100,15001134871966673833,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5496 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7ad9bb1054aa03e39b3554833d0c3ec

SHA1
cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9

SHA256
0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189

SHA512
d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
e3f1f045769959a67f1db022f1090139

SHA1
eb264dd212c5b48fde3612916d2ef413708a5c8b

SHA256
414fdf0318b8e376a1618cae0b6a748a4ca6b543e2f8ec20e276fb44f16c1657

SHA512
848694414a90dabd44c187c12b5ffb625681bde80d8c1b643fd62e9f1f85d12652af070bda9fed791481b67d38c1623617b79ded7a92034e647290e249601849

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1002B

MD5
b5f30b23c97d95daf3b0e326448a115d

SHA1
3d167a4ad1506b7e6ae0373e312bbb2c1c4ac6d2

SHA256
9f279e5bd50c309aa82b6694a234392abd7eb7ffeedfc166b6bf6dfd7cf08d60

SHA512
ff65275ce86223dc213f1302740b058de97a8ea8b0a02d6ae287decb967ead28eacf955f3d663455bd3fbbbc6e8f63216ecbce8a0ae1da20e5195bf6f30dfa0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
902B

MD5
a904591b983a48b5e587d52a313e992f

SHA1
6f62e1a04d4d3d2d65179cc52dd8aa0a2666b0e4

SHA256
a4c7e19f30386f23c1cdce742aa59003cc3ed5196165eb467d2e7d473bf6ce63

SHA512
b26219e20de3814a259ce330756eb0faf60a6497304050eeb587a0bf1419a26856111cd42d60db610e4eb289d3d660e300392c9b03449c67f06e9a2aae5599b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e2d6d1840a9c1d1cf39c9da649d55a93

SHA1
aebe5dbc38d828eb93608a797e208a16ed8dd33a

SHA256
0eb43df4d5dc5675f877c5dbf27381cf9033ee3f2259c5801b89810336564ebc

SHA512
a6674f583e4a0d28e662d4893a97fd12d532dba29f095684ca10e5cc155553337f356074514ac1ce40d52a5ee12b704a6425bc60f7dafd15db061434a67882ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
97f1573ad51951aab266a402561fac34

SHA1
23f31b074e6d564eae0656353a5670a04cbfba0b

SHA256
881587465ae635d2bebaee306b30215d9222728faa936d4584d46b15603e729d

SHA512
b7ca84398804f023347d0a064446800d2b9313b8e3d381b2a27ae3c70bfb97e696085d4c33a6678612bc09279432e2b1cceafe3f1d7eea68dc5c88c72d50da19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e62cc4051e1f8eaa0abda5d730a2496b

SHA1
d15346e40b196bc313cbfe5ac96b3c90b83345be

SHA256
ffb5b740b8777d010f0d32a120092084c3cd32eaceb937188d698ddc22df2fcb

SHA512
3e8f6d89c7c153177b2149d86cd8602ceafedf66f5335a86b19dfa46fc38c47f6ff9a272c3b71b4464a5921ebdf2461fba25692ca916b9715bac520bf1e81a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
2b394da3099e92f88870b13d108ff92a

SHA1
6367c9d296d77b0fbc784cbb1c07378f9bd22b44

SHA256
1c04aac3a7d80d5c39c54af988f43d592a69ad501b3dc1248ddf23b0246af153

SHA512
7f5bbb66229702ca7206acd27ae01e0355d341d6d1e6525b041cb0c1f0435d286636f20dacde0d030f054990f794c3f6c62a1e636c01ded496839c6cfde88a55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
c6c7864dda17050539b30ace408b4bd7

SHA1
188085aa042c152c6a8719db99da1e2cf9bbac5e

SHA256
8ae8ea3f28e7897bdceb8646e404270cb518320daf2c6bfafebd200bed554992

SHA512
131140a80bf9b05b5798fda70847928ae3d77d861c6f32fe160f73d836c94e1a166aa8102c627b78afa22a332a564ca87b4e229b09330535903eacfb607f02b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b939.TMP

Filesize
539B

MD5
ea7d117e78228e05b6780d80257acc39

SHA1
7285d2d447e2c3741ac22c15191a84a94f244045

SHA256
868e3c4a0031bd2d4ff288be68033b6b60d26d9e44775335135edeb33b8e5b1a

SHA512
90e3a2e2b5d35622577bfe0afaa3940688d9753ac7d28938abce4698bb365bf448362fad659f9ca56d4ab1adc3277b29560d754767c3a98a34e80e28e009d27b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
67ec12b9bdf72e3a4cc3832656fcf391

SHA1
35e1827a7184394f93cdbbb0b01c15ac806417ee

SHA256
1ddc6282ad2952255668a406d641dd10f22197b2d3ca6b08b38fee6964a683f1

SHA512
83e55174f72af365eff1244d0c84d5756e13a5c4f5a4cf6685ae48e9396293c3e38f4100ef9a342c85ae14b485ff0c2d5cf147809f3c7efed152e83633a4a401

Download Submit