76bc6408c500d8c756b7c51c34ebabc303919cc91707665653bfa10f4bd46630

Analysis

max time kernel
148s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2023, 12:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5cf5ab70c737be745241c99bfa583ba01d590dab01b7b89093f7eaa6adf947c4.exe
Size

31.6MB
MD5

b15089f83de33a90160b00999d55df70
SHA1

dfa8ec4d43fae89b1370685790046305754739fb
SHA256

5cf5ab70c737be745241c99bfa583ba01d590dab01b7b89093f7eaa6adf947c4
SHA512

a49d7f51e6da646e368d40230354b4f8cb8ba303f03416bc40d62694e148a3da6028c3e613fc6ff108d37932f856521e5c6bf21b25ea8de0c87ba37e951fc29b
SSDEEP

393216:jgODv8ZnwVTRCLbE60IdCESwL8ZNoZilm0vDJsLi0T2N:yZnwmkoSpELg

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 489774.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
5048	msedge.exe
5048	msedge.exe
2960	identity_helper.exe
2960	identity_helper.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 5048	2280	5cf5ab70c737be745241c99bfa583ba01d590dab01b7b89093f7eaa6adf947c4.exe	85
PID 2280 wrote to memory of 5048	2280	5cf5ab70c737be745241c99bfa583ba01d590dab01b7b89093f7eaa6adf947c4.exe	85
PID 5048 wrote to memory of 3900	5048	msedge.exe	86
PID 5048 wrote to memory of 3900	5048	msedge.exe	86
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 528	5048	msedge.exe	87
PID 5048 wrote to memory of 468	5048	msedge.exe	88
PID 5048 wrote to memory of 468	5048	msedge.exe	88
PID 5048 wrote to memory of 2308	5048	msedge.exe	89
PID 5048 wrote to memory of 2308	5048	msedge.exe	89
PID 5048 wrote to memory of 2308	5048	msedge.exe	89
PID 5048 wrote to memory of 2308	5048	msedge.exe	89
PID 5048 wrote to memory of 2308	5048	msedge.exe	89
PID 5048 wrote to memory of 2308	5048	msedge.exe	89
PID 5048 wrote to memory of 2308	5048	msedge.exe	89
PID 5048 wrote to memory of 2308	5048	msedge.exe	89
PID 5048 wrote to memory of 2308	5048	msedge.exe	89
PID 5048 wrote to memory of 2308	5048	msedge.exe	89
PID 5048 wrote to memory of 2308	5048	msedge.exe	89
PID 5048 wrote to memory of 2308	5048	msedge.exe	89
PID 5048 wrote to memory of 2308	5048	msedge.exe	89
PID 5048 wrote to memory of 2308	5048	msedge.exe	89
PID 5048 wrote to memory of 2308	5048	msedge.exe	89
PID 5048 wrote to memory of 2308	5048	msedge.exe	89
PID 5048 wrote to memory of 2308	5048	msedge.exe	89
PID 5048 wrote to memory of 2308	5048	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\5cf5ab70c737be745241c99bfa583ba01d590dab01b7b89093f7eaa6adf947c4.exe
"C:\Users\Admin\AppData\Local\Temp\5cf5ab70c737be745241c99bfa583ba01d590dab01b7b89093f7eaa6adf947c4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=6.0.15&gui=true
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc89b246f8,0x7ffc89b24708,0x7ffc89b24718
    3⤵
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,17800844082788497353,3593779105679313493,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,17800844082788497353,3593779105679313493,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,17800844082788497353,3593779105679313493,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
    3⤵
    PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17800844082788497353,3593779105679313493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17800844082788497353,3593779105679313493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17800844082788497353,3593779105679313493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,17800844082788497353,3593779105679313493,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5200 /prefetch:8
    3⤵
    PID:1960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17800844082788497353,3593779105679313493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
    3⤵
    PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17800844082788497353,3593779105679313493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
    3⤵
    PID:2580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,17800844082788497353,3593779105679313493,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6012 /prefetch:8
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17800844082788497353,3593779105679313493,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17800844082788497353,3593779105679313493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
    3⤵
    PID:2772
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,17800844082788497353,3593779105679313493,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6744 /prefetch:8
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,17800844082788497353,3593779105679313493,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6744 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17800844082788497353,3593779105679313493,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17800844082788497353,3593779105679313493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
    3⤵
    PID:1116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,17800844082788497353,3593779105679313493,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4112 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1002B

MD5
be9f3a3e8142da7d50456e70a4b1cea8

SHA1
28f4ba8029601344a85e8375bc93dbf44d04ca21

SHA256
f3c0f8898d48f8c2a5995aecec87325490577ad7ef2f4a912e3d54d430157de6

SHA512
70a6a6d6a28bf033ee855287f57d31767aac6156ca89f528bdef36897f4c5aae5078a749792e6739e56b75add44c08ea2fcd5a6d699b92a9c12ed1e0d74d367d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
460e98da5fefdd603ebd20e79142e368

SHA1
8846a35d41720a08cce6d334b3213c83cd83d289

SHA256
f345d7b55c35afb099821afee6050a3bb839bd8976cb9d953e87ff1496d053dc

SHA512
e256d5896d7f0ba794263a3f2b15ff5b2b1a37d622cd2b32f23da4a20598eadab4fddb6f52b99329b1d2822ee7a202126ff3f4f3cb344681ee9a8eb6b63ef881

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
55ebc4a1e0083a7ffe744e05dcd940da

SHA1
86a871d7ef3e081a35b03346a107b4dd320383ea

SHA256
c02ffd7772cd929725b915511d426ebe2bdfbcfa97979a94845fd672cede9558

SHA512
a04ad5c4c3bd76db3a920888a2ee3d98ccb6e977dc10132a91a1034ee9dd6f9b7092faa37940c260d492b18648621d342227638c938912352f39f26418eda84c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d555d038867542dfb2fb0575a0d3174e

SHA1
1a5868d6df0b5de26cf3fc7310b628ce0a3726f0

SHA256
044cac379dddf0c21b8e7ee4079d21c67e28795d14e678dbf3e35900f25a1e2e

SHA512
d8220966fe6c3ae4499bc95ab3aead087a3dd915853320648849d2fc123a4acd157b7dba64af0108802522575a822651ecc005523c731423d9131ee679c2712f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
2f3877373b700148ec8331a725b85cf9

SHA1
f95426a5f4c5219172186c04c375370df0728146

SHA256
5a944c66c3d94aceabc6e7c1eb9ebcc0bfcd442499b46521609ad83fdda6690d

SHA512
97e11251ecc1fca1fcba581e9f6a3f4ab62fcf0f35677e644ee280f5fdaa0842f8fcb0469d87cad98d4727999c77caded2fff0eef8aa54b320a3e1b1f9474c80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
a82611d983d5b4eb43801e34b304b3ba

SHA1
8a1164708e79c2f05482f72c732db5f409570431

SHA256
e37845326a0c0ca699ccc355043477c21412eaad64c85a8db1e785a08183d2f5

SHA512
adac11f55b559d3cbc89cfe146695757b4a5af6afeae2c20753ff620e13a76807733eb0b81709fd5bef7e84394f09be064120fc815315ceca4a5448a7c76d4f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58dd8a.TMP

Filesize
539B

MD5
2b048a11ffdb7b514bc3f92041dc8e82

SHA1
3708418ff2dbe5da38af574b396fc07cc60bc52e

SHA256
0d721ad9eae6276682bf3caed81e02958dd186238dc13645c9f428c61cb770de

SHA512
e2e7836870a9d9214286b84df907fbc9462b52f861cc777773d26c61793d7d1d7c251d444b48dbc8479a5c713e985222a1775967f3c23e2629645d61650a5a86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bd18ea26b49fb3228acd6698a784f0bb

SHA1
d7d603ec1f43833485ff1144578efd5ebe283c94

SHA256
1afe1ff3e7a9209102336d1192392a821db321ee6288c4d3e04f8b6693658376

SHA512
e8b2129d7a881a1a95fc6e93a5d3ad8876270e9c76570d61a3c64236380d05b36d4c665a2d462d5da45e264788fde31e7cb9dc36c673d03df324947696d3adaf

Download Submit