13a1ef9d08a32c9463269bbc9efdd9f3192c8eb51faed5e9105df9471342aed5

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2023, 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

658a394fdab3688501ff7cc0fe4908a3.exe
Size

1.5MB
MD5

658a394fdab3688501ff7cc0fe4908a3
SHA1

1428fe8541046aeaf890c9e3d46796959120961f
SHA256

13a1ef9d08a32c9463269bbc9efdd9f3192c8eb51faed5e9105df9471342aed5
SHA512

d00545e0a65a89850a6d02b08cbecf0ade66cc574beab6dbc2b7a1c372afd17f253703d0914ec4a1ff5f515128a26b359a65bb7f70654b5407361e55f845f636
SSDEEP

24576:JNxnadH7EFmI+TvAnIpLHH7EFmIBTvAnx4:JNS1zTYO1wTY+

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 293630.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3852	msedge.exe
3852	msedge.exe
4820	identity_helper.exe
4820	identity_helper.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 3852	408	658a394fdab3688501ff7cc0fe4908a3.exe	89
PID 408 wrote to memory of 3852	408	658a394fdab3688501ff7cc0fe4908a3.exe	89
PID 3852 wrote to memory of 2848	3852	msedge.exe	90
PID 3852 wrote to memory of 2848	3852	msedge.exe	90
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 4100	3852	msedge.exe	91
PID 3852 wrote to memory of 3832	3852	msedge.exe	92
PID 3852 wrote to memory of 3832	3852	msedge.exe	92
PID 3852 wrote to memory of 1708	3852	msedge.exe	93
PID 3852 wrote to memory of 1708	3852	msedge.exe	93
PID 3852 wrote to memory of 1708	3852	msedge.exe	93
PID 3852 wrote to memory of 1708	3852	msedge.exe	93
PID 3852 wrote to memory of 1708	3852	msedge.exe	93
PID 3852 wrote to memory of 1708	3852	msedge.exe	93
PID 3852 wrote to memory of 1708	3852	msedge.exe	93
PID 3852 wrote to memory of 1708	3852	msedge.exe	93
PID 3852 wrote to memory of 1708	3852	msedge.exe	93
PID 3852 wrote to memory of 1708	3852	msedge.exe	93
PID 3852 wrote to memory of 1708	3852	msedge.exe	93
PID 3852 wrote to memory of 1708	3852	msedge.exe	93
PID 3852 wrote to memory of 1708	3852	msedge.exe	93
PID 3852 wrote to memory of 1708	3852	msedge.exe	93
PID 3852 wrote to memory of 1708	3852	msedge.exe	93
PID 3852 wrote to memory of 1708	3852	msedge.exe	93
PID 3852 wrote to memory of 1708	3852	msedge.exe	93
PID 3852 wrote to memory of 1708	3852	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\658a394fdab3688501ff7cc0fe4908a3.exe
"C:\Users\Admin\AppData\Local\Temp\658a394fdab3688501ff7cc0fe4908a3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=6.0.24&gui=true
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb0cc46f8,0x7ffeb0cc4708,0x7ffeb0cc4718
    3⤵
    PID:2848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12059482891451332297,7567780137749896524,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
    3⤵
    PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,12059482891451332297,7567780137749896524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,12059482891451332297,7567780137749896524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
    3⤵
    PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12059482891451332297,7567780137749896524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12059482891451332297,7567780137749896524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12059482891451332297,7567780137749896524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
    3⤵
    PID:2924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12059482891451332297,7567780137749896524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,12059482891451332297,7567780137749896524,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5276 /prefetch:8
    3⤵
    PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12059482891451332297,7567780137749896524,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
    3⤵
    PID:3088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12059482891451332297,7567780137749896524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2148,12059482891451332297,7567780137749896524,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6516 /prefetch:8
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12059482891451332297,7567780137749896524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12059482891451332297,7567780137749896524,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12059482891451332297,7567780137749896524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
    3⤵
    PID:3080
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12059482891451332297,7567780137749896524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
    3⤵
    PID:1596
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12059482891451332297,7567780137749896524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12059482891451332297,7567780137749896524,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2864 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
ed034a155ed6bb56858d32498630c609

SHA1
b363bd6b0211b0f869750f88fb5d1cad00c15c28

SHA256
7ab7ae392bac2ec23f7d8e607878e454132d61f2731b73ba5d158e5c43a3f98a

SHA512
ae16e8fc2f98769fa22e107ebe6caf92215770ed7b82386b154a32c9b5a00f44f509c75423c31172d2557221506d487e29e6667104e5ce80e09aacd2c354891b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1002B

MD5
c1de15c39425b8e4e5be72ce1f912024

SHA1
2bb305f88d381ec0d83df0a82a9bccd247117c7e

SHA256
cd555214dc292f2596a78864619b2c7b040ecb9ec62b160f57fe65b873ebceb5

SHA512
6bd6c8ee96acb9a8658e13dad8339fc91919136b34005b1600d20289b48f960221a441639054f47ad35124d3e1f1d108b8460546d8843654337c85be6fa40f42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
50e79de9279cf2fbd7169f23d2238549

SHA1
1a512ac35e3853a2eaa25663b9613780b8a7f349

SHA256
43e1e5642dbeb12bd29e443c5a6cf095e74070cc59dcbe65928887ae1449afd4

SHA512
220ba036e9edfe13f06052e8be7577c15b99aecb3f4aa1ff12d2140f69c0d84efb87fff667a4fb2d9e094cfe34872510ef936b735703c6e5683128c848e4b877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7104b63a0c9df9b18f950d45f3a36833

SHA1
04da7d8a0e1dd7c28400d7f337c8a9e51ee40e10

SHA256
3e321f8d2323baf17c5aa35c83495d743dad9033b839f3e9da2cb675450a09e1

SHA512
ad6a450399d24a1514a7b16cc44f419bef79f252d336b30fa0a203bec2a0adc4bf25cc9f15614a4f3d42a2b98a79315f56b9c7bd0817ebcd4a265a33abbaa3e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3a748249c8b0e04e77ad0d6723e564ff

SHA1
5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729

SHA256
f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed

SHA512
53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
70c5f925f33094e96da082f913a597c7

SHA1
5008ce262edd95a47bdf38663187d673aa5b7791

SHA256
c2605384fae0120f80023c77847015648d1c988a25073ad4479a0308f8037bec

SHA512
197ad389c0a2e8df5f4c8895d0e1193f61f2eae7b3a04145e41c943c4619c6be952f481be1a9d5731c3e68e2a72362e409a5b5ae4acace0c00d59f6532c8a12b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
5fa6b5e35d1e305a8f204057cc36b6c5

SHA1
f1a7daefe6f19e5b0a96749c416eae6b41a4ffe0

SHA256
b09e24dd070a1d1772f04aae05f170792b1c7c1d2be483c403c1005b1f2bce2e

SHA512
1c47d7c284831ea87a4d78bc3ead223812d07774dac589493c10131a12bd104d8ffb6527f9268d8a3d8007c33d20619e8df86b959eaa0a446150ac59a5882bbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe591478.TMP

Filesize
539B

MD5
15afff612c0630631f650d336cfc20f9

SHA1
5e01a40a8a433d48fa4d4141edbd873b6fbfaf42

SHA256
88f779d067faf5bf403b4eb701700ca52cd3f2d5788054ef77a7244825c19eaa

SHA512
afa5ee04ccc1ecfc680586cf2a384c6a77441e7c2aa448253d6ce136a9f5d8aeeb5178f6588196c5acde18f33f7a7bee9d967b1c2862b3cc8c5b602281de513f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a327c773e0154d34958c50b997702e54

SHA1
c3bcf036f6bdf54c4cfbddef9456a5cccc515edf

SHA256
d490deea45df76b847f6bad86b16a7c5bff45039517c99377d5e4344d904c48b

SHA512
66c431fdb32d3c12a35ce583d0154366aa7c772f09e072c7f2c9c49aee6da3ea75f8bc8c7ed9a411f1ae09dc7a4f95fe3ab6d732e1175f24a49c891c7284f7ef

Download Submit