hxxps://wetransfer[.]com/downloads/bb709e53eb67a9ed42e2d019590eb18520240131160148/127d0059de6f80b0f706388151e5f87520240131160205/018b7e?trk=TRN_TDL_01&utm_campaign=TRN_TDL_01&utm_medium=email&utm_source=sendgrid&e=c56365ea&h=2671d568&f=y&p=n

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 10:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://wetransfer.com/downloads/bb709e53eb67a9ed42e2d019590eb18520240131160148/127d0059de6f80b0f706388151e5f87520240131160205/018b7e?trk=TRN_TDL_01&utm_campaign=TRN_TDL_01&utm_medium=email&utm_source=sendgrid&e=c56365ea&h=2671d568&f=y&p=n

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
1904	msedge.exe
1904	msedge.exe
4056	identity_helper.exe
4056	identity_helper.exe
1284	msedge.exe
1284	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2696	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2696	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 4048	1904	msedge.exe	60
PID 1904 wrote to memory of 4048	1904	msedge.exe	60
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 940	1904	msedge.exe	85
PID 1904 wrote to memory of 2256	1904	msedge.exe	86
PID 1904 wrote to memory of 2256	1904	msedge.exe	86
PID 1904 wrote to memory of 2980	1904	msedge.exe	87
PID 1904 wrote to memory of 2980	1904	msedge.exe	87
PID 1904 wrote to memory of 2980	1904	msedge.exe	87
PID 1904 wrote to memory of 2980	1904	msedge.exe	87
PID 1904 wrote to memory of 2980	1904	msedge.exe	87
PID 1904 wrote to memory of 2980	1904	msedge.exe	87
PID 1904 wrote to memory of 2980	1904	msedge.exe	87
PID 1904 wrote to memory of 2980	1904	msedge.exe	87
PID 1904 wrote to memory of 2980	1904	msedge.exe	87
PID 1904 wrote to memory of 2980	1904	msedge.exe	87
PID 1904 wrote to memory of 2980	1904	msedge.exe	87
PID 1904 wrote to memory of 2980	1904	msedge.exe	87
PID 1904 wrote to memory of 2980	1904	msedge.exe	87
PID 1904 wrote to memory of 2980	1904	msedge.exe	87
PID 1904 wrote to memory of 2980	1904	msedge.exe	87
PID 1904 wrote to memory of 2980	1904	msedge.exe	87
PID 1904 wrote to memory of 2980	1904	msedge.exe	87
PID 1904 wrote to memory of 2980	1904	msedge.exe	87
PID 1904 wrote to memory of 2980	1904	msedge.exe	87
PID 1904 wrote to memory of 2980	1904	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://wetransfer.com/downloads/bb709e53eb67a9ed42e2d019590eb18520240131160148/127d0059de6f80b0f706388151e5f87520240131160205/018b7e?trk=TRN_TDL_01&utm_campaign=TRN_TDL_01&utm_medium=email&utm_source=sendgrid&e=c56365ea&h=2671d568&f=y&p=n
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3c1046f8,0x7ffd3c104708,0x7ffd3c104718
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,6365767098906087393,15642362566046397056,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,6365767098906087393,15642362566046397056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,6365767098906087393,15642362566046397056,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6365767098906087393,15642362566046397056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6365767098906087393,15642362566046397056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,6365767098906087393,15642362566046397056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,6365767098906087393,15642362566046397056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6365767098906087393,15642362566046397056,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6365767098906087393,15642362566046397056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6365767098906087393,15642362566046397056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6365767098906087393,15642362566046397056,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2076,6365767098906087393,15642362566046397056,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1296 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6365767098906087393,15642362566046397056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,6365767098906087393,15642362566046397056,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6365767098906087393,15642362566046397056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6365767098906087393,15642362566046397056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1740 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,6365767098906087393,15642362566046397056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,6365767098906087393,15642362566046397056,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4716 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4476

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x39c 0x458
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eb20b5930f48aa090358398afb25b683

SHA1
4892c8b72aa16c5b3f1b72811bf32b89f2d13392

SHA256
2695ab23c2b43aa257f44b6943b6a56b395ea77dc24e5a9bd16acc2578168a35

SHA512
d0c6012a0059bc1bb49b2f293e6c07019153e0faf833961f646a85b992b47896092f33fdccc893334c79f452218d1542e339ded3f1b69bd8e343d232e6c3d9e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1008B

MD5
0f49b24a4c555cfc52c5e7e6b54c9a97

SHA1
15b07816c951946c98e6abf26f7e7a56f2958ffc

SHA256
2bedadd4dd9db13d372c90c8f43a13f5f6d84599e1898f60ddf1086b2ad293d6

SHA512
9af9628a609ced278ca0c740b21fd4332a05207e19487f530e3ea56f707dc2d2fc15e69b968bce93355f9339d6063a29ee3226395b06f4b2bd68229f24b657bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c1f55d6583a8a5eff9efc349d6b33cde

SHA1
30eebee9d53208f9339365fd4bbead041b33a3f0

SHA256
2483f448fa378ca9302d403e3cf0181e7e7e1aa4151a91ef1e9dde7c4309a81d

SHA512
891be21d7bba3613339294339b060bac76360eca2f5ed0fd8a5d4b4539cddb60760c871d506e7d16bbae6c5bec7d0a46cbba5d600b7bb1e244e046d9db8e5054

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
3ec572276974968332ac7f9ec525c798

SHA1
682c9e42893a854048f91ced241b69954a2731fb

SHA256
3d2fcdb5986bff286555896f7089bc92b0606af83fdd1372432158a21a0d8ae9

SHA512
d66fa15709654c077bdd6fc5a1b0134c3b61dd8af26f70795a020da34319c2212f0028d09b1e91bdea1a8592bcaab089860e56918c2cca97fe2ce49a119364a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2aa8db03c93cca0764b7900e7788ec89

SHA1
3adc445108bb5b608cccb348f1b22a643aecd159

SHA256
a612e464e8e49f9059827926e1250d65f099f0307aeba846c7571264cddeb118

SHA512
2ddeaeb4f0a3650933d37e54bf060d81cdd721c084e9e08b36258d0e95923a65770d6de9be90575e527d805b8818825afe0a1d0558179c11486d261fc03eab50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a396c8d61850029a77d15d974c1d408f

SHA1
cadb7d7c19a4ed087135d29db70e9f3fbb448df5

SHA256
d10dec67afc0dca67faec18680577904c903f6ab2d0fc1e8e056fc95a781e595

SHA512
1ffd3bbc2ed5c417168db8f6788d2b540fb88dc34a39b0eeaf0a18c65fd620d4d440164b166ce6934ac378f6437e447082e88774dcbb19af5b45cbaa4466b1fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
710e8fd72af227d76a0fb5736a6f65a4

SHA1
da48532caad0eee641bf8598a59fa5a702d33b27

SHA256
6348c678871f00fb698f3379b11ad6ae48976688b49cca8ba2efb4fb0639beab

SHA512
07d55e4b31a311bb386283a54c8171b042ea96a29f5b6eda7ca37aa0a17b34f789572216ba85290e80285bce7ffdfa5bd3bbb412d3f72ed1269468f24752130a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a294d02061fab00784373dc416c00b47

SHA1
67ddbfcd6a9f4371cf6c5028cfda953d1542a8a1

SHA256
688fc3a1a9d7c3e14a1a774b828b77d4195a408d2a691f0d1c18bd58d5f835cb

SHA512
06760d98f1b9c664d21afaccc7f116d216473d81b442fdabef091046a6a3fef7ba13ad4eed9cf89f1dc685f3a24c16ce677618bc4b3d41840529d5d99bd86299

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cd6bfc788ca71d662664e15e0a3cfb48

SHA1
d0f0abe9b0c5e8d271214c9a44b0051f28884893

SHA256
216b715cc2206b20df2ff39774d8e29d843a06ba625cb2ce598170a67bd433b5

SHA512
7aca16a1d989c794fe907aeca2838a5b51391fa538856df13e25e6b89b3ee93391d99f15b6a9cfe6af16b9f882d58939deb3a0d8af110c187efc990329fcb42d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
2bbbdb35220e81614659f8e50e6b8a44

SHA1
7729a18e075646fb77eb7319e30d346552a6c9de

SHA256
73f853ad74a9ac44bc4edf5a6499d237c940c905d3d62ea617fbb58d5e92a8dd

SHA512
59c5c7c0fbe53fa34299395db6e671acfc224dee54c7e1e00b1ce3c8e4dfb308bf2d170dfdbdda9ca32b4ad0281cde7bd6ae08ea87544ea5324bcb94a631f899

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4151a6efa51a9577f2f5169d7e944455

SHA1
3169d5959395bcc492ea655fa20716ccdb1ec94a

SHA256
c20c962ffead1af42c6b887f900384986c4d61770164ee622a2376a107f92cff

SHA512
d2aa0f97eaf93454a79843770675b0b5e87acd053e4bd0c1c506462acd298bb28495a4a825975cba1f06b995bd9aab3f5ec93c5111e85bc897706729e97d5223

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9be83ed03ea116b0e624e60b08a7bb21

SHA1
7b7850a15e355471ce14f3fd0afc17ada1fdece8

SHA256
e4af2e339d5d8b7e992f49a4c758401d6ff7bcb72eed31d5ec40ae2d56ef4a52

SHA512
1a2ca34d50cbb3d638431101f152d8a807edb914d67bb3f88eb661352cebae742483f1ad5c5e4a52826051967784bd9743abe25ecab0b71ca7c2a603cbd58f7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
21da94e61fe798c0e054ab0f02c3ddcf

SHA1
eb4f7266e2d6cef4ba809fa2e3239cabf22d5cbc

SHA256
3a447e058bef2a61ac93be60c843f9830c909f7839c1321ac3e70e877efa4d0c

SHA512
a7a99b531ee96c4fc42d32a1ffbf0dd47413c59718982a039e0340670db5d8c3629b1a3fccd687cd430da18de73e01461cc137750bdfab3e038f0d266a8dc783

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6256dbe463621375776013e78461d4b1

SHA1
8f562f907054d913dd78a3c9591a6d8b820b9497

SHA256
6b497375a2f5aad0af49af7049d01350486e4fe189574be42c46bb8c463e2105

SHA512
955b4a00ae6bef86bbda2814e3015f20c1ca34aba06fcee4961b8f2b8a22e7ebe917f5adb3e1c1c28e72b6bbcf765e9d13f87a5f4bf0a3653d3b3d19e48bc74e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588e02.TMP

Filesize
1KB

MD5
d465a84c904968df9ff37d8a18868822

SHA1
f7b1d07ca9e12cb6a8ce933a9cd5b2a9e64949f3

SHA256
5941b2c499379f2da3f831ed9fdc9dc7c4eafa6dcc1d8ce0dc42371f439d9213

SHA512
936f3943d1b91450c860556a331d53b890e25ee6e178145b4336d3ccd4644eba8e65c8b6958f60063446a18f0474c047c2dfeaa3c53fd9574198a97f42653707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c4e88f2fdb576819f39d21320740a9fa

SHA1
3eb7f2acfa310cc24ed5396f36c76e1a5d0f77b6

SHA256
1dc2f867be5b4bb7ab76532aa3f8258433cd52c1ab8c7425bd0a6b48cd0db462

SHA512
93fe995ed2532078f5fb5a0245cd843e3c41abed37504b62b3d18d4e68cbbfa1b5dc2a9b286c3784abaab3bd6ad165c92b9740a73af6021c74b851c19c0942d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b677c5c4fc790faee51f9f3598008117

SHA1
602053c374f7704606288f28823b81ef8954bf53

SHA256
2eba7680d772eac8aababef81cb7de7777f7e4922d1fb3d72c6a743811463633

SHA512
c60dfd3ee2ad695ae4510b26897b9ac1543cb4c91b7f863a38506a8f2a204b805ae44e18912d9a52b8865f727b453647054ddf413e9425d06cd982e1ac13b14f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
25cb655ea946f4f0d24d4b5f88bc8170

SHA1
c0724d037e806176d2bb4fdad68a2bd2a970837e

SHA256
580324a30d92507dc20255af75b534533a3a8073b76ad68d39140afa0f4ba5c0

SHA512
990e6833ce551a80404269968255e40282984d053633fa55ce25f2e292f6f3d516efeb94c8cadc04d9d8226a6d0aed91816ab2d72016f77e2b77d0aa1ea80fda

Download Submit