7947ce427da5fb9120688f68d391f64a393cfb56b77ab15f585bd3fe43273782

Analysis

max time kernel
154s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
17/02/2024, 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nezur.exe
Size

26.5MB
MD5

9368fd67654ec71b2d52dd0d8fa31bdc
SHA1

5550c19ead9a17988d30247b646be69b776cb693
SHA256

bc07898a6136045b88ae61abdf5cb081a4b7ad792c555afce1c42b3ce43cdf0a
SHA512

e6f06371262b4de8ec57800c2a06492f1e977b7a05bb34258fc1d27ab11cb089776fcca6bffdc64a407c222a5b998d5a36aedc829342baf50707600912268ae6
SSDEEP

196608:dOM8Wb0guhegb56w6Vr8utDq+S0KW1Hs3VaTnJ45/9iD54+V11bFv4ztbK+nmtzw:dOM8heg+YB+S0KW1HlTqzQw

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
3488	msedge.exe
3488	msedge.exe
1032	identity_helper.exe
1032	identity_helper.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 764	2584	Nezur.exe	83
PID 2584 wrote to memory of 764	2584	Nezur.exe	83
PID 764 wrote to memory of 2208	764	msedge.exe	84
PID 764 wrote to memory of 2208	764	msedge.exe	84
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 1716	764	msedge.exe	86
PID 764 wrote to memory of 3488	764	msedge.exe	85
PID 764 wrote to memory of 3488	764	msedge.exe	85
PID 764 wrote to memory of 2076	764	msedge.exe	87
PID 764 wrote to memory of 2076	764	msedge.exe	87
PID 764 wrote to memory of 2076	764	msedge.exe	87
PID 764 wrote to memory of 2076	764	msedge.exe	87
PID 764 wrote to memory of 2076	764	msedge.exe	87
PID 764 wrote to memory of 2076	764	msedge.exe	87
PID 764 wrote to memory of 2076	764	msedge.exe	87
PID 764 wrote to memory of 2076	764	msedge.exe	87
PID 764 wrote to memory of 2076	764	msedge.exe	87
PID 764 wrote to memory of 2076	764	msedge.exe	87
PID 764 wrote to memory of 2076	764	msedge.exe	87
PID 764 wrote to memory of 2076	764	msedge.exe	87
PID 764 wrote to memory of 2076	764	msedge.exe	87
PID 764 wrote to memory of 2076	764	msedge.exe	87
PID 764 wrote to memory of 2076	764	msedge.exe	87
PID 764 wrote to memory of 2076	764	msedge.exe	87
PID 764 wrote to memory of 2076	764	msedge.exe	87
PID 764 wrote to memory of 2076	764	msedge.exe	87

C:\Users\Admin\AppData\Local\Temp\Nezur.exe
"C:\Users\Admin\AppData\Local\Temp\Nezur.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=7.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9c69346f8,0x7ff9c6934708,0x7ff9c6934718
    3⤵
    PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,9006472018537864818,7667985873212175751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,9006472018537864818,7667985873212175751,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,9006472018537864818,7667985873212175751,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
    3⤵
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9006472018537864818,7667985873212175751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9006472018537864818,7667985873212175751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9006472018537864818,7667985873212175751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
    3⤵
    PID:2592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9006472018537864818,7667985873212175751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,9006472018537864818,7667985873212175751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
    3⤵
    PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,9006472018537864818,7667985873212175751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9006472018537864818,7667985873212175751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
    3⤵
    PID:3916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9006472018537864818,7667985873212175751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9006472018537864818,7667985873212175751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
    3⤵
    PID:968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9006472018537864818,7667985873212175751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
    3⤵
    PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9006472018537864818,7667985873212175751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,9006472018537864818,7667985873212175751,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5092 /prefetch:8
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2152,9006472018537864818,7667985873212175751,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6312 /prefetch:8
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,9006472018537864818,7667985873212175751,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6684 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
1d810500ef45f76d8bc916377edd76f5

SHA1
dff06431acce8d215818b7d7de0d6abf970d2227

SHA256
3bb36b87c9593e57b3d72ac17fa45105b0444ca38e23851fe1a1e0b3547ba33e

SHA512
c319ba2c9297d4cd5b9d1d02836bf8ded56a8ace31d032388cdf688348f6b5378228b6c00d0f95a761edc5df64d37a8d3fd73895ebca72d64f8ea0184d9cb707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1002B

MD5
4283508eb9ae3ee26199b38127e7ce5f

SHA1
b891ecc72c100fa9938b235ae4e965dc73ab15cd

SHA256
33eaff82c6165820e88f3e513611c0148c62a3cf7441a1453b41b44b2990d57c

SHA512
7b5fb4eceed14dd2c9df84bf93da37bd8ff1856b3f6a9d5cb2bfe8521aad75c5c8b09bf0d49c4eaac1c08f7649973030cfcad08863fa059eb9d390d75681f2a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
201105d021b18eeaabb7fa90c5207920

SHA1
8df853c18f8ef048d8f5ac224285f8d77761a5ae

SHA256
89e09e78ef9c1f89f1b2689fb77ff805f52bcba9b48050ed311b730346a93d21

SHA512
7d378d219056ab32d4b58bbd578926b86b21e0ae04c25d651c3268d986cc4a632b621634e9a4711c38ddec23a1995747f35de73c2a94b2f5ea8b2c7ae686a8b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1369f0b245cb16b040cf9a4838b89442

SHA1
4f0ed5a43b7baa5d0c046f02797e23f03baad839

SHA256
7bb56aad1a499f7950e2906050594cd5db1509430ae4991bccc7c12056503efd

SHA512
757208d8e3f0740e6c4d44fdeec5f7367ba2b1c779f7687d9d7a6eedec6d1f116ce9a63c992854a620210f575f678d29dbed5799643c84981044b0f032f466f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c68b8287da68baf5ca303f225347fb79

SHA1
0e022907204600f3e1b9e56a469f65b73bf6205e

SHA256
95f31d5440a407df0309f5773ff3b1b2e1d82b091be07244490953e18e27ad4f

SHA512
c644fb764b713d0bbd9c8f869e6e8d27a4986f56483d7e8a834d1ed6cbccaa74710fc828df805dc59bc53cba73325e153c76ae7a40ecd086b303957356240074

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
827597dd2eafd9b98d2354c642051c14

SHA1
d0e78a418920b94b7e78fa8ea319a24131ea23df

SHA256
a422a31487476e6b4e39a38212a6346d00ed9bff6a183605fcd4928dfe49acf6

SHA512
f504d51921969896bba06bc04ba76020f810496b340e86cf4030f9edebf3272f0b1eb525b1d10ade554f10d7a8c875ab33497b0e01ca14d80293d482d9daefab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
9b4c518c5f60b6fc144f63306c1a8ff5

SHA1
c026a8ffa7cd089f023ef82e20e9b386c6661ee7

SHA256
a40340eee83b80030603c73cff1a9385e5d6c75e604f362400b0bd5f319f9b24

SHA512
74f028364ab2fec1adf02c20b59e236316ca0082ea020e1f4839d118028dbfcad238c51a9c247429b36b8b8daa3acfbec900e98e38a31bc87db8eb5e7d586cd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
88c087b9c0dc348cb69378016f20937b

SHA1
da002857217db3253868bf73bedaaf8b564ca628

SHA256
e882a82b42a792d203e10837fbfa4e9ca3138b3fb0ee07d76ee58b789781535b

SHA512
6c6cdbf730bccb4ca0f975e95a7dae26fb731b7253bda2cf11c8350aa5ab0e8cfb81299213834b0983a6b70d9a7832acea602f32d2118ed16e18b5a0abac4be2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a071.TMP

Filesize
539B

MD5
4de2185ee30b2430400459bcdc919e8e

SHA1
86d06d9434a56ba7dab16eacbc593ca3cce01345

SHA256
1a0408e5f60dbe56484c6bd7e80382cbbd3e80f51be6b7d8dbdbf06bd6089926

SHA512
0e23c99a967a822d80dbb24afbd9b7d63da9ac28723558c8de8e7ed3f1c967759622bc600f17cc5441ba52fcf5376e4c2bb0834c32fb3a1ba2d254af687c2cb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
550c18ff1e527ec0411ae5473f5efb77

SHA1
460876f6b790665afaebf86c618ebf41cab133bc

SHA256
f0f9ca645a1b17bd1dad1c8015420ac21145997439389db45d411574be2df928

SHA512
058227e236420bc01175a8ead1fa553afdbce27f580355fa656336a3d88a2d1636b0acda97fe6673ef0e996f11e2319e71e4ca341327ebd954524f1f491e41a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dc48a1e1f9fc28c1440057610f431606

SHA1
d3b33117297c7766fbf26fe41583ffbd73ac6c03

SHA256
05f70ce21fb607d49c351b2059eb7a38634dba0d99e3c3d018a868f8d5fcdd98

SHA512
ddecb1c5d863eb14a9f5a46167a6d7784d38d7e0abf75e037725c8a91388ac6e11065f7ce3f128c7d7e79fd438296039371efd732a179cc93fc43f126abcff6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
618061b0a5c26754acdeb565df1b57bc

SHA1
545ecbbb1f4ac8a320eddbb6d41b2715c524a973

SHA256
d3804b973f3ebd43a05c89af52274195b468dbdca0ea447efb8735455e098555

SHA512
310f49a518c67076b296ed4ebaa7662034b62abd3294d774d9ec61d23f3ed93809264de23b196e938ec21ffae87706687e49417204a605a335b73efd6905b00d

Download Submit