752e88f0059ebe388e8795ec5f4fdc5f3c7f414f277d3ba1b952f5499b7a5cd1

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9749853c3f9772b7ec689af6ea731bcc30852fe2a2610501f0e397d6d59a008a.pdf
Size

52KB
MD5

b590a9fd49915e51f10ff25ee8952611
SHA1

2ed5611dfbc0d51f3a24d9c23cac29e1987f3856
SHA256

9749853c3f9772b7ec689af6ea731bcc30852fe2a2610501f0e397d6d59a008a
SHA512

18a105555a3a5239f5c29d4fcb9cf77f5da7829055502a251f76aa2373657b165af6f443d9f59417942c6182c855544bd764d98be2f5a112a8687360a584a447
SSDEEP

384:/W/5555555558F67cdOr9wavSN/Bi36livBu5vNMV0:/W/555555555+KhGwQjMV0

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
764	msedge.exe
764	msedge.exe
5028	identity_helper.exe
5028	identity_helper.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4636	AcroRd32.exe
4636	AcroRd32.exe
4636	AcroRd32.exe
4636	AcroRd32.exe
4636	AcroRd32.exe
4636	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 764	4636	AcroRd32.exe	88
PID 4636 wrote to memory of 764	4636	AcroRd32.exe	88
PID 764 wrote to memory of 4276	764	msedge.exe	89
PID 764 wrote to memory of 4276	764	msedge.exe	89
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 1992	764	msedge.exe	90
PID 764 wrote to memory of 3796	764	msedge.exe	91
PID 764 wrote to memory of 3796	764	msedge.exe	91
PID 764 wrote to memory of 1232	764	msedge.exe	92
PID 764 wrote to memory of 1232	764	msedge.exe	92
PID 764 wrote to memory of 1232	764	msedge.exe	92
PID 764 wrote to memory of 1232	764	msedge.exe	92
PID 764 wrote to memory of 1232	764	msedge.exe	92
PID 764 wrote to memory of 1232	764	msedge.exe	92
PID 764 wrote to memory of 1232	764	msedge.exe	92
PID 764 wrote to memory of 1232	764	msedge.exe	92
PID 764 wrote to memory of 1232	764	msedge.exe	92
PID 764 wrote to memory of 1232	764	msedge.exe	92
PID 764 wrote to memory of 1232	764	msedge.exe	92
PID 764 wrote to memory of 1232	764	msedge.exe	92
PID 764 wrote to memory of 1232	764	msedge.exe	92
PID 764 wrote to memory of 1232	764	msedge.exe	92
PID 764 wrote to memory of 1232	764	msedge.exe	92
PID 764 wrote to memory of 1232	764	msedge.exe	92
PID 764 wrote to memory of 1232	764	msedge.exe	92
PID 764 wrote to memory of 1232	764	msedge.exe	92

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\9749853c3f9772b7ec689af6ea731bcc30852fe2a2610501f0e397d6d59a008a.pdf"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gateway.ipfs.io/ipfs/QmTo6dWGHyBM4aLyvBhnPepzjpbzCB8P34agNZ4p3NHbYX#x-ipfs-companion-no-redirect
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffadf9e46f8,0x7ffadf9e4708,0x7ffadf9e4718
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,4100764715267198569,13880062962427681907,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
    3⤵
    PID:1992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,4100764715267198569,13880062962427681907,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,4100764715267198569,13880062962427681907,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
    3⤵
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,4100764715267198569,13880062962427681907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:2684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,4100764715267198569,13880062962427681907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,4100764715267198569,13880062962427681907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
    3⤵
    PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,4100764715267198569,13880062962427681907,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
    3⤵
    PID:3756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,4100764715267198569,13880062962427681907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,4100764715267198569,13880062962427681907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,4100764715267198569,13880062962427681907,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,4100764715267198569,13880062962427681907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:1576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2172,4100764715267198569,13880062962427681907,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5560 /prefetch:8
    3⤵
    PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,4100764715267198569,13880062962427681907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,4100764715267198569,13880062962427681907,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6680 /prefetch:8
    3⤵
    PID:2688
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,4100764715267198569,13880062962427681907,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6680 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2172,4100764715267198569,13880062962427681907,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3676 /prefetch:8
    3⤵
    PID:3952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,4100764715267198569,13880062962427681907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:2788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,4100764715267198569,13880062962427681907,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6304 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
198KB

MD5
cda68ffa26095220a82ae0a7eaea5f57

SHA1
e892d887688790ddd8f0594607b539fc6baa9e40

SHA256
f9db7dd5930be2a5c8b4f545a361d51ed9c38e56bd3957650a3f8dbdf9c547fb

SHA512
84c8b0a4f78d8f3797dedf13e833280e6b968b7aeb2c5479211f1ff0b0ba8d3c12e8ab71a89ed128387818e05e335e8b9280a49f1dc775bd090a6114644aaf62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9d8ddb73779854d80bce5f368e2335fa

SHA1
3df5f824e0237f8e58d03bc6d0b2b38ed065ad8e

SHA256
33df0566e594a1baabcfabda8056762aa2726b23e79c85ff69c18865dfa67091

SHA512
14618ffff47420c35d46a8dfc61a9a8dca501001d92b0d3a9675ffb98cfbfc2de1f79db98997e9a24927b62cc957a75784077b4d97014659672ff55298348fbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2ec140779ec4b18e0c5fe73d1fc61ce5

SHA1
04a182e3fa261bad6e13089f2e01ebd940ed8ed1

SHA256
90729eab73fa8b95e29b8b72967e56c901b4464964281a32446e56b68c28b316

SHA512
baa991b73934760a070238054f65b30a7d8cf47854c57e9056589a78ca252d0f63c7c561b534d5105fa9b7b5fbd47dd57bb9fdf8ce535b2097559fdf921b14bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4946d041c545fb904b8fcef2307356aa

SHA1
c30f224e01a27b25d04f56b7e197202172dd5347

SHA256
acda6e89ec47e2f4a0dbef5aca40110c5ac8ad7115fdb9b4e7751d5095c5c4e6

SHA512
3c4912ac280be58197620f76a66dd86e6b3a918a4a216010ba9dad21a86ee3ebb373c7812683b7a31663fae3b3c357c3abe667ee94c8f626bedfd2d94e063921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
391363031e730bbbc1fd32760bffaac4

SHA1
25505b08f4c0e88bc494792a71c59f218f60067a

SHA256
c891d7d594cfc5e77549e41a0b8cdd1c01161b916eb90c6d662cc9e8274f15d1

SHA512
eda86891a98e7592a45a725a828cdf6a22c7a44cd1f20a538391a791277e89681ff1bbf1669c260dfbe33e1fc86c89d42b533834dbe953dc7fb08ab398a2ec97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f67573b28964b994e75434e4c7368a79

SHA1
8eb68aaee1a7bec1b894c1da6336cf73413737d6

SHA256
3081da0bfa5e0f18657e8fffd17059f9b00cdd21cf58c4b1fc5ef2cecd7da97d

SHA512
0e93e9b0b328832f9450653585a9ec49cd252aa05a24dba0746ed2705dca4032cac422be1857de5f40d5efc4d4e6a1a6754e523b350b21f652df577308a5b93d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c530c5280a5270510fcb3678596021d8

SHA1
2974c8afecf8ecadfcaf6d06e48dd6dc1d337065

SHA256
0cf611c5882f9be3037dc23d773efc81d1a5a9c6a4e7f4c615052cddc6d2b80d

SHA512
36d72212bf7b96d6cc5af968ec6e4fabeceddade44c980d024a292cc9868c4ef73abd4a6507fd3a2f7c57eab03ac0621c76767cd77420dde0106466aa7f25c28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7b0f85ad99eb0436c5e4aa0fd65f3d45

SHA1
ef54634f2b1d9c3606f411be1206f0960eafc0a0

SHA256
6adaf65f3f81c8ec122e37d01f253459b23f5f825ee2539c8f4a307885d75951

SHA512
5f9db0ec895b094c9eea5c1e7aab98fd518a33edfc713289bfd7ec5d5c3cafd508c13d293786e0024c1cc38253f47cf65b4799cce0b7cdd36a1cb1a6bdf7ed9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580ccc.TMP

Filesize
872B

MD5
7c5b78e6b41404fd4117dee7533cd16c

SHA1
251583881d5cbae3fd9a0a6d4e1eacdbe46692a5

SHA256
07bce7103943ca7f5cb7203650430992289ee0d4a9f4f60d6aaeaede5ac552f0

SHA512
86dd939bf70f2efdabfbd6e54f58ac98f1c95aa80a6433d641ad2d08536dd8640dd7cad88fb7ef3060bcb2eb43aace2f104552e2c12b344439f1afcc49bcc480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3f82187787d2f6423e680a1d7b140eaf

SHA1
3a4588a4417c2e17f086ce2d5200f62a4eb94504

SHA256
9f3e7d0ace9c31a149b95692a458178189364aac534aec074d3827fdef40d58a

SHA512
329ba9915f227c53f2c3f70e00f789dda8c8d093358a8ac3870291e6813f3bb83895ed35878529e7f61327050387fa62bbd778f25806451a7cbdb10bd01568f4

Download Submit