hxxps://apk[.]support/download-app/com[.]soteica[.]pmtoken

Analysis

max time kernel
1134s
max time network
1139s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://apk.support/download-app/com.soteica.pmtoken

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
1924	msedge.exe
1924	msedge.exe
4892	identity_helper.exe
4892	identity_helper.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 3736	1924	msedge.exe	83
PID 1924 wrote to memory of 3736	1924	msedge.exe	83
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2636	1924	msedge.exe	84
PID 1924 wrote to memory of 2404	1924	msedge.exe	85
PID 1924 wrote to memory of 2404	1924	msedge.exe	85
PID 1924 wrote to memory of 4340	1924	msedge.exe	86
PID 1924 wrote to memory of 4340	1924	msedge.exe	86
PID 1924 wrote to memory of 4340	1924	msedge.exe	86
PID 1924 wrote to memory of 4340	1924	msedge.exe	86
PID 1924 wrote to memory of 4340	1924	msedge.exe	86
PID 1924 wrote to memory of 4340	1924	msedge.exe	86
PID 1924 wrote to memory of 4340	1924	msedge.exe	86
PID 1924 wrote to memory of 4340	1924	msedge.exe	86
PID 1924 wrote to memory of 4340	1924	msedge.exe	86
PID 1924 wrote to memory of 4340	1924	msedge.exe	86
PID 1924 wrote to memory of 4340	1924	msedge.exe	86
PID 1924 wrote to memory of 4340	1924	msedge.exe	86
PID 1924 wrote to memory of 4340	1924	msedge.exe	86
PID 1924 wrote to memory of 4340	1924	msedge.exe	86
PID 1924 wrote to memory of 4340	1924	msedge.exe	86
PID 1924 wrote to memory of 4340	1924	msedge.exe	86
PID 1924 wrote to memory of 4340	1924	msedge.exe	86
PID 1924 wrote to memory of 4340	1924	msedge.exe	86
PID 1924 wrote to memory of 4340	1924	msedge.exe	86
PID 1924 wrote to memory of 4340	1924	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apk.support/download-app/com.soteica.pmtoken
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa429a46f8,0x7ffa429a4708,0x7ffa429a4718
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,17998722120248521709,1841011699967412404,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,17998722120248521709,1841011699967412404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,17998722120248521709,1841011699967412404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17998722120248521709,1841011699967412404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17998722120248521709,1841011699967412404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17998722120248521709,1841011699967412404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17998722120248521709,1841011699967412404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17998722120248521709,1841011699967412404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17998722120248521709,1841011699967412404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17998722120248521709,1841011699967412404,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,17998722120248521709,1841011699967412404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,17998722120248521709,1841011699967412404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17998722120248521709,1841011699967412404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17998722120248521709,1841011699967412404,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17998722120248521709,1841011699967412404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17998722120248521709,1841011699967412404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17998722120248521709,1841011699967412404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,17998722120248521709,1841011699967412404,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5328 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6576d39e3728d68c72a85bf4c00bd73e

SHA1
fc11dccff2d46779b185047e86750eff3c5e42ca

SHA256
28a022d28bb18fe9a3b6fd306b589110f6ff2a65a4de2372aa254254bfce0495

SHA512
a90ba63521a15dc8fca3eb6a24963f6f6d19950a2eba7a154a6090fa186f0dfd220450e3b3d4cd27300e9858ec5f7d7f86011b19b7d138334d75581d747e0b69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e59b9fa48f2cc0da9d8b0f64948602cf

SHA1
a709d15e654fd3b89d0bd48e8d05795f9c95c953

SHA256
2f97470857175642055ef4664c0992004717d5b1453a286db3f0053de8af1826

SHA512
75ad985b2dc838b995b19cd26c6cb20d8deb51d12f85089158c5d2679a277cc0b22605795009eed1e8c95ca0a5cdb76a8bd10556d51e2ec546a6f2a04bdff62e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
198KB

MD5
319e0c36436ee0bf24476acbcc83565c

SHA1
fb2658d5791fe5b37424119557ab8cee30acdc54

SHA256
f6562ea52e056b979d6f52932ae57b7afb04486b10b0ebde22c5b51f502c69d1

SHA512
ad902b9a010cf99bdedba405cad0387890a9ff90a9c91f6a3220cdceec1b08ecb97a326aef01b28d8d0aacb5f2a16f02f673e196bdb69fc68b3f636139059902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
06702b4e1bada67d9f355338ae7587c1

SHA1
d0b32940fc0a7d6a97163cd36665c86a5e5cf7eb

SHA256
9e792da4dfd0482d59db7bdd9442e2817476ce1c6be6bec366bfdce49212ab40

SHA512
ffb57c3a9a2b546dac5bce8ebd2b2083dfd342c9f54f9b2f7e69f9091eee609644128cf4e1d1c03bba045cea847a0cc0f4e7195050420ac6a2572a10281e5ff6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
63e7deadd20f2acdf69b39092ce84647

SHA1
0628ebcb0a62839b72b216075af80a2f839135cf

SHA256
faedc4302d1d5726c4eba9b7dda5b855222fe4b3663d6ffe5a76a0254fcdf7ed

SHA512
ba789274fac901cae2abf324122b53e58afc277168c533862f3afe0ac31501a85e0a25c408757868c1a60adaf99cda1cb4c23aee3c4260f2865994aab3b02cb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
24ed65b259f3408795542a14b7c1e63a

SHA1
1fd106401e25e576b117a22f47f9ba81158ed4ed

SHA256
74099e4ccf9451c962421fd144c854f0ace8076466e440e77ee36ed917b105e9

SHA512
b3f106c000dc0a1e5945aba6ca236c8688c5457e91a2b597abfe4b38c2e7ac6e63c461465644e7d76ed1054e210851a1708c83aa38343326d789ba8ba54324e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
73904ba33d9d4fbd2810cdfb73b1204c

SHA1
384ac68bbd0968b9a050005f5c23894e1cb353f3

SHA256
19427d5da0bcfe5f65eb076b988b01873d174bc031640853be9e95c959c3618b

SHA512
766191d931685589086cf88d2152227d1ea1c5357a77ab5deca456c0c0501e2ad955f2038c5921404cc9d742d031400c2b8890116732eec27e42f24cc550315f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
db014b75522cf5b789ce050c338bfc1f

SHA1
f1fb52a2e37a699a2039c019053ae78310ab3526

SHA256
faee37b2b1f68815b441911d3974897455480f03e8a955a23cddaa0b6ef1dcf4

SHA512
1ef403910bba65cf3f594e3a6b9428884548f710e95f133a7aecd6544bc05e6e63501b62e308764ba9108bb5b1dab7ba3d0bfa3d6ed5558fd547a35eb8dd6642

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7a55bbf709c0632fb9a02d6f8a092780

SHA1
9df3f74c8533c89f224b5392abf99de0acc1c299

SHA256
f72913024f35a91218183d74cf8297314a4ecdbae5937c2d7a806e5e648f64b4

SHA512
26904e46883093bb3b2a87f6d50c763c370c58c91f9baebb1c69c19b1bc02a18cf117667f2b381e86dbc9a68a748af548356d9491775ecc9240c68588fdbacb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eb098337347b7922de217db9dc88bdc4

SHA1
c5f3c3d312984a9e5e6b862cc7fb0fa24d894c7c

SHA256
47a006c4a5d988db862a26c1e62afbc998c0c403137735bbccec42909030e9b0

SHA512
94b3a3b792e64202364cddb981da69819a92e6758caad57ea4f4752c7c6bc67e13241680ea2049803dcc0a3187c35013b7ac200c173abf14e15c354c37de5c6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7180f7c01fbcce521c40790633a95d9c

SHA1
59db2c481137f77a1220fea1513f4ef4e7697682

SHA256
002e1b98a9e42045ffe67a920600df4f063c9f079a4b8a2ea8ddf9e67f543e6e

SHA512
33340ef3ba403aad8ef5d573f4d24353c5f70f6d98ac446380b0d7db20af91e33f515666e034c06c4b545e3a3fe3a0ca3c6a494dea32c0291968755cdb322eb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
125379607e39b130b8665286a7831a53

SHA1
7e150005c46cd94add417c3ba18d8a4566db037f

SHA256
db4707f324a15169ab9a604f8d0b995c41e4a0326d85ff7a66ee9be48b908e6f

SHA512
4a5b52ff99c27f36edb0f930d782447854da1fee052f94eb143177e694df97590153a76f11e4dee6cc7cf3cf7bd380cea80457a064cd6c70f8b4efa35163fe64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
da4074b927e4a623d424addf403f5ce6

SHA1
32f50254381b374785cb12d009f964c4a0a5424e

SHA256
273c288bf605e6d8085d9d8292ede317e19150173bd7cee558242db28d4c47ed

SHA512
49186d072881df7d9290a8f41bfd6af40c0a974a8e0fa9cd704156217206283890254e418ab680f9682e7641cf58681c4eecd51e15a7f9b747df1f2007694de1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
368B

MD5
f29058414bacdbb6257351a31f6f80a8

SHA1
fca71eaf2d43e8166c4a208f1cb9c617beec4733

SHA256
637b7b5e7df7244fa8842bf1c5f4cfd158fa518236cb0257f3fe5f69e9a78e05

SHA512
aa8b63c06aadcbc0c17a7336cb6bca5275133b45181960050ea7985059312fadc7c07de20242a278f2f003a6f4923e2ca202e309feed9468898ccf8d61475a9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
368B

MD5
8da52f9e3c52f9e22341740bd8f53a1a

SHA1
739af53926df442041947f80df94495992a971ee

SHA256
f1f86b1b2a9bbf5cdc350cf3a389b17c3056f324a68ea367ca4504793a724df3

SHA512
6509a70d03b9cdefb9922eb990e737ae32f5df7e680c03a5c67f6d7d478e98f021602ab51b2aaaa0fafaba5f64156d76816958d065336ae90c5d5b44cdb19c34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582ca9.TMP

Filesize
203B

MD5
74b8bc0555d0f3e7929f7d6f740f251a

SHA1
c714c8e758b5447b2fc57964315f6ea8fa839fe1

SHA256
b5c58f1c2c1c97895eec2fbc4851fc56d25c24c13d291c21c5dd7a7596cdf2cb

SHA512
d922edf304c7828d5a77e5b15b91535d20ebade19075fdc26ca9435358d5fd92ad1afecb1f41cb34dcd665bdbb818d8ad40924ac12a77b32cdd0a3780c9d8fc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
67eda080066e758c33295264d1263340

SHA1
ecc59493a54767848e8d21c59daba4273c330ceb

SHA256
c665edc9337f92425518bcf9f37acfb047ad5fd3a7a712967f6a7f97b9d225d4

SHA512
feadd1720e0528b304d6a6af67ac0e531ed4cfeb03b106f3896822ae9e51a0933740e6ad95ee916d21b8bec7accd3d8dc201f2b40c35b56f6eb9937c4ff094b1

Download Submit