55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43.exe
Size

6.3MB
MD5

c981672af16f890e6ff080b71905a940
SHA1

089e55ea97390b3da6a8853aa7bff471598da66b
SHA256

55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43
SHA512

a2ead9c260d1721cd9d696c66159ba7cd54233637715adde1a9825a776d6c5367e6d3d0669b292d81568fd1616dfdb4d337cc5df733272e612bac1fe1e1a62ca
SSDEEP

98304:2/oz/g3xbrKsTS343sWk1bYcNFC+VU1JtknAx3JhBz10TkiXbmoXGg+UgCC46PyG:2/e25/cjCtkiloTW7UhCtn7JjFewv

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43.exe

Executes dropped EXE 1 IoCs

pid	Process
1220	FoQa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5660	msedge.exe
5660	msedge.exe
4844	msedge.exe
4844	msedge.exe
3464	identity_helper.exe
3464	identity_helper.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 1220	2428	55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43.exe	82
PID 2428 wrote to memory of 1220	2428	55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43.exe	82
PID 2428 wrote to memory of 1220	2428	55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43.exe	82
PID 1220 wrote to memory of 4844	1220	FoQa.exe	95
PID 1220 wrote to memory of 4844	1220	FoQa.exe	95
PID 4844 wrote to memory of 4904	4844	msedge.exe	96
PID 4844 wrote to memory of 4904	4844	msedge.exe	96
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 2376	4844	msedge.exe	97
PID 4844 wrote to memory of 5660	4844	msedge.exe	98
PID 4844 wrote to memory of 5660	4844	msedge.exe	98
PID 4844 wrote to memory of 2948	4844	msedge.exe	99
PID 4844 wrote to memory of 2948	4844	msedge.exe	99
PID 4844 wrote to memory of 2948	4844	msedge.exe	99
PID 4844 wrote to memory of 2948	4844	msedge.exe	99
PID 4844 wrote to memory of 2948	4844	msedge.exe	99
PID 4844 wrote to memory of 2948	4844	msedge.exe	99
PID 4844 wrote to memory of 2948	4844	msedge.exe	99
PID 4844 wrote to memory of 2948	4844	msedge.exe	99
PID 4844 wrote to memory of 2948	4844	msedge.exe	99
PID 4844 wrote to memory of 2948	4844	msedge.exe	99
PID 4844 wrote to memory of 2948	4844	msedge.exe	99
PID 4844 wrote to memory of 2948	4844	msedge.exe	99
PID 4844 wrote to memory of 2948	4844	msedge.exe	99
PID 4844 wrote to memory of 2948	4844	msedge.exe	99
PID 4844 wrote to memory of 2948	4844	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43.exe
"C:\Users\Admin\AppData\Local\Temp\55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\FoQa.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\FoQa.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=6.0.10&gui=true
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad3c946f8,0x7ffad3c94708,0x7ffad3c94718
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,6266697286819897783,15880867846942021692,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,6266697286819897783,15880867846942021692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,6266697286819897783,15880867846942021692,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
      4⤵
      PID:2948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,6266697286819897783,15880867846942021692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,6266697286819897783,15880867846942021692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,6266697286819897783,15880867846942021692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
      4⤵
      PID:1644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2020,6266697286819897783,15880867846942021692,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5240 /prefetch:8
      4⤵
      PID:3960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,6266697286819897783,15880867846942021692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2020,6266697286819897783,15880867846942021692,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5704 /prefetch:8
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,6266697286819897783,15880867846942021692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,6266697286819897783,15880867846942021692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,6266697286819897783,15880867846942021692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
      4⤵
      PID:3852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,6266697286819897783,15880867846942021692,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,6266697286819897783,15880867846942021692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
      4⤵
      PID:1420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,6266697286819897783,15880867846942021692,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,6266697286819897783,15880867846942021692,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5252 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
d1d83eb9968afecb2488e1f53c476a01

SHA1
65904d77799db619678820848f88a8f2805337a7

SHA256
52b0f08e20af89a2c7b9b41d8d145645d5d845ba9fa6d3078a5728a34ddaa037

SHA512
539e3d3df911f5d7d2df78a0a06cfda8962e4f92468f6fd653f5f8d2ee932043911ea9705b29277589339b6a64d57b5ec5adf015a10419607f3b52e755dcffea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1002B

MD5
a77696fb23a1ac8683749e7adc9f14cb

SHA1
02557eaaed9e88c67e717167d6407e4748578e44

SHA256
6386e07931845af4d1fc6ffd731c2c6d6febee95823ffc847fb58cb21e2a9fe6

SHA512
227aeb00c323cd3d174b86938d0e23db38c20efa7b1cecc965d764647a350b79bbafcc4a8aac610527b8bc540fc2f45d4711df244ff96cfd8fca0c0b30080575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a096f03df43135d7fc747442c209b31a

SHA1
877cdfd6b62db9e65f16cf9567b9b2d376ddfc5c

SHA256
c9617f69616d5f12b3083ec4c576fcc0338fd261a161915f3e88625a5bb98e62

SHA512
4453c1d53d534c6efe9017680f5ddcd9e532e5832b3b8c72bd475dfb140df20c1195b750eb5b5486dd6dc1bf36576d67ec51541e621ef484ed471a03f2f01ac4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
de59646c8f7b153c4566b51abedb871a

SHA1
767041d1e8cb8f72195d4ab81004cc6551bcb8f5

SHA256
64be6c5306edb507d888ff9cc3b5ecc230a2e710e2b7b8e6b5560b8b48358057

SHA512
bd5c8460217bb27331f1d353ced7535c73f248e1f2c811c30684d6503cc56271e101b376870db2a45dc1254433281c9cf2cddd7d333799f9b6133fce795f330b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
88c7d83c476169c51f54dea5eb78fac8

SHA1
7da2188a038074ec929c5970db13e2249ee648c8

SHA256
69ea620aec5aae5a244e42c79691565764ae4aef59e1fca2d86e3318192f6669

SHA512
a5a16044c9f1317c9c4170cdf222225076e75b492531edc72bf23214edbb9cbb804b0e015247953f345d2065ba9f9d35c0e932e8a8cfd4adbfbd5e8aa05b2487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
47eb74b38265e85102521f5578205cdd

SHA1
3a6beffbdc8453297e637111233263855b49b2e2

SHA256
3372a96f9e46a752152ebc2c3a8c535d0db8b9c98e04f53fda0193184c263287

SHA512
b1901b23e0d035eea1280038de7da6b6d5f6d90d4691753c23b278800f6b4f1e59df1617ca5d761ecc0982c4cc7a7a444493b9f6fe08df41e62b180de892ad61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
7bf056f44ae4a50dc72d33110de447cf

SHA1
917d0fcbe44898ccecb12ea7e949bacf21c82642

SHA256
d212ae6af3dcf286a4878794cba3c3dac4c76e53004fb82fd34c509c95a07ea9

SHA512
1a6c31df0fc88ba6840bd1f29abcd8e029d3ea652bbd134f0463efe361ff0424ee6f01de10a790ee4a333680de251683622b460040d9d1f3d731853a2b00e82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a6ee.TMP

Filesize
537B

MD5
0a1e773801744e8a6990fa2d60406fac

SHA1
1c5f4f8876a41b2a0ff14a6b4a46f896db715ac3

SHA256
035740baab3d2ece51967e000ee821f797a6dff8bc7781352ff6f87778182359

SHA512
25ba75387acf199619984dfdded08258309b94b691263068644bed8f1ede6f6515c1f577490de23b6de4b44addf2d969f918eea8f40eeb383e88822353320934

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7efc01d90e12b2597e1e458806e25506

SHA1
73bd6cfdecfb75e22180067fbf8d974d2fcaf222

SHA256
3165ced711500493c7ab799797605fa7478615c0e918db0e95fd6eae5caab94d

SHA512
1ba6b3ee269a36cfea07e283031b595a210d930127b84dc224d0f08e9abd419901233bd2658e29bb56d1c7c839e4fcd4fdcc3f2bb8a04a3d1925540b5be03bbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\FoQa.exe

Filesize
178KB

MD5
1bc97d36bfb5b3af6deef85448454605

SHA1
8f0902f8afbc37a11b4f36d43011119ef1d973bd

SHA256
f02a49b4c374303b75e4dda5b89a13e3221a214791bc3b96a7dd766b306cd2f5

SHA512
e04b623a254051191cee6f1451693168c3200cb32491a71abb82d514af4fb86485ab4c549dd2555e141797c721eaa02cd984df67f6c7f0de3481f4af77b0d02d

Download Submit