00bf085cdab5aad50999ea9ece26badbb8c079cb9e3cd3b5a4d08f94fdbaa6b1

Analysis

max time kernel
141s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00bf085cdab5aad50999ea9ece26badbb8c079cb9e3cd3b5a4d08f94fdbaa6b1.exe
Size

38.6MB
MD5

86d53411abc2b650a08715b57c62701e
SHA1

f8ca452d41df2455409f0503b268c936210ffea8
SHA256

00bf085cdab5aad50999ea9ece26badbb8c079cb9e3cd3b5a4d08f94fdbaa6b1
SHA512

4fa6f176d1423f34a7bf5fe249aa61082396fd3804a8bd87e7214e0a4331a39abf6a444dd1528e4546e6ce713cbf6a2e39e73922e0afd69543cdcd55fbfe6d75
SSDEEP

786432:aan6iTfRwFOUPofAl2jtyfJscDxvVUyaPZC:Tf2VP9l20fScD1AC

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 353040.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
4252	msedge.exe
4252	msedge.exe
212	identity_helper.exe
212	identity_helper.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 4252	3968	00bf085cdab5aad50999ea9ece26badbb8c079cb9e3cd3b5a4d08f94fdbaa6b1.exe	91
PID 3968 wrote to memory of 4252	3968	00bf085cdab5aad50999ea9ece26badbb8c079cb9e3cd3b5a4d08f94fdbaa6b1.exe	91
PID 4252 wrote to memory of 4680	4252	msedge.exe	92
PID 4252 wrote to memory of 4680	4252	msedge.exe	92
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3448	4252	msedge.exe	94
PID 4252 wrote to memory of 3448	4252	msedge.exe	94
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\00bf085cdab5aad50999ea9ece26badbb8c079cb9e3cd3b5a4d08f94fdbaa6b1.exe
"C:\Users\Admin\AppData\Local\Temp\00bf085cdab5aad50999ea9ece26badbb8c079cb9e3cd3b5a4d08f94fdbaa6b1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=7.0.10&gui=true
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5bc746f8,0x7ffd5bc74708,0x7ffd5bc74718
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
    3⤵
    PID:452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
    3⤵
    PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5020 /prefetch:8
    3⤵
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
    3⤵
    PID:1236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5760 /prefetch:8
    3⤵
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
    3⤵
    PID:1940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
    3⤵
    PID:64
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4780 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
f34b4f500e705db5787d164fe4529333

SHA1
42bfdc5d16a6ae39d11db431053b6a23672c7b82

SHA256
2b08cd637d02ccbcfed5c2cb396aa347d88ac09dbc5733f513f715f200cfabdb

SHA512
36cdc660879a103deaaf473fb7013372f665682ae0df88b37599fb94c1f86262681c29c57be7085279637c505e161bb156a405fcd266a915052b4db3fb67573a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1002B

MD5
91ff0f42739d322233fa3f237d7b7e59

SHA1
72ba1d3912374a3470874cd737f4cd1a644d4c35

SHA256
9913a4cc7b47247baf3c677153971d6e2b59d40a0887a570e4b4ee3d583024c4

SHA512
cfe22511ad0ae58a35810aa2e5a288e7a7e9f9077a12446b373c1de03610f457e4c7c1a739957eccf5aee631e92e7bee848144c2033be30f3442c00c4bd7b11f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
663adc00a10fcca529a3938ae659fe06

SHA1
f9bea8d22c878d0f0d54e5b18b1905c1464da62a

SHA256
0f80dc7cfa89c82f095b0cb1a0fd12d91007139d1be28def01439e24d433e66e

SHA512
d7c59b7916eaf91895dad14e8f2cb323927748173054311dfee7509e974e0ad4c77caf644c5aefcf0f8fbac91f45fd2a95b15dc8f90ddf2723d850116f5e95a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e8a1f346f8159d935fa464113113f61b

SHA1
e143c68b24a45581136a6b2b0cc285e3657a6fc4

SHA256
6fb8947582756ef270696053d5c707fa3573dbeae0a4580c7afc86ed1bb74034

SHA512
4b06ca414e2a486a371bcd78d619261b6394d0f763b32250231f8bbf91fca62e95dadf15fa1e89ae0fbfd9a8f9f518de6746d1b662ef4ed32dc85e668b14ad27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
110bb926fe7caa329cd3d155d390d9b8

SHA1
0f571a85cb49650e6961e42f2c6fb59b916f782d

SHA256
f2781e82a719f475c3010591964a3c09d8fe5cdc555dc3c7366195f7dbfc4c45

SHA512
c6a53965507298fab2276b6494ebd318b4c7d234e8f2aae75f5ca0b5c81d5b2b749c51de8391fa040d36de7188386b0d9ee5db4e2db3b53c50255aa6ab222ee2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
555212df495d3fe253066107c6f696c0

SHA1
3e3070092da33ab789d2a6cb882c906bffadc75d

SHA256
8689673fe7301266bfe069be0de9b3598c6b7be27629a661f3fafb09b8e587b5

SHA512
d1e90d0849c0a6536f4842df199a507c28edcaf914b3a7ef4ac6edccc26808c2a5de4f916640026453c3a3bbf361813ee652285b89372e826d13c93ec6e3f5c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58abac.TMP

Filesize
537B

MD5
55036fec5ae4f1d64ed92b95067b82ab

SHA1
9422d72eca256d8d4f953ce1b46c808b8781d3ac

SHA256
3f7cec26f0fb966432fb81fc78ca79436b601964e536af0a97eacef863487a1c

SHA512
88354663d88dcd4568cfdd3f211e4c43a5f32c1dd0dbc3f72f47d17a1f2e6cea4d492eaaffa8ace0bf0566a205563dc0f1bddd03e5f4a1d6f1645b035581e3c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3498ac6f75f3bda76602de24eeac4e00

SHA1
2376b760f071d747b88eb4d63dadbd6f64fb99ee

SHA256
098fb249d6ebe18107126240a114bd33c52c8ac6bb74e8dcba9858502cde9eb0

SHA512
8fcba9ab6a39fb3157705be56e82bc1819d13cc4ec0a520b52ffb51da0dc1f6851d8d9da892f42cf8daabb4c5347892015a2134e79c4d9d4d055f84c492fe143

Download Submit