b1912806192d130201a5adc52af7bcebbcbbf785ae77febcee4fffbc1432309e

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1912806192d130201a5adc52af7bcebbcbbf785ae77febcee4fffbc1432309e.exe
Size

38.6MB
MD5

ed9241daf488522ca7cb0de77631fe59
SHA1

827c8caad03d919be34d64d7b04e4fffda87ebb2
SHA256

b1912806192d130201a5adc52af7bcebbcbbf785ae77febcee4fffbc1432309e
SHA512

8af044888b658fd6ccdbd75c3adee5bc54403824302541c8b6a69bc9053cd9d2c4fbc78a1acedb5ec0e4c2c62075e7013221d4bdeac5eec080bb0dd2a3d741c1
SSDEEP

786432:cn6iTfRwFOUPofAl2jtyBKcDxvVkyaPZ8:If2VP9l20BKcD1E8

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 650371.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
4592	msedge.exe
4592	msedge.exe
3712	identity_helper.exe
3712	identity_helper.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 4592	1468	b1912806192d130201a5adc52af7bcebbcbbf785ae77febcee4fffbc1432309e.exe	85
PID 1468 wrote to memory of 4592	1468	b1912806192d130201a5adc52af7bcebbcbbf785ae77febcee4fffbc1432309e.exe	85
PID 4592 wrote to memory of 1840	4592	msedge.exe	86
PID 4592 wrote to memory of 1840	4592	msedge.exe	86
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 1932	4592	msedge.exe	87
PID 4592 wrote to memory of 2040	4592	msedge.exe	88
PID 4592 wrote to memory of 2040	4592	msedge.exe	88
PID 4592 wrote to memory of 4464	4592	msedge.exe	89
PID 4592 wrote to memory of 4464	4592	msedge.exe	89
PID 4592 wrote to memory of 4464	4592	msedge.exe	89
PID 4592 wrote to memory of 4464	4592	msedge.exe	89
PID 4592 wrote to memory of 4464	4592	msedge.exe	89
PID 4592 wrote to memory of 4464	4592	msedge.exe	89
PID 4592 wrote to memory of 4464	4592	msedge.exe	89
PID 4592 wrote to memory of 4464	4592	msedge.exe	89
PID 4592 wrote to memory of 4464	4592	msedge.exe	89
PID 4592 wrote to memory of 4464	4592	msedge.exe	89
PID 4592 wrote to memory of 4464	4592	msedge.exe	89
PID 4592 wrote to memory of 4464	4592	msedge.exe	89
PID 4592 wrote to memory of 4464	4592	msedge.exe	89
PID 4592 wrote to memory of 4464	4592	msedge.exe	89
PID 4592 wrote to memory of 4464	4592	msedge.exe	89
PID 4592 wrote to memory of 4464	4592	msedge.exe	89
PID 4592 wrote to memory of 4464	4592	msedge.exe	89
PID 4592 wrote to memory of 4464	4592	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\b1912806192d130201a5adc52af7bcebbcbbf785ae77febcee4fffbc1432309e.exe
"C:\Users\Admin\AppData\Local\Temp\b1912806192d130201a5adc52af7bcebbcbbf785ae77febcee4fffbc1432309e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=7.0.10&gui=true
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffce4746f8,0x7fffce474708,0x7fffce474718
    3⤵
    PID:1840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,506252423802229331,18292986142695177936,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
    3⤵
    PID:1932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,506252423802229331,18292986142695177936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,506252423802229331,18292986142695177936,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,506252423802229331,18292986142695177936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,506252423802229331,18292986142695177936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,506252423802229331,18292986142695177936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,506252423802229331,18292986142695177936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
    3⤵
    PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2184,506252423802229331,18292986142695177936,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4136 /prefetch:8
    3⤵
    PID:652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,506252423802229331,18292986142695177936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
    3⤵
    PID:392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2184,506252423802229331,18292986142695177936,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6040 /prefetch:8
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,506252423802229331,18292986142695177936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6288 /prefetch:8
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,506252423802229331,18292986142695177936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6288 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,506252423802229331,18292986142695177936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
    3⤵
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,506252423802229331,18292986142695177936,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,506252423802229331,18292986142695177936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
    3⤵
    PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,506252423802229331,18292986142695177936,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
    3⤵
    PID:3652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,506252423802229331,18292986142695177936,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5456 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
17678f165de14ad9daa821474b272b56

SHA1
4ada246446517ce1000925e22ae3881092438fe6

SHA256
b09c1bb9a4b5ea4d8d4611ccd632f1066e663b4cdf61e845851c7c86c46072c2

SHA512
369faa44e55ccc6916273fe9b14159749468f0b67c5e3e28e9d17ad5e244d4de4483f4f7f88be5db7e4f6a06f2db89ccba954fee06cac9c0fd6d427ab0e369ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1002B

MD5
b6e761d316bb61d8658f915badcdebf4

SHA1
a40226db03ba0d98215ec7b957da84a68d5ee90f

SHA256
6abebc816b592262bf21364269443f7ce1e51d602ad76fc1276fffda645c95a9

SHA512
0304a3dc25e8371cf27602740e5259f6145dd453f7d44a36d32e6517bab4dc3f3c3255b99f4cad1279221c71ce3f34e30b08580eae22dcbe0c7d8cf795ac5056

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
902B

MD5
c3712aa265a09418200c0384dbd3fbb9

SHA1
1ebee47021a3dda365b0478a68b946f71b9d8aa0

SHA256
4d9234d5ea2ab5d996029c5716ce4ce4bb5417a57c52b0ff19bc745104025f36

SHA512
57080531b2213a88666303e0c7c9d578ec72a95f441972d0e71517281c17078ee664425ceccbea137dd1711f069b2107fa4b89c5f476b610990312e3c85b2648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3ec1dd8fc91a503ed3ad4f3a9de34937

SHA1
226395ceb6a7856ed11380ef0796fdc64def1073

SHA256
280de0c4e54c88d2287175d31616d722ecfce9d01860bc8933994c42ca83a553

SHA512
53ad733acc866f4f89806ba4c874c083753f42c717fde2b9d03e3c1b5d7bd4a6f11cfea9c4b130ca9478e57b28a88eb01e0c1d19cce1b8a1076613e6a145a9b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4bde0a776622f60e03bec2d4dfbd214c

SHA1
47735ed5f94cb149de5838c0262cecc4783eb6d5

SHA256
1fb79a49464facc1869d2c60cea664fca41cedae3e7201fe1571e66c95419b87

SHA512
a7203e9dadaceb671d9527a893a4748963a64f74c40325df02f9eb183c72a0b2ea67e12fc0685fff2cf72aedcdc3c5cb75f5d39c0cc5120b9207309ff06acc28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
19bec17c8a66f115116c9cb4bc7e3fe8

SHA1
3bf559b6dad05136f6c6ed2d450f98ce8060dd97

SHA256
6406cc6e37c4162fbb1b1f600ae1380d50671efc9bfcda2e6003459be3c8a828

SHA512
a41f74b9d74affc2d1d1b24b5a5b22df0e0e4ec5ec9f6ac1671df23ecc355b738252b87c2090bb5518fae02925bb9ada619c9a8450523181dfc0704f151c1389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
d89b40a0924236cfe8cfc3adf50de666

SHA1
302aaaa1bc51d3759657c643f822652532432f98

SHA256
3aba35a1d84f4f55045cb88986527e47f16364b684869e7c9fe925105925cb5e

SHA512
48c07704dcc43082a0dbc887d1f472b9f6d572a7a867b45426842b9f0c79ff1d0fac68f6bb098512ccd14e6e027e95787f457b98ce475d5e3ba00f1264b2053c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5898e0.TMP

Filesize
539B

MD5
f01629102df1ef940a34b53b5521b66f

SHA1
5525c45ca6ab94f3267af75f80ee4b968bf28e48

SHA256
d4b36d4371c8b5348a6b1ce16e3f103e739cb0cc26144b30f83554a2a863978c

SHA512
d7f8091b9785c5e1629d70b1288f92149c8da55c3c8635913a7703e7b868400c0825dd28647aa7e89a36becf6bb5794503102ffd11d8b182321661043d69b8b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a99b2b8c77438b6d2b66256f0229b965

SHA1
999870600aaae0dd7adb588033c94fdb529bc231

SHA256
3872dce80cf9aa39152327bfc449dc4e758a3f4faef11191bb0e2f082b59995c

SHA512
20f71d3c5e4272ecca41b653245298d3559cf09e2800461c1c59c742715e84936ce9db286ef658e4b787fbd45fd009e8f7bef62d0693ec82fe2822e55a443fbd

Download Submit