112461885f4ac1a6da60ef951205df9c4f834333a9b1998239de3d7851a6fd0f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

112461885f4ac1a6da60ef951205df9c4f834333a9b1998239de3d7851a6fd0f.exe
Size

31KB
MD5

a955de9497c50b8beb4724cf7fe1f2a3
SHA1

e71faddfaf3e04e465267bbaeddde1b1d358da2f
SHA256

112461885f4ac1a6da60ef951205df9c4f834333a9b1998239de3d7851a6fd0f
SHA512

57ff313edb473ca8b47ad56ad9f0a066c66c3c99b38b7c48d1b90fed6fbdc92e028205c75fcc6e5270c22fde1c57692def48a321b37e68bf11501e4f27581a50
SSDEEP

768:wiqPz2X1oRYcekNY/y6ovuAmfiq7U6w4rd2lN065RhWifhyLAuJGGn:wiqb2X1oRNY7omAmfiq7U6vER5/h8AuE

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
4880	msedge.exe
4880	msedge.exe
4808	identity_helper.exe
4808	identity_helper.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 4880	2664	112461885f4ac1a6da60ef951205df9c4f834333a9b1998239de3d7851a6fd0f.exe	90
PID 2664 wrote to memory of 4880	2664	112461885f4ac1a6da60ef951205df9c4f834333a9b1998239de3d7851a6fd0f.exe	90
PID 4880 wrote to memory of 912	4880	msedge.exe	91
PID 4880 wrote to memory of 912	4880	msedge.exe	91
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 2424	4880	msedge.exe	92
PID 4880 wrote to memory of 1500	4880	msedge.exe	93
PID 4880 wrote to memory of 1500	4880	msedge.exe	93
PID 4880 wrote to memory of 2800	4880	msedge.exe	94
PID 4880 wrote to memory of 2800	4880	msedge.exe	94
PID 4880 wrote to memory of 2800	4880	msedge.exe	94
PID 4880 wrote to memory of 2800	4880	msedge.exe	94
PID 4880 wrote to memory of 2800	4880	msedge.exe	94
PID 4880 wrote to memory of 2800	4880	msedge.exe	94
PID 4880 wrote to memory of 2800	4880	msedge.exe	94
PID 4880 wrote to memory of 2800	4880	msedge.exe	94
PID 4880 wrote to memory of 2800	4880	msedge.exe	94
PID 4880 wrote to memory of 2800	4880	msedge.exe	94
PID 4880 wrote to memory of 2800	4880	msedge.exe	94
PID 4880 wrote to memory of 2800	4880	msedge.exe	94
PID 4880 wrote to memory of 2800	4880	msedge.exe	94
PID 4880 wrote to memory of 2800	4880	msedge.exe	94
PID 4880 wrote to memory of 2800	4880	msedge.exe	94
PID 4880 wrote to memory of 2800	4880	msedge.exe	94
PID 4880 wrote to memory of 2800	4880	msedge.exe	94
PID 4880 wrote to memory of 2800	4880	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\112461885f4ac1a6da60ef951205df9c4f834333a9b1998239de3d7851a6fd0f.exe
"C:\Users\Admin\AppData\Local\Temp\112461885f4ac1a6da60ef951205df9c4f834333a9b1998239de3d7851a6fd0f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=112461885f4ac1a6da60ef951205df9c4f834333a9b1998239de3d7851a6fd0f.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xa8,0x108,0x7ffccd2346f8,0x7ffccd234708,0x7ffccd234718
    3⤵
    PID:912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5605360852452492008,5713438158327750471,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,5605360852452492008,5713438158327750471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,5605360852452492008,5713438158327750471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5605360852452492008,5713438158327750471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5605360852452492008,5713438158327750471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5605360852452492008,5713438158327750471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5605360852452492008,5713438158327750471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5605360852452492008,5713438158327750471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5605360852452492008,5713438158327750471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5605360852452492008,5713438158327750471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5605360852452492008,5713438158327750471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2996 /prefetch:1
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5605360852452492008,5713438158327750471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5605360852452492008,5713438158327750471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5605360852452492008,5713438158327750471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5605360852452492008,5713438158327750471,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1956 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=112461885f4ac1a6da60ef951205df9c4f834333a9b1998239de3d7851a6fd0f.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffccd2346f8,0x7ffccd234708,0x7ffccd234718
    3⤵
    PID:5012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
cc61e78d77131d9771b63b192e6a4872

SHA1
8b07de28294093e0bf69736e6c8df900e6dfc8fd

SHA256
a6cf8ccb9978511f257d5c9802d69b87c78ed422d908341075fc24009df53e38

SHA512
61a93a10152d4ade088009920b8a7138d6d00611c8ff15ba81da10c95a28ec69c071c6ac90ea78f4edbb1016b26441228dcdc243d207f9b1e211845f924a070c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
95d3382d8bbba23327118fc9b61031b9

SHA1
230644685bd1cc79aff72383a81b5a3caf39ff39

SHA256
1587f491b17102723388a9045a0271d60fedb3fcff72a6034898ac29791550b3

SHA512
5bdafe869a3e9e15dd64aacb9dc0e2a0fcca80fe905ab2fe73f78ad9af5c153309b87edb900efc76aa917284e45485fa0bc73c35a563c6497c780b4a30f3381b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
14af09a451db70d25ab51b2ebfb79cf6

SHA1
0d398b8443513013ab25867014c1a5d4e2f5ad84

SHA256
52f75b82b7b2d65922bbea6a75e463c8fa66dca2d41ad1185dffee10c9352739

SHA512
3d21193fdd403cff3313554136c43c80b59471fcc064b5dc9970a40b2271c0c16d0bc723a8e53def5f2c33208d7a986c37a45b1b9d8e115ff64b25f6551e4fb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b263e086e58260cd267e89a877105952

SHA1
7ba9cd660e7a143a06fb733f7366ba273159418d

SHA256
daaa659701fa65edcb4385cfcca80b110bf47944e15279a75b743c69ae816263

SHA512
c588a0808867c8f90f03b5136172db74ac43322837b4d8c03e767564c61c2bbe1754d3836e5f330ee26367e04507d10e8ec1fc1d6dd9f7155215ac3abe9c636e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
a08fe6a7f38ea60e5ebe2cc8aea25208

SHA1
dbfadb29047433a5c43f79a748593b0001b3a346

SHA256
e36f721d6c7641bdea3383dc1892e35c74fc222e76ea6a2aca7f70ae7741c649

SHA512
8e59a27b8c4efa26da99468df60d71293cb5b1f6bd848dff4d1fc0d65516b961c2d7eab5e9ff8698eadf6bc0b33def3febe5eed11d60ffecccdb5515f963f0c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a3f1.TMP

Filesize
369B

MD5
c90b92ee37f7d76361a77db0e8473a4d

SHA1
dc5213574cdd3321a805fe44ddcf9efba1f1c621

SHA256
d7f6b7e198e21d77b09ad5acee1a01d3fefe85169d31fc9b71fa05859bbe2092

SHA512
12998d7d7ad9f0e33f59bc5e25f5b811b2feb8e3a23752e4db3b224699b5b05d6b0afacb69742d6b9291c204f6b46f7123ac48890cd0b522cbb19f95167d5a53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d7a18aa10790127f151df0afe42a10ed

SHA1
df87e9ffe205f9aec3e873f2c34c3ea19903d401

SHA256
6824f4c9789f157cdfb00239d366da3e5f50e4394d4a19bbb196fc17d6dfcb6c

SHA512
022ad4ecd7d590a6118dcd8967fc6eb6111602566bc02cf02c415a8217e1e512dc4b92d909ebff2ad0231d3624ee6b5ea610b92ab543954f4e91decb24911508

Download Submit