c3fa59901d56ce8a95a303b22fd119cb94abf4f43c4f6d60a81fd78b7d00fa65

Analysis

max time kernel
42s
max time network
45s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
26/06/2024, 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SPOILER_IMG_8753.png
Size

36B
MD5

a1ca4bebcd03fafbe2b06a46a694e29a
SHA1

ffc88125007c23ff6711147a12f9bba9c3d197ed
SHA256

c3fa59901d56ce8a95a303b22fd119cb94abf4f43c4f6d60a81fd78b7d00fa65
SHA512

6fe1730bf2a6bba058c5e1ef309a69079a6acca45c0dbca4e7d79c877257ac08e460af741459d1e335197cf4de209f2a2997816f2a2a3868b2c8d086ef789b0e

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	discord.com
18	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1560405787-796225086-678739705-1000\{7BC547A1-0D3D-4CC8-9B11-1CC58BFA1B3B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
572	msedge.exe
572	msedge.exe
1404	msedge.exe
1404	msedge.exe
1760	msedge.exe
1760	msedge.exe
5036	identity_helper.exe
5036	identity_helper.exe
1976	msedge.exe
1976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2912	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2912	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 4624	1404	msedge.exe	85
PID 1404 wrote to memory of 4624	1404	msedge.exe	85
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 244	1404	msedge.exe	86
PID 1404 wrote to memory of 572	1404	msedge.exe	87
PID 1404 wrote to memory of 572	1404	msedge.exe	87
PID 1404 wrote to memory of 4800	1404	msedge.exe	88
PID 1404 wrote to memory of 4800	1404	msedge.exe	88
PID 1404 wrote to memory of 4800	1404	msedge.exe	88
PID 1404 wrote to memory of 4800	1404	msedge.exe	88
PID 1404 wrote to memory of 4800	1404	msedge.exe	88
PID 1404 wrote to memory of 4800	1404	msedge.exe	88
PID 1404 wrote to memory of 4800	1404	msedge.exe	88
PID 1404 wrote to memory of 4800	1404	msedge.exe	88
PID 1404 wrote to memory of 4800	1404	msedge.exe	88
PID 1404 wrote to memory of 4800	1404	msedge.exe	88
PID 1404 wrote to memory of 4800	1404	msedge.exe	88
PID 1404 wrote to memory of 4800	1404	msedge.exe	88
PID 1404 wrote to memory of 4800	1404	msedge.exe	88
PID 1404 wrote to memory of 4800	1404	msedge.exe	88
PID 1404 wrote to memory of 4800	1404	msedge.exe	88
PID 1404 wrote to memory of 4800	1404	msedge.exe	88
PID 1404 wrote to memory of 4800	1404	msedge.exe	88
PID 1404 wrote to memory of 4800	1404	msedge.exe	88
PID 1404 wrote to memory of 4800	1404	msedge.exe	88
PID 1404 wrote to memory of 4800	1404	msedge.exe	88

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SPOILER_IMG_8753.png
1⤵
PID:1208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbb6c03cb8,0x7ffbb6c03cc8,0x7ffbb6c03cd8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1796,2195066506861715533,1197106503258177061,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1796,2195066506861715533,1197106503258177061,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1796,2195066506861715533,1197106503258177061,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,2195066506861715533,1197106503258177061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,2195066506861715533,1197106503258177061,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,2195066506861715533,1197106503258177061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,2195066506861715533,1197106503258177061,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1796,2195066506861715533,1197106503258177061,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1796,2195066506861715533,1197106503258177061,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,2195066506861715533,1197106503258177061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,2195066506861715533,1197106503258177061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1796,2195066506861715533,1197106503258177061,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,2195066506861715533,1197106503258177061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1796,2195066506861715533,1197106503258177061,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,2195066506861715533,1197106503258177061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,2195066506861715533,1197106503258177061,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,2195066506861715533,1197106503258177061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,2195066506861715533,1197106503258177061,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1464

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004EC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f717f56b5d8e2e057c440a5a81043662

SHA1
0ad6c9bbd28dab5c9664bad04db95fd50db36b3f

SHA256
4286cd3f23251d0a607e47eccb5e0f4af8542d38b32879d2db2ab7f4e6031945

SHA512
61e263935d51028ec0aab51b938b880945a950cec9635a0dafddf795658ea0a2dfcf9cfc0cab5459b659bb7204347b047a5c6b924fabea44ce389b1cbb9867d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
196eaa9f7a574c29bd419f9d8c2d9349

SHA1
19982d15d1e2688903b0a3e53a8517ab537b68ed

SHA256
df1e96677bcfffe5044826aa14a11e85ef2ebb014ee9e890e723a14dc5f31412

SHA512
e066d74da36a459c19db30e68b703ec9f92019f2d5f24fd476a5fd3653c0b453871e2c08cdc47f2b4d4c4be19ff99e6ef3956d93b2d7d0a69645577d44125ac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
bc23897a41f5c1f3c5ef717aca9da48d

SHA1
df57933d976f94b86935b103ad4bc31e1426d329

SHA256
5398a16d7fc4b0be67651f21e687ba578a10c4b6f51a80ce41e5219542a9a927

SHA512
d32f02159be41dd63aa6f6d1f09e2f24f17b2efc15aa583c0f780db6483423e838e60a30613f1a366e0ca7d56ec1cfbb4e6cba39754ab0ad0e442f278dc6f7b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
defb9593a433ad5e722fe78eb04c3589

SHA1
8395fb63078e81017ad053ed6c054e0428773b96

SHA256
45067bca3794342f2daa6def0703def794f0cb4aa5a153048d489adfba0b5164

SHA512
3793112d039fb1151bde751581ff168aea87e7d944de9526f6f83e234cde2f5c048c81a5dc7f3ab68ee17ba983581d64417b44b7089765d3004461ece1ba4873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
296d5d1f5ae5668f422ade4d530a613f

SHA1
b0ed47771f26dff91948bc50e8cd54ccc97e347c

SHA256
39fdc69c82e18b9a2b1a973f0878df97263ac4a75fc19b2c921262a444ba961d

SHA512
751d5ab7769fc224873fb095a7d895b98f8d68416010b8ababd94dd894c07a5ff587e60c03f7db0ce5e3103bb9060892358a31c890ad310ea92658cde2029729

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3a72d9010b8d15b9786b9683a7885ba0

SHA1
e21e4b6e55f9a47155a68dadae168e7e6b740e11

SHA256
2d1eca647394b1ec108b0f7a07ae2f2d47c9f021a492e594a6740708e62362fc

SHA512
11004553c995989e5658290b383764723b5747f8f81f67c46d7dcc53870ebd53ee64f91a2a38cebb0201ff6f0572e71495218d983bbec790ccfd1e2b04fc91c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ec7c3d999bb3c4d60e10ac962d49c8c9

SHA1
077328acbd36136226e9cfa5961dc625cad5aa14

SHA256
a1ec4692e22e46e8fc0d8aaf1f4196800609cb8f9fc2c8ff55c6d0dd214881f9

SHA512
98774d9b87099083fb79f3e60d944539f26e0808457d5189ed87dd48c52fcf0ca523c4a60fc411bb22e4e7ed8f6fd014341f6cc63997dda073c9668b0183316a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3e3f9b994f148b13c72c51d2e8701821

SHA1
3a37b88361e9c63c8dbbc6683046d6f02bd830e4

SHA256
39d5b417944b59176510eabfd6d61b0773ae52588a82d7301ecc3d035f41dcc4

SHA512
a6860f5a9658a291bc4bb4dfb6d2a8a018ec29b067861ec1e6e78fdbd3cf682377f5cea869d745624222201eecb7969644a63f2c1b07c2cb1995afec77d8263b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
5300036e030018ed888a7715c6218de6

SHA1
ab5da1986e439e86334d456928bdd280e697ead4

SHA256
736a8c8c94150ed7ab76e6d109b81c0ad7bfdb7074f6e2fea6330865f2e2cfb3

SHA512
e2cc2ce7de07ea699b13904dcf2a3d0b588392fe7d59c0416c1ae61c492e85a332dd41ea073986a33e279c8e58bcdb38963a4eb752cd17c8f932655b1ba30275

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58144e.TMP

Filesize
871B

MD5
b1db6ad5d53468ed74fbddd0ac977814

SHA1
d35d67c78358274cb7591a214ebe8f0a8f71c01a

SHA256
96958cd927a33ec802c7275a09b7b20e4489e71f06e879ba8e5bee54dba542cc

SHA512
a31fd4a746f2a9daa8016d3e543328bef2e058442e492947568bbdc63f1242db6f7639eb8c880c2601f6b7c312f7a3ec4a52684a2030513a45a00e94e1c0f183

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6c8ebef704fbdaa4efa55e864ed30979

SHA1
79e0a36a579ff6c439672b1d8f257e80d28ed3d3

SHA256
e8fd5a0746888509c0481edc51013f26f7b6cfbbfffb7cbd2a7dd04b92c66139

SHA512
077572ab285754cb10dfed0603b27f94f8a4773d89077e04fc4ced82654b994618463c5330d85e516523c47bd6de6d30062670394909275dcce5228488ca50e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3a6acda80e9e463d7757f18b0a80644e

SHA1
7b1aaca07d1ac9d8313cde9355f6b0c516564514

SHA256
6eec46e8e8797cd5260124e293d41a0cf460d51924e7762704ca569ab7d5b2bb

SHA512
6353f0de5336fdc1780396ed9ba57cca8b2425e2969341c2981145e431e2c655269b48d39c8acd4f0b40a02f58f7c791468378f8cb8e6858e845fc9ab9af1033

Download Submit