7be0c0da79239377aefdd0469da0a790b8bab2659f01c47dfa6ef4fd81c71497

Analysis

max time kernel
146s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06-07-2024 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7be0c0da79239377aefdd0469da0a790b8bab2659f01c47dfa6ef4fd81c71497.exe
Size

38.7MB
MD5

b6da70ee489a102bac114969cb88f0bc
SHA1

1ccead98f5ed632c51f6ede694b003462075fe8d
SHA256

7be0c0da79239377aefdd0469da0a790b8bab2659f01c47dfa6ef4fd81c71497
SHA512

0fcd1a02219e47d44287c45566f65e3d1a72f7b1019cbd94764fb1744ac9f79ba3f2e498a4601e8a26b0fb8f0d32ed3c6459bd9aff3c963a6aaa2e35a3b5114c
SSDEEP

786432:hn6iTfRwFOUPofAl2jtyhIcDxvVxyaPZm:Xf2VP9l20hIcD11m

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 76075.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3740	msedge.exe
3740	msedge.exe
2460	identity_helper.exe
2460	identity_helper.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 3740	3644	7be0c0da79239377aefdd0469da0a790b8bab2659f01c47dfa6ef4fd81c71497.exe	85
PID 3644 wrote to memory of 3740	3644	7be0c0da79239377aefdd0469da0a790b8bab2659f01c47dfa6ef4fd81c71497.exe	85
PID 3740 wrote to memory of 1128	3740	msedge.exe	86
PID 3740 wrote to memory of 1128	3740	msedge.exe	86
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3304	3740	msedge.exe	87
PID 3740 wrote to memory of 3524	3740	msedge.exe	88
PID 3740 wrote to memory of 3524	3740	msedge.exe	88
PID 3740 wrote to memory of 2592	3740	msedge.exe	89
PID 3740 wrote to memory of 2592	3740	msedge.exe	89
PID 3740 wrote to memory of 2592	3740	msedge.exe	89
PID 3740 wrote to memory of 2592	3740	msedge.exe	89
PID 3740 wrote to memory of 2592	3740	msedge.exe	89
PID 3740 wrote to memory of 2592	3740	msedge.exe	89
PID 3740 wrote to memory of 2592	3740	msedge.exe	89
PID 3740 wrote to memory of 2592	3740	msedge.exe	89
PID 3740 wrote to memory of 2592	3740	msedge.exe	89
PID 3740 wrote to memory of 2592	3740	msedge.exe	89
PID 3740 wrote to memory of 2592	3740	msedge.exe	89
PID 3740 wrote to memory of 2592	3740	msedge.exe	89
PID 3740 wrote to memory of 2592	3740	msedge.exe	89
PID 3740 wrote to memory of 2592	3740	msedge.exe	89
PID 3740 wrote to memory of 2592	3740	msedge.exe	89
PID 3740 wrote to memory of 2592	3740	msedge.exe	89
PID 3740 wrote to memory of 2592	3740	msedge.exe	89
PID 3740 wrote to memory of 2592	3740	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\7be0c0da79239377aefdd0469da0a790b8bab2659f01c47dfa6ef4fd81c71497.exe
"C:\Users\Admin\AppData\Local\Temp\7be0c0da79239377aefdd0469da0a790b8bab2659f01c47dfa6ef4fd81c71497.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=7.0.10&gui=true
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b32046f8,0x7ff9b3204708,0x7ff9b3204718
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,13184130173217974956,96571931558391603,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,13184130173217974956,96571931558391603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,13184130173217974956,96571931558391603,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
    3⤵
    PID:2592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13184130173217974956,96571931558391603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
    3⤵
    PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13184130173217974956,96571931558391603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13184130173217974956,96571931558391603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13184130173217974956,96571931558391603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2188,13184130173217974956,96571931558391603,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5456 /prefetch:8
    3⤵
    PID:3416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13184130173217974956,96571931558391603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
    3⤵
    PID:3912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2188,13184130173217974956,96571931558391603,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6148 /prefetch:8
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13184130173217974956,96571931558391603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
    3⤵
    PID:1752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13184130173217974956,96571931558391603,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
    3⤵
    PID:3952
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,13184130173217974956,96571931558391603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6716 /prefetch:8
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,13184130173217974956,96571931558391603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6716 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13184130173217974956,96571931558391603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
    3⤵
    PID:920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13184130173217974956,96571931558391603,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,13184130173217974956,96571931558391603,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6516 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
210676dde5c0bd984dc057e2333e1075

SHA1
2d2f8c14ee48a2580f852db7ac605f81b5b1399a

SHA256
2a89d71b4ddd34734b16d91ebd8ea68b760f321baccdd4963f91b8d3507a3fb5

SHA512
aeb81804cac5b17a5d1e55327f62df7645e9bbbfa8cad1401e7382628341a939b7aedc749b2412c06174a9e3fcdd5248d6df9b5d3f56c53232d17e59277ab017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4e6521c03f1bc16d91d99c059cc5424

SHA1
043665051c486192a6eefe6d0632cf34ae8e89ad

SHA256
7759c346539367b2f80e78abca170f09731caa169e3462f11eda84c3f1ca63d1

SHA512
0bb4f628da6d715910161439685052409be54435e192cb4105191472bb14a33724592df24686d1655e9ba9572bd3dff8f46e211c0310e16bfe2ac949c49fbc5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
825d98ff9f7c5cf866194d9c6e4bb52a

SHA1
420798766a4706d6ed51a6e3c2aa9398c5ca76a3

SHA256
882c0c794183545d03cdad09b31e118bfe583c43bd7e588a4881e7288aba561c

SHA512
b8f398cdb20eb0aa6e3940989b4bed157c46b2777eee8c86bc037870b08663cf1b16c5e68d368ccb7a9435f4e72cca6479dffddd76cdef48ea1dbe38dc25926f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1002B

MD5
7005f4e9c77e629be30daf4a72d2af62

SHA1
ff24dfbc124675bcada178ddad19febf91b464e7

SHA256
951e3fe7f2f507e0ac76584218e54ba034d47b9bc13b79f05ed266ece9f1a372

SHA512
91bb3e413ec0b252e760fd6baabe14c724e6b6efb3824c0c19d40bb106025839f41e5d56276303443739b3ff5b030b3c912eaff577a17d89574eeef65c4aed89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4174efff1786b23f67b78c70b9155a0a

SHA1
b719ec5c7a2e1dd087c71cb2f3f768cbff79112d

SHA256
2732a35fe3f5e2f0e1926b00ab3ee43ce503b0ce18042da429bde977585c2bb8

SHA512
1a476477b8ea0b997c12268d3f8d8abaf4e10d2da409ce394e1de40ce46e6fba09b728b191891a9745ca529e8196ff7091482e080733bc633bda8e7806a1dc64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a4c1dd55b283411c90bd8a9399441378

SHA1
29e395d6f0a3df8426d1f5f19a73275df5bcb5b0

SHA256
cb6daf476582b1664c681e35dcbf05a35c778abed168fbaf32febd45bf5d3621

SHA512
4b5561b7bef77ae1d901bd575b7f1d5dbc8d0602deac3ad3c77f66781c1bb8fd9cdb77a6854d404bfdb5446d4d9dabe73b1fa5c7d5c6ca3a1da5ead68357e044

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cc12a7046cf1a1e24888d6126c85cbf0

SHA1
a56a6eb3b265324561ce36efd8e5e19975d52344

SHA256
4b67d9318daaf12ea826b8f1d64cfebc262ee0c5a96a87a203cdf658b524819f

SHA512
5d3f281641163f32af1b620588f4775d8825fdd6d101f7b65a87ea80e4d6038a6a36693d697deb2fe918aebe63449ef4dbb0067913da1c4994cfc939fcbf462f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
ab023fb03933a6ba249ea3b8e82552f7

SHA1
02380c5da7b5aaf9e91a63308061066b5532f9b1

SHA256
e6b49585984e5e251c983f400b8c611961c0fd85a510cce3678e9f207d874937

SHA512
4546d690cf0f48777735ff77a7509fda4545ab8222cc5e577478461696a6470e781028b19aeac9af128cb4160955f135d3bf982cbc1a61e4b9d46c334e40fa35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
3d7c7962794a7a788297b8163e5f380c

SHA1
3b253025ca5167d519e4afb7758752e8e5a66e33

SHA256
7325083c2a91e2450b46dc9865656dc531887c4b7f9cb917fc883fa40695b233

SHA512
a499fc7330a2096040066fa697dc38b2ef1e52034b530587729b162d9ce06c8edbf1c7413e5e860307f36f9686620e6c8d845ceec366d8a622b2ca2b30a171e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d0b9.TMP

Filesize
539B

MD5
2acdb3cc3eae78c63b7e38ca99ca26a5

SHA1
d5483ce19d2ad337e8957e7ba672d4b83e147538

SHA256
dd436e971ceb0fe761e2247c6d1a017629df68cdd24de6d95669d64d59d61ed1

SHA512
6031fdf6039d3279ad09b0eeab70e4ac28d92f4f6d3f2573cc8bee51365973e92e073b9388ec8cc0944766704f5c584079fa5d27d3553bc3866767173cdc9d8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d62855782a808448e2d2acc44b543786

SHA1
1ed0530cf03e53d9cbedd88f5861e958d47b627b

SHA256
26466223fc51647806baa3ddd182831a66910541f1a113195298e8ec33674387

SHA512
5e9480af4b78e7721907bc667616ece538abe423433ecbdf211c466fc640065077d3187739e5b17fe9ef1c75f7a02db99ef96ba0af9683227cf214e445a2644f

Download Submit