f5e8d3b9373bb7f36edfc28c0ecb2471fbe2dad14021aab5d2f02866797c1269

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ATT01876.htm
Size

249B
MD5

d04f9613beebebed0b1d99528c39bb80
SHA1

0cc5c837feed0d5fa1d9e85cab3197723e4a803c
SHA256

f5e8d3b9373bb7f36edfc28c0ecb2471fbe2dad14021aab5d2f02866797c1269
SHA512

b95f88e4c517e12fbcf9f22987235597de094487130d90b23262361da69748383c4b7ed446f5bb9ef0a4467e49b0c65f21c075961b938f1cb8a0ae00a32bf147

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
2796	msedge.exe
2796	msedge.exe
1648	identity_helper.exe
1648	identity_helper.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2856	2796	msedge.exe	83
PID 2796 wrote to memory of 2856	2796	msedge.exe	83
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 924	2796	msedge.exe	84
PID 2796 wrote to memory of 4708	2796	msedge.exe	85
PID 2796 wrote to memory of 4708	2796	msedge.exe	85
PID 2796 wrote to memory of 1144	2796	msedge.exe	86
PID 2796 wrote to memory of 1144	2796	msedge.exe	86
PID 2796 wrote to memory of 1144	2796	msedge.exe	86
PID 2796 wrote to memory of 1144	2796	msedge.exe	86
PID 2796 wrote to memory of 1144	2796	msedge.exe	86
PID 2796 wrote to memory of 1144	2796	msedge.exe	86
PID 2796 wrote to memory of 1144	2796	msedge.exe	86
PID 2796 wrote to memory of 1144	2796	msedge.exe	86
PID 2796 wrote to memory of 1144	2796	msedge.exe	86
PID 2796 wrote to memory of 1144	2796	msedge.exe	86
PID 2796 wrote to memory of 1144	2796	msedge.exe	86
PID 2796 wrote to memory of 1144	2796	msedge.exe	86
PID 2796 wrote to memory of 1144	2796	msedge.exe	86
PID 2796 wrote to memory of 1144	2796	msedge.exe	86
PID 2796 wrote to memory of 1144	2796	msedge.exe	86
PID 2796 wrote to memory of 1144	2796	msedge.exe	86
PID 2796 wrote to memory of 1144	2796	msedge.exe	86
PID 2796 wrote to memory of 1144	2796	msedge.exe	86
PID 2796 wrote to memory of 1144	2796	msedge.exe	86
PID 2796 wrote to memory of 1144	2796	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ATT01876.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95f8f46f8,0x7ff95f8f4708,0x7ff95f8f4718
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,10636142341792883174,10289073349247342431,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,10636142341792883174,10289073349247342431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,10636142341792883174,10289073349247342431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10636142341792883174,10289073349247342431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10636142341792883174,10289073349247342431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10636142341792883174,10289073349247342431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,10636142341792883174,10289073349247342431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,10636142341792883174,10289073349247342431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10636142341792883174,10289073349247342431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2696 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10636142341792883174,10289073349247342431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2068 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10636142341792883174,10289073349247342431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10636142341792883174,10289073349247342431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1876 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,10636142341792883174,10289073349247342431,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6c86c838cf1dc704d2be375f04e1e6c6

SHA1
ad2911a13a3addc86cc46d4329b2b1621cbe7e35

SHA256
dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb

SHA512
a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27f3335bf37563e4537db3624ee378da

SHA1
57543abc3d97c2a2b251b446820894f4b0111aeb

SHA256
494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a

SHA512
2bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
56KB

MD5
34f965a4d7d19b9c3537c4e1869b4739

SHA1
3f452880f9ef9bd9ce4a2ee7a32add87e3f0759d

SHA256
65b2a4c0e766b867fcaf5630491c5ae9e96b3c6159c1a278467e6e89d700de07

SHA512
7177b02e5a299fe42d050e9e09147fb119e57e885c5c462883bdcd48ab41a9ee362293ec9a9aec661f6cd5a85260f65a0bcaf2012d270682870040e406d73ffa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
17KB

MD5
952ec9075d757b709ea4469379e28f9f

SHA1
c2a96e00b1e7e92ddc80b44e08f4a5c6d693266a

SHA256
491a8db58567aef33f3faf9a632059f5fcb915f9ed41dbeef23a9f41eb111f6d

SHA512
4a33cc2a4b8dbf0ba294b769c1ad83a1903c1a151bdd691dc54e094594c90f64198b50b1a2270b3ad79e93e94c9856ff24998c79b4cca84a65439f1b2028fed3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
1.8MB

MD5
5e9a386193a3da0b6ddbd74c4c9b1938

SHA1
5b5166991c2db064a81ce399ef11a87c9cf2b3ca

SHA256
279fd2f3ba013333c14cd32ffb878c9bfa2da8763001ee066a3e09db074f338b

SHA512
7dccbdfed270540a632cfdcdaa7e4fd4ca052935c1c5737c93ab80019ca4236128c60c75b579b944652f68d26a0e37c060d232f79896f396b1619859e31e44d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
938KB

MD5
408b5c460c5137e1e2ec9522ee8a4cbd

SHA1
d08ca4ddcf9b58cd10a6020953766f93d0ceb74f

SHA256
8f003c7ebce395b61518a930e1d5961a9b7ae36838f1c57e3e4a7f3da78a8f26

SHA512
05826e344e7da45c59731497dd1f3c255c98ce65f66ccb0b6c028522101c7cdadc2dd9949f7f4bb573f0546f205350883fb25405e1b16cb30a67f8f9c4322fac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
24KB

MD5
9c700e17e974d4ab2dfde82f6451dbbb

SHA1
d5b85e82e10c2d96b36316670c76b8a0112bf246

SHA256
3ec0462dbcae8561ca0465558845da248d434dc6205cbde99c47ae3be2ac99c0

SHA512
1428b7401d281ad3d635eb007e45b6e5798be6b029f270874af2312627c496407ec7440df4a3028f3cd6c1ec587b0805425ae5de4bcb04b90d942145e26966fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
24KB

MD5
bfe899d5100d5084b30748cc9d389a4a

SHA1
6ffecd302fc9a761f01266c234eba171968c2553

SHA256
f491e31bbdbad29456d5a8125f1be3bccdae56329c26d79ff63b8c32a99703c1

SHA512
d7ac825311abb4967a3eb044c044bf5ebb78f4fc267f9eac92b63825e67d9c903c1abaee4e787f96e26f4d31cff3461e8bd83c2b1fafd9f71ff441cc0febac11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
df4e3a1f0ad7b28f030462ffed8e5222

SHA1
aece863b8e701b77e9ddd0cbf1974225cbdeb3d7

SHA256
187daed7c2482c5db7949940d79c8de29d3a4ad523ebbc61953128dec4f9d6a9

SHA512
d0872852d74fbf76117d1febc14cec1321da78d3de23252ccd02d9759de64f52b04053fbdb450110335e940fec6a82e2e8fe5ace075b16669f33386f90a28247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
a9547a37c1236e940b5fef65de32e6c3

SHA1
bb55336e5c0affc617277286f5854ed7b88b17ef

SHA256
3ff30d5a40153b84ed7945f33f26178484f8dd37d3371a8928f8afc28a6f29aa

SHA512
38c34a9ef081531a06dcbc4e2253b93921507eabe996931473d89a1d32c42bd48b3093bb6ea8e6051bc626bc2a541b6211ed4e1a92735b8df4fbee25d59bf0d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
66e64e5d434bbefcd11c4e320af91041

SHA1
4bff8ad1317100f9fb7845f2dab52f24fe5a50fb

SHA256
8be3812aaa9ff3bbe8a7f536bf1a8353a0fc62af67a9e4a4b6392f7e96c4e523

SHA512
45afd5939ace0a1dab1d527049678772b17df2c9f8b31e263ef7a41847dfe998d3dc27d18f0a470611627594785f5ef775f86b68bd189ed9acd84fcc79b85685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
768B

MD5
a59ce74295bf421e32295016d945fc61

SHA1
fe951f71b07df41dc244abe2a11ffc6633de999d

SHA256
e1e73af611bd2ab39d4a905fa33e3d45ea20b16a2618fbd9c24d0b215101eb24

SHA512
47061d3d0ea3827612b87bb5f759373c02ca50d2cdf45381e5ed2b39e195a6f6ad79861b019db48f60ad2c79544e35cc9ade236e19b352166082882fd0d698d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c97f3a3f5c1220eb7377a57ebbdb50bc

SHA1
d29fb439f65d6684faf2bc9d04415441be4e86c1

SHA256
4546d603297a7d5838296961cf4dfe86a298d401acc2c03b18e766e6b220ddfd

SHA512
b21f6d8807ae030227c29fb2046d9eee4fa0c1d09bf59d2d0d0debdea5a34c0e5788ca16e97eed686704b66b515582a371302e580c0a9c8271dee2c20cee58ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1cfb6e73bd686984e95e3137fc25ab93

SHA1
09c0eb9aa37762531008e313a39ae0594e140d02

SHA256
b4067f2eeeb1a1d5af3cf767665bcacac60b70bbd4b1e9518dab8325b71d4c07

SHA512
06550169a5a9f763b008ff1ca006c32829e60fcd67d5191d604ca3b6260a96e1f41b44ab13969e7d63b37d5a277be81a2fb247956b52128b656b3ad0f84aa116

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d011b917afcccd19e9c64b3f90038675

SHA1
1b73625d825a42afc9580451d8c0609b8650913b

SHA256
0d058908f0888a8160581b309d204d2a5a0a8372e1e9f57b86715883406de337

SHA512
f3e4085d9bada99d4e6c343c9cc8154ed7301644497cfee99da94c0e5a2ffa7e5dea1f9148a08919888f3e76a6749d77f2652e56d39dceb17a13aedf95335291

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
86aebac41e79af03cb6df1dda98aca0f

SHA1
d8b7a81f888aa1a950967e27f6c9f3583ac70061

SHA256
6472c2cb4a4c9a719315f7b1705c260dc557761f1dbcbd09174ebb9de12782b5

SHA512
dace0b7d0682ee5b4a28efd7f5ae1f58c4b935d2f3e0179211ab07ed200a223be0d5531991b4cc15d2eafceb4fe72315acf345554aa5fcd0a750d76b56f2a856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6ca9f0ef8c6e7cf54585e33cb284b29d

SHA1
e3ccaae7a200c14f6d62607bd6830c436002d795

SHA256
50e4663e3622d60509dff6487ff1aa3d424f324b431e586b623921a506ef4c5d

SHA512
bcdb75b0cb0dae35966e3a3400e10446331149cb0a1f1fb500d19bb2a9e826f9bc81a5f21e4cf199673c38518728c098acbadb72a69c76c008ad0e0182139c69

Download Submit