828d223e7a3c7ae580d4119c0ae83351b5867d8197379ff7ffd4ed8a242721c9

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
17-07-2024 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

828d223e7a3c7ae580d4119c0ae83351b5867d8197379ff7ffd4ed8a242721c9.exe
Size

39.2MB
MD5

0c3b8816be1110ef9be060de2cbc7222
SHA1

a8b9845c227bb2f5ecaf1d032b6c928506418462
SHA256

828d223e7a3c7ae580d4119c0ae83351b5867d8197379ff7ffd4ed8a242721c9
SHA512

47ed34fb2872ead99ce2ea94eb727bc6ed768432211b8eeb62b853612aee91f1b7aa03ea7ce7db4311cbd3c7229740c5640eca3b0cbe42b5cbd48fffacb57e00
SSDEEP

786432:Nl6iTfRwFOU8ofAl2jpyrmcDxvVsyaPZ3:Vf2V89l2YrmcD1w3

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 572574.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4972	msedge.exe
4972	msedge.exe
3728	identity_helper.exe
3728	identity_helper.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 4972	1584	828d223e7a3c7ae580d4119c0ae83351b5867d8197379ff7ffd4ed8a242721c9.exe	91
PID 1584 wrote to memory of 4972	1584	828d223e7a3c7ae580d4119c0ae83351b5867d8197379ff7ffd4ed8a242721c9.exe	91
PID 4972 wrote to memory of 1836	4972	msedge.exe	92
PID 4972 wrote to memory of 1836	4972	msedge.exe	92
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 1620	4972	msedge.exe	94
PID 4972 wrote to memory of 4552	4972	msedge.exe	95
PID 4972 wrote to memory of 4552	4972	msedge.exe	95
PID 4972 wrote to memory of 772	4972	msedge.exe	96
PID 4972 wrote to memory of 772	4972	msedge.exe	96
PID 4972 wrote to memory of 772	4972	msedge.exe	96
PID 4972 wrote to memory of 772	4972	msedge.exe	96
PID 4972 wrote to memory of 772	4972	msedge.exe	96
PID 4972 wrote to memory of 772	4972	msedge.exe	96
PID 4972 wrote to memory of 772	4972	msedge.exe	96
PID 4972 wrote to memory of 772	4972	msedge.exe	96
PID 4972 wrote to memory of 772	4972	msedge.exe	96
PID 4972 wrote to memory of 772	4972	msedge.exe	96
PID 4972 wrote to memory of 772	4972	msedge.exe	96
PID 4972 wrote to memory of 772	4972	msedge.exe	96
PID 4972 wrote to memory of 772	4972	msedge.exe	96
PID 4972 wrote to memory of 772	4972	msedge.exe	96
PID 4972 wrote to memory of 772	4972	msedge.exe	96
PID 4972 wrote to memory of 772	4972	msedge.exe	96
PID 4972 wrote to memory of 772	4972	msedge.exe	96
PID 4972 wrote to memory of 772	4972	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\828d223e7a3c7ae580d4119c0ae83351b5867d8197379ff7ffd4ed8a242721c9.exe
"C:\Users\Admin\AppData\Local\Temp\828d223e7a3c7ae580d4119c0ae83351b5867d8197379ff7ffd4ed8a242721c9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=7.0.10&gui=true
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9253246f8,0x7ff925324708,0x7ff925324718
    3⤵
    PID:1836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7422444967672343911,18149119782382116106,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:1620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,7422444967672343911,18149119782382116106,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,7422444967672343911,18149119782382116106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
    3⤵
    PID:772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7422444967672343911,18149119782382116106,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
    3⤵
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7422444967672343911,18149119782382116106,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
    3⤵
    PID:1280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7422444967672343911,18149119782382116106,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
    3⤵
    PID:1212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,7422444967672343911,18149119782382116106,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5196 /prefetch:8
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7422444967672343911,18149119782382116106,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2148,7422444967672343911,18149119782382116106,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5700 /prefetch:8
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7422444967672343911,18149119782382116106,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,7422444967672343911,18149119782382116106,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6180 /prefetch:8
    3⤵
    PID:952
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,7422444967672343911,18149119782382116106,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6180 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7422444967672343911,18149119782382116106,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7422444967672343911,18149119782382116106,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
    3⤵
    PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7422444967672343911,18149119782382116106,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
    3⤵
    PID:5260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7422444967672343911,18149119782382116106,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7422444967672343911,18149119782382116106,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
078c2563cc82baa29c82f842d803b9d4

SHA1
e70bc4abf5e1e6f767fde51a69fe99d12703ea5e

SHA256
921180147e1418016d04b3c3c9fa1ddf99b7fe0e10746b2f8f8c2e774c9a21b1

SHA512
b7f23ec6320556b1b97bac7b6cf6930ebfffe29dfe1d894e3cacb536c53414d7799a8c0842d16aa9fac36bf2ff671d9bbc249b47307aa39664b9b87f00cbf5bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1002B

MD5
c8312f34b3f10d9368933779979c0221

SHA1
6a4ee9e3ae5618723ead20c9e2c36cdb4416cb5b

SHA256
ae5422a0c5d9950c0d6cb0b051ccfbc02b6c1196c7af681c29fa4859aa00bec3

SHA512
8974ffd5c93e287bda79c6e607921a0a21cf07b9d15582e9e8fe0a8f915ab4a30d0b24b07fc1e0cc5f0da2dd9c10ad15729a5fdea4fd77001bfd42a1515e9af3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8aeb386ee40b8cd5bccaa2d58c4727b

SHA1
ba08b6d80a3c9988b4ee85fd99142f7385be1c27

SHA256
a807d1d4cd66060156872f7cd308d4f53f07e33396316f25f0a0c353d698a946

SHA512
54656a87db7ed9103cce8d75e3ad03530721f0c872bb45bb3e953c1be10011f42afe8f0f9ba3367173867072e31ed99a58b98e25227a3cf7537802e76accbd23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2a9f2f84d373e8845adac327fe564fe6

SHA1
165aead3fd67aa10f3235e08c64e9456f25adacc

SHA256
65a04655dfc02ec9fe25508a3168596dab850dbbde5841d1e1b0fead48122994

SHA512
8fe245d0020f2e5a5821af4d8a4d0898c8e37775a662ddff7f61c3dba15e237ea30bf975d56ea7798958e3b4486f0bdf131448f7c8dbfeff3f49313b4cdb32f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
d1f1f0d46cf71c30f128a991dbd4a4e6

SHA1
d9e6515dcef76299420e68683c5e6150aecb26a2

SHA256
c58ed5b93b64767883961cbbdd2b56bd0b7681e4006658f8287ebd96444902fd

SHA512
0cd7bd5d34dd6a5a97c0b998b8b65a5766b9ea2cec31945da70e17247b21b3131ec3cef34cbf612f8ec871b4a8dd59bec363557f67db597700b5efa03eec8cf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
4fc4c50db0b4c532a69eb3c35d0e1935

SHA1
55b4bd994255ed2724330d1fbfb856faf275a4a3

SHA256
23e0e6212d6f97da4bd663206e01991c7703ea99df5a7ddce491162e567abae8

SHA512
4cba30d6fbc05ddaa95cdc6452fecc498a8c4056190d391db9676b0135b5c8f73fd33566b8c3f77a589a33a34fc6671ae188cda4b885c92f91c85f606ffc9ecc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58ac87.TMP

Filesize
539B

MD5
e4137836f888aa53bad68a044e2a907f

SHA1
751ffa5d66b9fe9b7e6cf17684625876e2b6f6c2

SHA256
8e364acb598d17dccc03352d14a3496364221cbd2f2a925b93104f59a5b52f31

SHA512
4063d8d5f80ff42b4673a81d35572231fda10a29e3172985197e7a438be3d9d54971f07d155d0764b303da41e3e31c4b090b4e97f66383268bf56e43fd146f8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b378fc90468be3984465bca934b037f7

SHA1
840a8e28f80a22a483248a17eb7d3c4bf0c62d43

SHA256
c341c67a5e312821af46dfd7fdaa5c3ad86ab665ce99899a37a28f9f9ef9d562

SHA512
efd0f8856be64a8ac18e2795c316218e15aced9feb94039de68b6ed2bbdb2471b69eab403779908f3a081ab64a4ae229402ff66f938d0276993eb143a54564a8

Download Submit