3eb08aecd009036fa0c84d4f3e5042aa62cdca8fb1df86a2cafcce56428bcd1e

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
17-07-2024 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3eb08aecd009036fa0c84d4f3e5042aa62cdca8fb1df86a2cafcce56428bcd1e.exe
Size

39.2MB
MD5

3f6415c3c04aa8a428e42de41c75faea
SHA1

e59c93a362f881618813425e19f765b359d7769f
SHA256

3eb08aecd009036fa0c84d4f3e5042aa62cdca8fb1df86a2cafcce56428bcd1e
SHA512

feb74b18248f0a7923c4388c6aab3f9dff0bd07265b2135462537b44d40412c79b4de23fef3927440d978c283a99eb2e0943fd245f9ee521d88aef9f20e9da11
SSDEEP

786432:il6iTfRwFOU8ofAl2jpy2KcDxvV1yaPZ2:Af2V89l2Y2KcD1l2

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 363160.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
3792	msedge.exe
3792	msedge.exe
4440	identity_helper.exe
4440	identity_helper.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 3792	4088	3eb08aecd009036fa0c84d4f3e5042aa62cdca8fb1df86a2cafcce56428bcd1e.exe	93
PID 4088 wrote to memory of 3792	4088	3eb08aecd009036fa0c84d4f3e5042aa62cdca8fb1df86a2cafcce56428bcd1e.exe	93
PID 3792 wrote to memory of 2452	3792	msedge.exe	94
PID 3792 wrote to memory of 2452	3792	msedge.exe	94
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 1984	3792	msedge.exe	95
PID 3792 wrote to memory of 4468	3792	msedge.exe	96
PID 3792 wrote to memory of 4468	3792	msedge.exe	96
PID 3792 wrote to memory of 228	3792	msedge.exe	97
PID 3792 wrote to memory of 228	3792	msedge.exe	97
PID 3792 wrote to memory of 228	3792	msedge.exe	97
PID 3792 wrote to memory of 228	3792	msedge.exe	97
PID 3792 wrote to memory of 228	3792	msedge.exe	97
PID 3792 wrote to memory of 228	3792	msedge.exe	97
PID 3792 wrote to memory of 228	3792	msedge.exe	97
PID 3792 wrote to memory of 228	3792	msedge.exe	97
PID 3792 wrote to memory of 228	3792	msedge.exe	97
PID 3792 wrote to memory of 228	3792	msedge.exe	97
PID 3792 wrote to memory of 228	3792	msedge.exe	97
PID 3792 wrote to memory of 228	3792	msedge.exe	97
PID 3792 wrote to memory of 228	3792	msedge.exe	97
PID 3792 wrote to memory of 228	3792	msedge.exe	97
PID 3792 wrote to memory of 228	3792	msedge.exe	97
PID 3792 wrote to memory of 228	3792	msedge.exe	97
PID 3792 wrote to memory of 228	3792	msedge.exe	97
PID 3792 wrote to memory of 228	3792	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\3eb08aecd009036fa0c84d4f3e5042aa62cdca8fb1df86a2cafcce56428bcd1e.exe
"C:\Users\Admin\AppData\Local\Temp\3eb08aecd009036fa0c84d4f3e5042aa62cdca8fb1df86a2cafcce56428bcd1e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=7.0.10&gui=true
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffb9df46f8,0x7fffb9df4708,0x7fffb9df4718
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14389200658420501494,14486463857981669561,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,14389200658420501494,14486463857981669561,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,14389200658420501494,14486463857981669561,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
    3⤵
    PID:228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14389200658420501494,14486463857981669561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:2580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14389200658420501494,14486463857981669561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14389200658420501494,14486463857981669561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
    3⤵
    PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14389200658420501494,14486463857981669561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,14389200658420501494,14486463857981669561,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5020 /prefetch:8
    3⤵
    PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,14389200658420501494,14486463857981669561,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5644 /prefetch:8
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14389200658420501494,14486463857981669561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,14389200658420501494,14486463857981669561,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 /prefetch:8
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,14389200658420501494,14486463857981669561,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14389200658420501494,14486463857981669561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14389200658420501494,14486463857981669561,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14389200658420501494,14486463857981669561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
    3⤵
    PID:4004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14389200658420501494,14486463857981669561,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
    3⤵
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14389200658420501494,14486463857981669561,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3100 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2f842025e22e522658c640cfc7edc529

SHA1
4c2b24b02709acdd159f1b9bbeb396e52af27033

SHA256
1191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e

SHA512
6e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54aadd2d8ec66e446f1edb466b99ba8d

SHA1
a94f02b035dc918d8d9a46e6886413f15be5bff0

SHA256
1971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e

SHA512
7e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
224af0c578934d17a602b4d99056a3e5

SHA1
1009bfe964cf169ac5c33368b672356cba1008bc

SHA256
0d7c975ad04f702c9e7c8083f66eebcccee0fa9db5abda995b30f008d5a9c516

SHA512
ebe83e3c819e98c481a4979a181f210c3e59ae4ba66a57282e9ffc37f6ab8681732629fe2f56a65daf038b3dab93103627d7081b7ee44b6a67b2570163b66f85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
902B

MD5
575898ea150321d87c8d5f7d1a2eb2b3

SHA1
9a1c246fea865874ee13861a81e6fd4a91c132c9

SHA256
8b03849702743c4315234634390e312a7d795b7c039dff2c8d109acafa632513

SHA512
c23878648565cff5202a8f3cdcafa9ad846c3d6bc0c5bd81e511c0bbc4780887c77403cd992595fc915ffd4d792c68345241dbd99c0a6e5b0cb8f29f0cb1c949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1002B

MD5
17380a4141e4220c3506c6642ef7ed8c

SHA1
dfd324d7814acac916886e07fb62e1afc8766d5b

SHA256
9d6e1144153bd738e7cf5a69811d4a7671132986ec00a6de676c09fb946e67ca

SHA512
26143363bc8507c8c7a5f86cf4ce2a32ea151a9465bc573671481f5f7238e83dfc0820f783210846a8c3cd5aacd1682a3a67181fa7a4123a42f04e7941a97c72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a20ecf798f6045199859457f81acfe7f

SHA1
c8875bf39254fd5be0715e1bec19779594e3807b

SHA256
025150b716584bc986028a0d28b4b5f4325b0f968fe4387b01a37dcdf36b9d41

SHA512
2e99918bcd8af0089d9b4a2557bc26b45b9aee7448c62fd85172d6c815f1d07912e7d4c660845cf50ec3305a00b4beb0866d909cc12e9157800a3b41dc1c1c8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8cddc0a877d5010a103dba0b45b7939

SHA1
259ddd43b0ca6975b2a45606c2dac09d99749b2a

SHA256
a56b5fe6333196cd0e3ef386c63727dbab5cc4346ba591c63f9a4f100ee3f02a

SHA512
a8431e14a62db2303126a3f40da25e42542497ebc12711bf10db73afac2a758d9fc268eb057e9f89fe8aafd7935f6d66d3ac604dca72a9c1a7193309cf9ee648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
a1f683b105bcaa8e230944d7b7ce7be2

SHA1
0d0a9deb7f2e91393db08eb151e464dbcd24cdf8

SHA256
3f25618a97d802c2d5935f7f1a8226c085b503797610ebdd2d118d36a159c030

SHA512
12b00a450cd8a2aef89f6c9d6c0784fe8740260f70135714d7648dda810807d830a075a3234d05e2749e497d2bd940ab14e7dc353ae772eca17602f16e38e7d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
d4132cf4c712ea13c743775ada6516e2

SHA1
f84db256b25d443f73b37c9778f582a2a35a342d

SHA256
0f7b3fc843c78132c5ee95827cb6b997587a2f290bdcfc0db7d5d0a49fcd6f70

SHA512
18bdf05bd2033736e3b06cacf93d07500f77d7f0580d5779b9fa3b2b0d1208ba61770e7610e29445af21817980d03beee53b51d116dfa1625477c4619a599d60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d174.TMP

Filesize
539B

MD5
67312f275be550aa6b526a5aa89ba36b

SHA1
477a74b0f0ffe6e04c7e5b806032d885a1823f1d

SHA256
280feb55dda429fc5eaeeeeb64cfcc37b9bbc34ad0f1a0d885e67b7d15f84ac4

SHA512
fab2f238f0a9fd2c8906140f3d0c8018488231e1fa5f0e1a094e53cc7f8f8160ea95e31296bf0bc439f1006051d5c60cd225901d0d8d5f94602b038246e088f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4fc29b4cd727dd1db1fda278bb931721

SHA1
78c4546c23e2a6a7998d44f820e5e3960141605d

SHA256
ecdea281821b015019b245586e5ef146cf9a0d17fa2c8e99c91a680e3100e997

SHA512
50259204aec3423caaa3a156a8e6c53984a4e542a92893bad16201ac39b6cd7007d5f502b32c50908a75ecc6f5e66c72852511dcc30a21bf3204e5d5faffb05c

Download Submit