54fc57140f61020756f183591d8366378d62958dcf6925fb312c2f7bb17f2b4c

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2024 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7EE182A4E061B93EAA096B87B0914D115F5C49D2812A6C81C62A836892ADC359.exe
Size

201KB
MD5

6bf932d37fcca11b7963b8253b563e07
SHA1

1b43fdf02aaae11a0c482bc0345c050be41f05fd
SHA256

54fc57140f61020756f183591d8366378d62958dcf6925fb312c2f7bb17f2b4c
SHA512

ac1750253bb7c2f22e9ab132c10338853964a92cbed52aa9fe3927a0c6812104cb95b4ab98a04c85c18070e81b16b2b078a1c13a1c4d51aba480052f65589212
SSDEEP

6144:euI1y6+a3j287ty2NV2wEY/vVhMrkxF6L4l:euIQ6n3K87ty2NV2wEY/vVhMrkxF6L4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7EE182A4E061B93EAA096B87B0914D115F5C49D2812A6C81C62A836892ADC359.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
3316	msedge.exe
3316	msedge.exe
4196	identity_helper.exe
4196	identity_helper.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 3316	3908	7EE182A4E061B93EAA096B87B0914D115F5C49D2812A6C81C62A836892ADC359.exe	88
PID 3908 wrote to memory of 3316	3908	7EE182A4E061B93EAA096B87B0914D115F5C49D2812A6C81C62A836892ADC359.exe	88
PID 3316 wrote to memory of 812	3316	msedge.exe	89
PID 3316 wrote to memory of 812	3316	msedge.exe	89
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 1932	3316	msedge.exe	90
PID 3316 wrote to memory of 3380	3316	msedge.exe	91
PID 3316 wrote to memory of 3380	3316	msedge.exe	91
PID 3316 wrote to memory of 2060	3316	msedge.exe	92
PID 3316 wrote to memory of 2060	3316	msedge.exe	92
PID 3316 wrote to memory of 2060	3316	msedge.exe	92
PID 3316 wrote to memory of 2060	3316	msedge.exe	92
PID 3316 wrote to memory of 2060	3316	msedge.exe	92
PID 3316 wrote to memory of 2060	3316	msedge.exe	92
PID 3316 wrote to memory of 2060	3316	msedge.exe	92
PID 3316 wrote to memory of 2060	3316	msedge.exe	92
PID 3316 wrote to memory of 2060	3316	msedge.exe	92
PID 3316 wrote to memory of 2060	3316	msedge.exe	92
PID 3316 wrote to memory of 2060	3316	msedge.exe	92
PID 3316 wrote to memory of 2060	3316	msedge.exe	92
PID 3316 wrote to memory of 2060	3316	msedge.exe	92
PID 3316 wrote to memory of 2060	3316	msedge.exe	92
PID 3316 wrote to memory of 2060	3316	msedge.exe	92
PID 3316 wrote to memory of 2060	3316	msedge.exe	92
PID 3316 wrote to memory of 2060	3316	msedge.exe	92
PID 3316 wrote to memory of 2060	3316	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\7EE182A4E061B93EAA096B87B0914D115F5C49D2812A6C81C62A836892ADC359.exe
"C:\Users\Admin\AppData\Local\Temp\7EE182A4E061B93EAA096B87B0914D115F5C49D2812A6C81C62A836892ADC359.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7EE182A4E061B93EAA096B87B0914D115F5C49D2812A6C81C62A836892ADC359.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf4f646f8,0x7ffaf4f64708,0x7ffaf4f64718
    3⤵
    PID:812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,7988034270867020748,17425198632546656888,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:1932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,7988034270867020748,17425198632546656888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,7988034270867020748,17425198632546656888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
    3⤵
    PID:2060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7988034270867020748,17425198632546656888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7988034270867020748,17425198632546656888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:2092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7988034270867020748,17425198632546656888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,7988034270867020748,17425198632546656888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,7988034270867020748,17425198632546656888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7988034270867020748,17425198632546656888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
    3⤵
    PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7988034270867020748,17425198632546656888,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7988034270867020748,17425198632546656888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7988034270867020748,17425198632546656888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7988034270867020748,17425198632546656888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7988034270867020748,17425198632546656888,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,7988034270867020748,17425198632546656888,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5668 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7EE182A4E061B93EAA096B87B0914D115F5C49D2812A6C81C62A836892ADC359.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffaf4f646f8,0x7ffaf4f64708,0x7ffaf4f64718
    3⤵
    PID:4772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
85449567650f19e2f6f2241cf417dd10

SHA1
9ce0fa92e03dc002893e0b651ea2265e51f5f995

SHA256
095c9c5641411e89a3cba92922ef33246c635d71a3460f0304ff1988f5de8138

SHA512
b65f2d0d8e53b1eed996e868efb646638d2863bfcd4e4ab0ff54c34d048d836a2689cad37122c9b84fa44f38f85c67e3aeae55d9ff3476e26ef5715884645ba7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ff7903db94fbcd17494f4d0ed26ff993

SHA1
bafa5c32a9b68bf9737c1322c496c1e521a00e71

SHA256
d958c0e1055b43d01bb66594c5ab4b3cd381522b50874f16c9cb6a497140e717

SHA512
1132f8ebe5c2c82eddb51ea95a8d9234883a56851bf3e9701dbcf9aca67c1bb8f0d9225867395818a75c0890874e2211a23549c4c8f320f44ad8451eda47a548

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2ffa609f219ec871313a119b3e6794bf

SHA1
9265e6c1ce34b2312ecdd419be2ffdc0e4d2b2d6

SHA256
694d74107f52a9d022d96193fd21c95ff229684bc7956cec02c15e9a0f45656e

SHA512
1c0a799ec0afad21dde972dd9091c5fc24d2da5c3c07ee7930766af0da623f5f957e3a1e2c33866ea22e95318e5f50d49c11cbd7686928038431c4bf99431b8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
22679518573250ccbf0c9622fd20c2d3

SHA1
7068eb5fa17cee9704af69b062cbe5a9fa5a1f99

SHA256
0f973a28a18fd72639e643316d90694e0c1109ed1b4da708e20c67e609bb19a2

SHA512
064c5d7a219734cc0ac78b23f0c961bf5e09f485faf502c274fccd4082f20e6cebea79e738ddca39dd36b3a229c259ad599a64eb23e4216059f3ed97c0fa440d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
60ffd99b573851ce4ab83ba71650dcd4

SHA1
5f5ceb305675530a537e3d5d40d8d4eb525b94cd

SHA256
654cb8b2bedec363d8fd0196eb1d99fd5ced19cef2eeed5713de67a116ee1a21

SHA512
4be86ffec5c52798447859d25110696cec87cd1abf792b9f36490d623e5e5ca11d5fb3d45017579cbd37c65a659e44e6a0388165b46d71f6de2c1a7948721094

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58049f.TMP

Filesize
371B

MD5
46ff3d5a876f06ec7424050657e898ab

SHA1
cb5c77f4022923303c709fe8a49b2092a2a3e31f

SHA256
75b7880a438be7da1c8c223dfac83f7baa37e2cb81db181e3e308de1789b8629

SHA512
e8e5a4116dea85e51e531719aa05235cf77d7d5f6733c3162124cbef2be982cb69ed2f9a16be5ff91fc1a3d4e01431d653bf2ccbd298a099e5fe1ada1f91f664

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0415fbae59a238458c1a396f886070b0

SHA1
bdd962c99ea718f9bd14970a9ddfaefb99d4f0ab

SHA256
71c10023eb9ab4cf2f141c9e1a9453bdc5308ed91058b2435e3b289267b6cc96

SHA512
5321280d6e8cb9d500c410468036632deeb07d6c44dc47c7ce67a1cd1ff9e8f23ce365f8c508fe91ff6f70e4beffac8639528fd4ca6430c6dca386a36b4af5af

Download Submit