54fc57140f61020756f183591d8366378d62958dcf6925fb312c2f7bb17f2b4c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 03:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54fc57140f61020756f183591d8366378d62958dcf6925fb312c2f7bb17f2b4c.exe
Size

201KB
MD5

6bf932d37fcca11b7963b8253b563e07
SHA1

1b43fdf02aaae11a0c482bc0345c050be41f05fd
SHA256

54fc57140f61020756f183591d8366378d62958dcf6925fb312c2f7bb17f2b4c
SHA512

ac1750253bb7c2f22e9ab132c10338853964a92cbed52aa9fe3927a0c6812104cb95b4ab98a04c85c18070e81b16b2b078a1c13a1c4d51aba480052f65589212
SSDEEP

6144:euI1y6+a3j287ty2NV2wEY/vVhMrkxF6L4l:euIQ6n3K87ty2NV2wEY/vVhMrkxF6L4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54fc57140f61020756f183591d8366378d62958dcf6925fb312c2f7bb17f2b4c.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
4824	msedge.exe
4824	msedge.exe
1200	identity_helper.exe
1200	identity_helper.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 4824	4720	54fc57140f61020756f183591d8366378d62958dcf6925fb312c2f7bb17f2b4c.exe	93
PID 4720 wrote to memory of 4824	4720	54fc57140f61020756f183591d8366378d62958dcf6925fb312c2f7bb17f2b4c.exe	93
PID 4824 wrote to memory of 4072	4824	msedge.exe	94
PID 4824 wrote to memory of 4072	4824	msedge.exe	94
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 1188	4824	msedge.exe	95
PID 4824 wrote to memory of 3352	4824	msedge.exe	96
PID 4824 wrote to memory of 3352	4824	msedge.exe	96
PID 4824 wrote to memory of 1844	4824	msedge.exe	97
PID 4824 wrote to memory of 1844	4824	msedge.exe	97
PID 4824 wrote to memory of 1844	4824	msedge.exe	97
PID 4824 wrote to memory of 1844	4824	msedge.exe	97
PID 4824 wrote to memory of 1844	4824	msedge.exe	97
PID 4824 wrote to memory of 1844	4824	msedge.exe	97
PID 4824 wrote to memory of 1844	4824	msedge.exe	97
PID 4824 wrote to memory of 1844	4824	msedge.exe	97
PID 4824 wrote to memory of 1844	4824	msedge.exe	97
PID 4824 wrote to memory of 1844	4824	msedge.exe	97
PID 4824 wrote to memory of 1844	4824	msedge.exe	97
PID 4824 wrote to memory of 1844	4824	msedge.exe	97
PID 4824 wrote to memory of 1844	4824	msedge.exe	97
PID 4824 wrote to memory of 1844	4824	msedge.exe	97
PID 4824 wrote to memory of 1844	4824	msedge.exe	97
PID 4824 wrote to memory of 1844	4824	msedge.exe	97
PID 4824 wrote to memory of 1844	4824	msedge.exe	97
PID 4824 wrote to memory of 1844	4824	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\54fc57140f61020756f183591d8366378d62958dcf6925fb312c2f7bb17f2b4c.exe
"C:\Users\Admin\AppData\Local\Temp\54fc57140f61020756f183591d8366378d62958dcf6925fb312c2f7bb17f2b4c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=54fc57140f61020756f183591d8366378d62958dcf6925fb312c2f7bb17f2b4c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd37b346f8,0x7ffd37b34708,0x7ffd37b34718
    3⤵
    PID:4072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,10527735655512006758,13309227023607095808,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,10527735655512006758,13309227023607095808,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,10527735655512006758,13309227023607095808,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
    3⤵
    PID:1844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10527735655512006758,13309227023607095808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10527735655512006758,13309227023607095808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,10527735655512006758,13309227023607095808,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,10527735655512006758,13309227023607095808,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10527735655512006758,13309227023607095808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10527735655512006758,13309227023607095808,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
    3⤵
    PID:208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10527735655512006758,13309227023607095808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10527735655512006758,13309227023607095808,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10527735655512006758,13309227023607095808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10527735655512006758,13309227023607095808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10527735655512006758,13309227023607095808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,10527735655512006758,13309227023607095808,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2992 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=54fc57140f61020756f183591d8366378d62958dcf6925fb312c2f7bb17f2b4c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd37b346f8,0x7ffd37b34708,0x7ffd37b34718
    3⤵
    PID:2696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
4d1ba46dc0c8b42bcb51a0f85bf45a78

SHA1
d048b596c9a6dc168c506d2430a67178186b6255

SHA256
79efae91afe54561fb4e3a59c4edbaf3accbab59e0536f92ce0cf832862f14ee

SHA512
c2048789728658418701d3e24aa6c7cbaa373fd844fc4ea973fdc1e84aa0db90466a3e6ca9c2eda1015963eb70a81f0da41339a640b256e66dba609563908485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
258269bef0a88a57d3390c8d8ab6eb2f

SHA1
a72e97e219dc133131952cfd9a747a698bf450d9

SHA256
89c0af03380303cd6a3ec66842975e01e9dcfae1e47186274d41ddba65110392

SHA512
dc742414d0039d9595851277b5e37327fab1d3d7b257bbabc29c52d2961fd7651de540da129d33bcda01be7ae5bbff6e2dd374d263ba2a19b94c5b6e4ce7510a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b85ef86847781de1897c676a7da3e477

SHA1
d8a1b8b2945bf03ab395a1ff8381f03a24ccafd5

SHA256
4658f8c2078208243d7fe6faaaa8074fa2995edf1a1d6a6337aa852003d5d40e

SHA512
633ac700c60f5ce3c99aaa365f48cbc976cdb40b312acadd6fa830ea55712347402e853c76e0a4a274582e8ea027e4cb88de5075f898c768de9ee73dfa22975c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea39f4340753ca8552242a9f943b2a70

SHA1
6f188b15a310ede4817f72342ed3d7b554ca559e

SHA256
7899666550e1ca6a5b5cb062fa33bc1bca6f6a16e6444858a6374840e8a3e0bc

SHA512
466ea6997fd1da5e228d0b931f9965960b736569e7bb5c902b63d5732cc3032de615cdc27e4c3e693516cd4d83c3bfd22975d7e73560bf747e73d6083650b090

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cb29736b88aa8215fc62dfe46f3897bd

SHA1
e8f4d2772f18e780ab948d81a6785459fdb25c0e

SHA256
8f3dede98bd830a87811d6b8a6893b93ae17327e11d2899c37608a881d71414e

SHA512
2847446ff9e8e4f421bae79f4cee9da1d2c744fc6dcd2b09073398de1a21db8fd38278f8439b107c3a2576b690562de9e6af9c1614922a558e5b33c235813020

Download Submit