304ef59f776d719daedc7d19c1c50713f90a8e92050d57456d30d1ce73ec126a

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2024 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

304ef59f776d719daedc7d19c1c50713f90a8e92050d57456d30d1ce73ec126a.exe
Size

233KB
MD5

419884a79a8c293429a14a0613c0ce62
SHA1

698f2c221fac46ef0215123cdf76261442e8563c
SHA256

304ef59f776d719daedc7d19c1c50713f90a8e92050d57456d30d1ce73ec126a
SHA512

bab6af7185cb37e34f7195333204a5f81d268bccb7e24f91c27f7a9188f8e1c817d770726daeb1591549bf5b7d33c3a7e50ba6f82cdc536a14e53864754bf7e9
SSDEEP

3072:mW1X0w8AUsM8ciO0dQh5dBw0GbO5WOEEAM5:r1X0w8AUsSiO0g5dBw0GbsES

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	304ef59f776d719daedc7d19c1c50713f90a8e92050d57456d30d1ce73ec126a.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3076	msedge.exe
3076	msedge.exe
4192	msedge.exe
4192	msedge.exe
4752	identity_helper.exe
4752	identity_helper.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 4192	3120	304ef59f776d719daedc7d19c1c50713f90a8e92050d57456d30d1ce73ec126a.exe	86
PID 3120 wrote to memory of 4192	3120	304ef59f776d719daedc7d19c1c50713f90a8e92050d57456d30d1ce73ec126a.exe	86
PID 4192 wrote to memory of 1552	4192	msedge.exe	87
PID 4192 wrote to memory of 1552	4192	msedge.exe	87
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 1624	4192	msedge.exe	88
PID 4192 wrote to memory of 3076	4192	msedge.exe	89
PID 4192 wrote to memory of 3076	4192	msedge.exe	89
PID 4192 wrote to memory of 1984	4192	msedge.exe	90
PID 4192 wrote to memory of 1984	4192	msedge.exe	90
PID 4192 wrote to memory of 1984	4192	msedge.exe	90
PID 4192 wrote to memory of 1984	4192	msedge.exe	90
PID 4192 wrote to memory of 1984	4192	msedge.exe	90
PID 4192 wrote to memory of 1984	4192	msedge.exe	90
PID 4192 wrote to memory of 1984	4192	msedge.exe	90
PID 4192 wrote to memory of 1984	4192	msedge.exe	90
PID 4192 wrote to memory of 1984	4192	msedge.exe	90
PID 4192 wrote to memory of 1984	4192	msedge.exe	90
PID 4192 wrote to memory of 1984	4192	msedge.exe	90
PID 4192 wrote to memory of 1984	4192	msedge.exe	90
PID 4192 wrote to memory of 1984	4192	msedge.exe	90
PID 4192 wrote to memory of 1984	4192	msedge.exe	90
PID 4192 wrote to memory of 1984	4192	msedge.exe	90
PID 4192 wrote to memory of 1984	4192	msedge.exe	90
PID 4192 wrote to memory of 1984	4192	msedge.exe	90
PID 4192 wrote to memory of 1984	4192	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\304ef59f776d719daedc7d19c1c50713f90a8e92050d57456d30d1ce73ec126a.exe
"C:\Users\Admin\AppData\Local\Temp\304ef59f776d719daedc7d19c1c50713f90a8e92050d57456d30d1ce73ec126a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=304ef59f776d719daedc7d19c1c50713f90a8e92050d57456d30d1ce73ec126a.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff88a6b46f8,0x7ff88a6b4708,0x7ff88a6b4718
    3⤵
    PID:1552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9717778289469396126,6346951518451559600,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,9717778289469396126,6346951518451559600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,9717778289469396126,6346951518451559600,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9717778289469396126,6346951518451559600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9717778289469396126,6346951518451559600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9717778289469396126,6346951518451559600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9717778289469396126,6346951518451559600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9717778289469396126,6346951518451559600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=164 /prefetch:1
    3⤵
    PID:2772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9717778289469396126,6346951518451559600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9717778289469396126,6346951518451559600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9717778289469396126,6346951518451559600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
    3⤵
    PID:4352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9717778289469396126,6346951518451559600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9717778289469396126,6346951518451559600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9717778289469396126,6346951518451559600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9717778289469396126,6346951518451559600,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=304ef59f776d719daedc7d19c1c50713f90a8e92050d57456d30d1ce73ec126a.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff88a6b46f8,0x7ff88a6b4708,0x7ff88a6b4718
    3⤵
    PID:2972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
b9f987bd8eb7d5c85abdfc0dc7899041

SHA1
49d8e0807482cc308f8cc10ccde4f04573d9c85c

SHA256
191ace1e9580d1777a243a48e5e8b4fb76ffc1ad1823700ea22946f075904252

SHA512
d018fe74d45a7aed7a66d3546eecd3b63e3ad61a9dc920cb29fd146946593fbf93ec1c7b2f24cb25d752f34dbd6aabea1663f1434413c8770f12474bec4f870c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
88a72c71e9abc52a88dbf459e07f274d

SHA1
09e22baeb2a83878587698aeb1ceff7722bc8f30

SHA256
db3bd43509b5365df37824ee4475bcf045a2b6ef93d83663987b2a0fdb0da3d1

SHA512
902ac00a71074eab2d64868d7f5d4f0bee8110dc1f404ba61347b6c785cc67a497514a063e71213c17078da13721a0ede6e753293a99df788f9c073797d3a86a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cbb63da52aa4b24ff43e1807807c54a9

SHA1
0f393a2e68fec3ce48dfcb8ba9a47f25fbc53984

SHA256
6f043adc7ee43cfc128254875a9931e3985a65348cff6c34b21a4f349497ceac

SHA512
a5bc75e1775be9319664ec5b7c450de776a6adc1400173682cc45c63a06147d0f7629327a09b96f2de82385feb485af01ae0a5460dc9914fb681b4af698b7235

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
162608f31bba0dcd28b043be1c4bc066

SHA1
780fd3e873035e4ed9069f361108a8f61b225e4a

SHA256
f9c1613825768b7533448895bb62881f152b5f4d994737f393ab0a662e9f6c3f

SHA512
e55c7cc9fedd13f6952bb861871de4513fa4625e070a1a4cf6606cc767415bfefe195a7c665cb31afb88d98177e7fceb3928de2f77b65609ddca5d508c3e0544

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
eeef5569cd3b02b1d4f49e8eeab020da

SHA1
25e9a58d77a65fe1ac4118f9249efc006d2ec898

SHA256
7979bf9d8e51952abe6085a31b00281b047171dc4a2e4a2c29a060e00f883a27

SHA512
c16f0fc8d0390c189672f19aa9eb66ef587cf141ac7f4613a0e4707ba16ad175a6d4af8cbf70d600e662265526b66018ce08dfc09113e5fa02f5b720b59164a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
e19a555a818586efd9d5a06c92d459b1

SHA1
65da3440ab4e49aaa3b6d9e4aa562ade07fb481a

SHA256
d9ad1a3d3221a0f6ae89321540cec5f3a9ea29ab22f4bdc4fec8824e36440970

SHA512
b0914ed9b386310676010ffc1bc08b96f4baff2b87d7150f78d3383ebf175ba24893cd337682aa594837c1f4683179c96643ae769f0e55b4329928e2fcf44acd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585aae.TMP

Filesize
203B

MD5
c08e5f6485906705418fbf7d403cd8fc

SHA1
b64d2e86d36d065ee823061addc9f5e75ce96719

SHA256
934af3b7c4b61cf268b5efb5d2ed17ce514d460dc249abac652aab8be419c644

SHA512
2dd63f6e6796e06dc626294d678491baa7bdf8b7aa43859975787ba6cf7cc932f5a0e65c32cf3816a2e244bfe2edf91f1138848a31fa72b602af1a9d92959735

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4b22246f1f8a3f37e94214139fa85143

SHA1
5bd4391fc075bf8c4779322a2f0ca3ad930dbf81

SHA256
8253cefa719965ab17ed40bfb01be24c63d7fbc24b0e37463da7b0be4bf2c33b

SHA512
7765adba5f4d8d83557f1d0462710d94538278b442346882abdcc2ba1db08551676aaf723916d3f41fab5cd20a5cd13e9837e3b0b495c481aa85d71c726521b7

Download Submit