629ef96921c67d7102df6138b3085ff4dca0ae1796cc755752bd0ce876b36ac0

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2024 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

629ef96921c67d7102df6138b3085ff4dca0ae1796cc755752bd0ce876b36ac0.exe
Size

5.9MB
MD5

7e53c0fe2ceecaef94bd317c526d3f09
SHA1

70fee9a15a7507e6cb723424258755426afe3247
SHA256

629ef96921c67d7102df6138b3085ff4dca0ae1796cc755752bd0ce876b36ac0
SHA512

fab95cf71276fd9f08db1ed5542bff2bb073655a1d785ddefa36cd87a32ac2ac71974a7c26bd24dda0897c52caeccc93dcd29e4883de223afa79b7b59d34bfaf
SSDEEP

12288:EKkAmLeYTYzVdduG802/z2KFWKkAmLeYTYzuvx:JZBdduG8fLZip

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3588	msedge.exe
3588	msedge.exe
2408	msedge.exe
2408	msedge.exe
3120	identity_helper.exe
3120	identity_helper.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 2408	4672	629ef96921c67d7102df6138b3085ff4dca0ae1796cc755752bd0ce876b36ac0.exe	88
PID 4672 wrote to memory of 2408	4672	629ef96921c67d7102df6138b3085ff4dca0ae1796cc755752bd0ce876b36ac0.exe	88
PID 2408 wrote to memory of 4256	2408	msedge.exe	89
PID 2408 wrote to memory of 4256	2408	msedge.exe	89
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3220	2408	msedge.exe	90
PID 2408 wrote to memory of 3588	2408	msedge.exe	91
PID 2408 wrote to memory of 3588	2408	msedge.exe	91
PID 2408 wrote to memory of 3224	2408	msedge.exe	92
PID 2408 wrote to memory of 3224	2408	msedge.exe	92
PID 2408 wrote to memory of 3224	2408	msedge.exe	92
PID 2408 wrote to memory of 3224	2408	msedge.exe	92
PID 2408 wrote to memory of 3224	2408	msedge.exe	92
PID 2408 wrote to memory of 3224	2408	msedge.exe	92
PID 2408 wrote to memory of 3224	2408	msedge.exe	92
PID 2408 wrote to memory of 3224	2408	msedge.exe	92
PID 2408 wrote to memory of 3224	2408	msedge.exe	92
PID 2408 wrote to memory of 3224	2408	msedge.exe	92
PID 2408 wrote to memory of 3224	2408	msedge.exe	92
PID 2408 wrote to memory of 3224	2408	msedge.exe	92
PID 2408 wrote to memory of 3224	2408	msedge.exe	92
PID 2408 wrote to memory of 3224	2408	msedge.exe	92
PID 2408 wrote to memory of 3224	2408	msedge.exe	92
PID 2408 wrote to memory of 3224	2408	msedge.exe	92
PID 2408 wrote to memory of 3224	2408	msedge.exe	92
PID 2408 wrote to memory of 3224	2408	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\629ef96921c67d7102df6138b3085ff4dca0ae1796cc755752bd0ce876b36ac0.exe
"C:\Users\Admin\AppData\Local\Temp\629ef96921c67d7102df6138b3085ff4dca0ae1796cc755752bd0ce876b36ac0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=629ef96921c67d7102df6138b3085ff4dca0ae1796cc755752bd0ce876b36ac0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd538046f8,0x7ffd53804708,0x7ffd53804718
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,10863187511974508969,17865202852472052273,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:3220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,10863187511974508969,17865202852472052273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,10863187511974508969,17865202852472052273,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10863187511974508969,17865202852472052273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10863187511974508969,17865202852472052273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10863187511974508969,17865202852472052273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
    3⤵
    PID:796
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,10863187511974508969,17865202852472052273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
    3⤵
    PID:312
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,10863187511974508969,17865202852472052273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10863187511974508969,17865202852472052273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10863187511974508969,17865202852472052273,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
    3⤵
    PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10863187511974508969,17865202852472052273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
    3⤵
    PID:440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10863187511974508969,17865202852472052273,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10863187511974508969,17865202852472052273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
    3⤵
    PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10863187511974508969,17865202852472052273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
    3⤵
    PID:316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,10863187511974508969,17865202852472052273,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4964 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=629ef96921c67d7102df6138b3085ff4dca0ae1796cc755752bd0ce876b36ac0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd538046f8,0x7ffd53804708,0x7ffd53804718
    3⤵
    PID:4572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
7a3bd400c755b8f2f2252e9c64af4083

SHA1
d977cce4aff29ba5809562b6657de23efa27e3f6

SHA256
49a82ec2c0632a88f6b9f5d3c081c5bfd4551a041255c1cf88efb913d2247dac

SHA512
6455a83cb68836844e5576193912b19472b63a7b5f6ab73422b36ec0633768c614d49d361549b9ce420f2c0a948c405a46ad87a5309e87c8deb2b2ce3410474c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
207f39531ee5c97038d81d41ef245926

SHA1
fd1e263943e94156a7b1b720bc5b602b382b5872

SHA256
51f4b6681f421bcf59e7545f1ac9a4687f60ddc63df214558359474167682dc2

SHA512
c5f87fb0294bfb4d9b3cd68e14b0534e92daac8ddd1c0e7c3529d58793ee978f3ba7dd7639f7a12facb5f2ab19e9c2b006f157f4f1593a0a2ccadc41c5951f55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e2005e8267edec13ed503cbab3bc2791

SHA1
dd9b10a89451826cd8ad3deb0f69a00cfd6d10f6

SHA256
f8c7a498a75f798ec34fd22cb62bc0dd3b456fb2e5c7fe22883e20a78075448b

SHA512
58cfae779586432b9912d1d33673fc16e53f801dbe4f7660bae98bc9238364264b70d806c6d7d9aec7276c2a7b683c7cb14907b301c311d804fe65ce3fae0443

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
92945d25c25b834dc67a1e155737cef9

SHA1
d7a756b5a04f6e5d0631d22933b436910da71e61

SHA256
fdbf4511fdc47a0f868063e7788eae013eba85fa1d2427c61291f0cc6b3f9686

SHA512
876ef502f18ac5a45cbac9da982c5a025de8538ea7cfe6f701453afb63f3507672a1d6b4b1a2b8a766d3d070a06d7adc964a2824644a36f3002f97e28241d81e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5831aa.TMP

Filesize
371B

MD5
290a17b9489304f41f1c0cc456041460

SHA1
8b4b44d1cf83f5776a06c1532f15fdd8f53ee554

SHA256
38d425a0f8c1709fa16c7e5677d5a08e1f5c59ef0a0e54ef908535151aa4ab14

SHA512
484a0a384c37ad0b48e5aa1774a8849283815118a9780d3e0f43767272d7484c8daf617bcc3bafcedce268e3cae3327d6c5cfccdf526b1c437936f484336660c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dbe15890-484d-43e0-aca9-753ed56f7f0f.tmp

Filesize
369B

MD5
cfea376d770b9721f2f9d9e8edbf81c7

SHA1
44a1c91415bba3d7f8eb681670fefac9348b4d57

SHA256
75d29c42fbb4843780ec46f6299fee4afcb5cc8fbb85aa99d6566dbed37bc5f0

SHA512
9419455216ceba771c34c91229189e110f936d20bf55b296d033cc4bece986bc3b9f8e6f8e1b1c366e38aed81da1b13dd047ae71aabc772b1e76b5f1292c42bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6765c9180b62d0d302ec9adcaf149a62

SHA1
46e6bfd6cd7296021c72f5256603d3252d639d94

SHA256
2b13c4b2a55d88f1fa52596bbb9621ef2016f63163d45148cecffc127a649425

SHA512
44e6831c0c3062ff266138d07ab715f8d4bc91abbd7827c1ce122af4562fe36aa27c758f73b7e45f88822ff046a1ad2282b5d3b07f6c23976d6cfff252f39b57

Download Submit