73ed471113aa9dd9670aaad69f6b801eb016b1017f56f2c968304a80cb053a11

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2024 18:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73ed471113aa9dd9670aaad69f6b801eb016b1017f56f2c968304a80cb053a11.exe
Size

74KB
MD5

2271975b91c7e4eb448710f10c851f84
SHA1

d5e6477e390457b80dec65a189e7f0ff961dfbb4
SHA256

73ed471113aa9dd9670aaad69f6b801eb016b1017f56f2c968304a80cb053a11
SHA512

ab77c4505b09a6b9dc7341ffa0a0b4d49142a94a3a010cd638fe41c2518c33f0234f06d540148217959672df301e6045b395bee9eb8531d16cd84202eb9c8624
SSDEEP

1536:EUUPcxVteCW7PMVgOyWIeH1bc/buLLhaQzclLVclN:EUmcxV4x7PMVLyOH1bcMLgQgBY

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
832	msedge.exe
832	msedge.exe
744	msedge.exe
744	msedge.exe
3868	identity_helper.exe
3868	identity_helper.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 744	3076	73ed471113aa9dd9670aaad69f6b801eb016b1017f56f2c968304a80cb053a11.exe	93
PID 3076 wrote to memory of 744	3076	73ed471113aa9dd9670aaad69f6b801eb016b1017f56f2c968304a80cb053a11.exe	93
PID 744 wrote to memory of 1132	744	msedge.exe	94
PID 744 wrote to memory of 1132	744	msedge.exe	94
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 972	744	msedge.exe	95
PID 744 wrote to memory of 832	744	msedge.exe	96
PID 744 wrote to memory of 832	744	msedge.exe	96
PID 744 wrote to memory of 3744	744	msedge.exe	97
PID 744 wrote to memory of 3744	744	msedge.exe	97
PID 744 wrote to memory of 3744	744	msedge.exe	97
PID 744 wrote to memory of 3744	744	msedge.exe	97
PID 744 wrote to memory of 3744	744	msedge.exe	97
PID 744 wrote to memory of 3744	744	msedge.exe	97
PID 744 wrote to memory of 3744	744	msedge.exe	97
PID 744 wrote to memory of 3744	744	msedge.exe	97
PID 744 wrote to memory of 3744	744	msedge.exe	97
PID 744 wrote to memory of 3744	744	msedge.exe	97
PID 744 wrote to memory of 3744	744	msedge.exe	97
PID 744 wrote to memory of 3744	744	msedge.exe	97
PID 744 wrote to memory of 3744	744	msedge.exe	97
PID 744 wrote to memory of 3744	744	msedge.exe	97
PID 744 wrote to memory of 3744	744	msedge.exe	97
PID 744 wrote to memory of 3744	744	msedge.exe	97
PID 744 wrote to memory of 3744	744	msedge.exe	97
PID 744 wrote to memory of 3744	744	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\73ed471113aa9dd9670aaad69f6b801eb016b1017f56f2c968304a80cb053a11.exe
"C:\Users\Admin\AppData\Local\Temp\73ed471113aa9dd9670aaad69f6b801eb016b1017f56f2c968304a80cb053a11.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=73ed471113aa9dd9670aaad69f6b801eb016b1017f56f2c968304a80cb053a11.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffba3cb46f8,0x7ffba3cb4708,0x7ffba3cb4718
    3⤵
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5820992305440116748,11470281347432402084,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,5820992305440116748,11470281347432402084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,5820992305440116748,11470281347432402084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
    3⤵
    PID:3744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5820992305440116748,11470281347432402084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5820992305440116748,11470281347432402084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5820992305440116748,11470281347432402084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
    3⤵
    PID:456
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5820992305440116748,11470281347432402084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5820992305440116748,11470281347432402084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5820992305440116748,11470281347432402084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
    3⤵
    PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5820992305440116748,11470281347432402084,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5820992305440116748,11470281347432402084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5820992305440116748,11470281347432402084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5820992305440116748,11470281347432402084,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
    3⤵
    PID:1156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5820992305440116748,11470281347432402084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5820992305440116748,11470281347432402084,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2736 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=73ed471113aa9dd9670aaad69f6b801eb016b1017f56f2c968304a80cb053a11.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba3cb46f8,0x7ffba3cb4708,0x7ffba3cb4718
    3⤵
    PID:3908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
24d1b42042d03377b89773e886a2163d

SHA1
59c38d78bcff2b3d1a7040177b039019e9bdb903

SHA256
f557a518d6a8882ae162d26f784835b619a64ce2dbf489fcb5f10bb946edc7ae

SHA512
c0f33629fa2169d75e77d5813a7704de7253e1c4462c29f42eda7b11f3e0706133386c4a790965c928591a27a3e5d6bc36040f28cc7a14552e2874000002dd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bca0d522bf7c1693c99f4ed89bb4ea98

SHA1
a3fab083600933869f5e5e78f44950666f0f6616

SHA256
e948fa9e7b8f5ba6cca5df5a87cd0bc298ee876d4e7a7774f9caa9bcadcd8af0

SHA512
3f1298e31f1eb04295d447f31b216ece4e2a775b77d269681d58bc58d1ad63ffd5a76ebde69d423f045194865a8c8a21753eb17eaf07cab3a05f117312d3b71a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b6cdc56e04841d5dbfd7fc0e233d6f28

SHA1
a07efe2a985f494efe39fe0a8b009a3a45b674cb

SHA256
c3a615b5fc7f80fc46cf14a7a71db6dd312218b729a265c2b3d51e7fd2920b46

SHA512
f239213ace53d567ed8653a7ba7d9e6f0711e5b730b8ef09e6765e0086202326911f1698b79c81f4fc8e12865e2a456e3fbf89347efdebb88e7499518eb419a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d1889bfb55d47282e76819ee8ee8f28e

SHA1
e94d0b4dbbcf39fd0dce0da880098bc5a9bd3f38

SHA256
f04f80141e711179b1e8b8b0d934e703061fd5f035aabb7b8c3d12a30e711157

SHA512
bb7fcb67e6f4df55200414c168e2f4ad9030a9cb8acdb381db626972c8be68262c3fc27c6793471e285a455effacddf094d50da9c2ff7cc91655c5c315b32c83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
367B

MD5
e0c9eaf9bb8d65c685746637faf5a872

SHA1
47a025f9ac8317562028a0fc3e27baddbe6ad62f

SHA256
307fbfee5a2dd30643b5b76f1283cef2d30fde22675b816fffc6200495a0868e

SHA512
78d1b4b0004abd1612097a1b133c61f2373c9297b2e7349de79ed8d61e13b230f851fdb220b6dac7728b7f0e6e162adf016786e0e6081174334496207a8eb602

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f608.TMP

Filesize
367B

MD5
928f3f00d45434e7bf1143e91d367876

SHA1
d22cc3f1cf3bba1bd578f04f45522f0bf7e47d79

SHA256
b3bd935b356e491d536a514bf0a4f46ceb87ac2198d1848718608287c69c0512

SHA512
4e0e43bee65d0f7a1937e1288454f1e18eafa0f92e6f87d467093745b019fce6ffbd7604b9aebe96564b1566146b1c7b343e9f1e369aab77969892fab88b5edb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
60025cf624f4d630b00ddac03546a056

SHA1
7ab3ebeb674d10b8d4c77348c9cf221908dea3cb

SHA256
a194a713f15c91f337c7aa10f14e724db95b3287335e64bd4379d546a2203290

SHA512
55ecdefb59477c7ee44ccf4927ef49d2121ea6bd60f35cc7c1011a6016e400cd35120a0c0bce476e4f5e557f83bef33bf0c3408e0d850858765a82ccdddfa621

Download Submit