fc2b9ddbc47cc3014c2f42b11d85aa35ac2b077f5be3dfb8dacde81d7320d360

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-08-2024 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-26_6a9106d26544e77f95d9ee01f924626f_avoslocker.exe
Size

20.2MB
MD5

6a9106d26544e77f95d9ee01f924626f
SHA1

eeb603878c623bd1e39fefa216c9ee4f4916dea1
SHA256

fc2b9ddbc47cc3014c2f42b11d85aa35ac2b077f5be3dfb8dacde81d7320d360
SHA512

59e49602c0ac0252b8d2a2f93f5047ade18555d690b5c8bee58b34b86b7f24d37508e94cdf10b53997a5d1635ad873f90e5ccb3f870464c16f29437681132880
SSDEEP

98304:VhmhO/0f2tgOhUhWhmhO/0f2tgOhkhmhO/0f2tgOhUhmhWhmhO/0f2tgOhUhWhm9:h5KOR5KO+5KOi5KOR5KO+5KOb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-26_6a9106d26544e77f95d9ee01f924626f_avoslocker.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe
2240	msedge.exe
2240	msedge.exe
4884	identity_helper.exe
4884	identity_helper.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 2240	3872	2024-08-26_6a9106d26544e77f95d9ee01f924626f_avoslocker.exe	93
PID 3872 wrote to memory of 2240	3872	2024-08-26_6a9106d26544e77f95d9ee01f924626f_avoslocker.exe	93
PID 2240 wrote to memory of 3612	2240	msedge.exe	94
PID 2240 wrote to memory of 3612	2240	msedge.exe	94
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2684	2240	msedge.exe	95
PID 2240 wrote to memory of 2520	2240	msedge.exe	96
PID 2240 wrote to memory of 2520	2240	msedge.exe	96
PID 2240 wrote to memory of 4276	2240	msedge.exe	97
PID 2240 wrote to memory of 4276	2240	msedge.exe	97
PID 2240 wrote to memory of 4276	2240	msedge.exe	97
PID 2240 wrote to memory of 4276	2240	msedge.exe	97
PID 2240 wrote to memory of 4276	2240	msedge.exe	97
PID 2240 wrote to memory of 4276	2240	msedge.exe	97
PID 2240 wrote to memory of 4276	2240	msedge.exe	97
PID 2240 wrote to memory of 4276	2240	msedge.exe	97
PID 2240 wrote to memory of 4276	2240	msedge.exe	97
PID 2240 wrote to memory of 4276	2240	msedge.exe	97
PID 2240 wrote to memory of 4276	2240	msedge.exe	97
PID 2240 wrote to memory of 4276	2240	msedge.exe	97
PID 2240 wrote to memory of 4276	2240	msedge.exe	97
PID 2240 wrote to memory of 4276	2240	msedge.exe	97
PID 2240 wrote to memory of 4276	2240	msedge.exe	97
PID 2240 wrote to memory of 4276	2240	msedge.exe	97
PID 2240 wrote to memory of 4276	2240	msedge.exe	97
PID 2240 wrote to memory of 4276	2240	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\2024-08-26_6a9106d26544e77f95d9ee01f924626f_avoslocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-26_6a9106d26544e77f95d9ee01f924626f_avoslocker.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2024-08-26_6a9106d26544e77f95d9ee01f924626f_avoslocker.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7fff137746f8,0x7fff13774708,0x7fff13774718
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,14733409944534125307,5475296978697538930,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
    3⤵
    PID:2684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,14733409944534125307,5475296978697538930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,14733409944534125307,5475296978697538930,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14733409944534125307,5475296978697538930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14733409944534125307,5475296978697538930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14733409944534125307,5475296978697538930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,14733409944534125307,5475296978697538930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,14733409944534125307,5475296978697538930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14733409944534125307,5475296978697538930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
    3⤵
    PID:3136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14733409944534125307,5475296978697538930,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14733409944534125307,5475296978697538930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14733409944534125307,5475296978697538930,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14733409944534125307,5475296978697538930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
    3⤵
    PID:1556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14733409944534125307,5475296978697538930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,14733409944534125307,5475296978697538930,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2024-08-26_6a9106d26544e77f95d9ee01f924626f_avoslocker.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff137746f8,0x7fff13774708,0x7fff13774718
    3⤵
    PID:2884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
c0efada83267ad756c7738a8d194e1e7

SHA1
0678d220186086bbb12a2c872ff1d6aaad735e74

SHA256
08a7ff9c603c3c0ec8908f1f9a8005b3bfe1514f6c29401748204e200e2b3012

SHA512
8d43bf1f6439cf2e9f296b0a6a9c44928d64c36c9e743ad79fe7447463dfccabc20055c428db9f17090868562aa4938c41436c4ade23a837c1bb5267b4ac5d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7c1f529d6de9be218825634fcde60308

SHA1
84e500ab5186aed38190d261f5ab61c536061155

SHA256
0e9fefa0b5a90d37e199c02161f5d516ff211cd552972b0abf1ed5bbbb4daa68

SHA512
b48afd96a177eeb4b4d32ac532e536aa7206062c8ac524ec2f54da43b072ee5ee614afaafaa6cbfc6eede15b2446ad7ab5db6d35e73b82895d16f652c4bebeb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f5690d6cae3ca74e4733b5ec0656708

SHA1
cbc99edef8cedc01719b11489414fa59d1dc5ac3

SHA256
7ef1015fc48c59eee9c20273592265caa986c3be61f53b0731ac738d0926f9fb

SHA512
b1dbe4f01e16b86f866ff1639188088b32d967438844f0623e20906881dd59a56560fdca0f184eb34631433a8da8b1ea7f350632cbddd8d15e9cf1c8d2b85b5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a15d4f6c4d725eeea48728e2dd35aa85

SHA1
68c83a92ed01f93e74c64939a192781d8d93d3b8

SHA256
3c472b91f6f3a173756f28361781d66845c56d23f72252798b43265769aa63e5

SHA512
4765fe49612044c194c822b6402d4643aadd5955449a2cad1338b5a57ae706b08589aa5e11fb13f6f74aebbec52b0f52a8995d49584e86b408bf74e6daea1364

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
4edb0f57bd79087c03b0c1db8862436e

SHA1
e70f4e6fbd9db9094c1127392339964188af7eef

SHA256
73be7dc5d8469a1353bcb37b8bed6cfba2586404b5dda0e10acaad205a14c01b

SHA512
d8963adbc6a7ad8c0d02e5f7ba2d508d5db6e9ee08e9d8900665b9ea9b216f80326adeaca9b907626d3ff642e112fca82d9f037bdeda5fa874f5651d62ac54b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580385.TMP

Filesize
371B

MD5
fe44b52c1e51a8102baa8e3e665c3269

SHA1
3aaa7c52b8ecadd611f84de6e7110368ec09f281

SHA256
fa132334ff5acc36a8e340cb9d40318901c61940a8e3e681c4fc1f11f61ddc91

SHA512
3491f73dfed21b258c7ccbbfc7fc4822a6aca2d592a36800dbc6444fd0fc04aa813f3e96bfe278f5ee72f37d0f1bb31da53b8ce41cec16bb9e1d9dc9a9b1023c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
728154cea3bf3f7ce5b5579441cd2c93

SHA1
4ed9c5fdf7a2b14cebee3eeb94fcf2239b8f7182

SHA256
230d83ea33fe5e00bda8b1b7e1ff5b492cba57050feab6514e87ebb4c1b4b5e4

SHA512
132c06a73262c7898d9405cb80cc6a04108b4d5883ab788f5e1bdb71e342a7d459224398069d1b46b0c7b60bfbba8c9e62b67b69bbae327c083f13eb1b54b5a5

Download Submit