233cb669f6920635ebb8ee4a0e2a27a8e624c7cb2b7dfd47e0f82136ab00f0f9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

233cb669f6920635ebb8ee4a0e2a27a8e624c7cb2b7dfd47e0f82136ab00f0f9.exe
Size

511KB
MD5

9c4ed7c04b34e624f01a7a8386d32391
SHA1

dcc1d49032ebdfb533e5c069eebae12272ac3785
SHA256

233cb669f6920635ebb8ee4a0e2a27a8e624c7cb2b7dfd47e0f82136ab00f0f9
SHA512

a835b7771fc51cb7adad2aa84a97dd5f548fc15a68ac44ee0ffae5425e158d1a343b04b1ff7973c098db24f7ea6b05939fed7865d39a16bace98f14ed95988c4
SSDEEP

6144:ZN27aqefGX9Xx//DHXnuA543YZo1HIBw/dARxAmyoYhNK6:ZGNBzT3qqKHAw/dAAmyf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	233cb669f6920635ebb8ee4a0e2a27a8e624c7cb2b7dfd47e0f82136ab00f0f9.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
5000	msedge.exe
5000	msedge.exe
3532	identity_helper.exe
3532	identity_helper.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 5000	888	233cb669f6920635ebb8ee4a0e2a27a8e624c7cb2b7dfd47e0f82136ab00f0f9.exe	91
PID 888 wrote to memory of 5000	888	233cb669f6920635ebb8ee4a0e2a27a8e624c7cb2b7dfd47e0f82136ab00f0f9.exe	91
PID 5000 wrote to memory of 4552	5000	msedge.exe	92
PID 5000 wrote to memory of 4552	5000	msedge.exe	92
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 3028	5000	msedge.exe	93
PID 5000 wrote to memory of 4636	5000	msedge.exe	94
PID 5000 wrote to memory of 4636	5000	msedge.exe	94
PID 5000 wrote to memory of 2424	5000	msedge.exe	95
PID 5000 wrote to memory of 2424	5000	msedge.exe	95
PID 5000 wrote to memory of 2424	5000	msedge.exe	95
PID 5000 wrote to memory of 2424	5000	msedge.exe	95
PID 5000 wrote to memory of 2424	5000	msedge.exe	95
PID 5000 wrote to memory of 2424	5000	msedge.exe	95
PID 5000 wrote to memory of 2424	5000	msedge.exe	95
PID 5000 wrote to memory of 2424	5000	msedge.exe	95
PID 5000 wrote to memory of 2424	5000	msedge.exe	95
PID 5000 wrote to memory of 2424	5000	msedge.exe	95
PID 5000 wrote to memory of 2424	5000	msedge.exe	95
PID 5000 wrote to memory of 2424	5000	msedge.exe	95
PID 5000 wrote to memory of 2424	5000	msedge.exe	95
PID 5000 wrote to memory of 2424	5000	msedge.exe	95
PID 5000 wrote to memory of 2424	5000	msedge.exe	95
PID 5000 wrote to memory of 2424	5000	msedge.exe	95
PID 5000 wrote to memory of 2424	5000	msedge.exe	95
PID 5000 wrote to memory of 2424	5000	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\233cb669f6920635ebb8ee4a0e2a27a8e624c7cb2b7dfd47e0f82136ab00f0f9.exe
"C:\Users\Admin\AppData\Local\Temp\233cb669f6920635ebb8ee4a0e2a27a8e624c7cb2b7dfd47e0f82136ab00f0f9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=233cb669f6920635ebb8ee4a0e2a27a8e624c7cb2b7dfd47e0f82136ab00f0f9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed3bb46f8,0x7ffed3bb4708,0x7ffed3bb4718
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,16958549096829563063,9182308924575193834,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,16958549096829563063,9182308924575193834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,16958549096829563063,9182308924575193834,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16958549096829563063,9182308924575193834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16958549096829563063,9182308924575193834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16958549096829563063,9182308924575193834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
    3⤵
    PID:1796
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,16958549096829563063,9182308924575193834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
    3⤵
    PID:1320
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,16958549096829563063,9182308924575193834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16958549096829563063,9182308924575193834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
    3⤵
    PID:3872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16958549096829563063,9182308924575193834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
    3⤵
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16958549096829563063,9182308924575193834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:1116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16958549096829563063,9182308924575193834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
    3⤵
    PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16958549096829563063,9182308924575193834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16958549096829563063,9182308924575193834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
    3⤵
    PID:1496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,16958549096829563063,9182308924575193834,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3120 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=233cb669f6920635ebb8ee4a0e2a27a8e624c7cb2b7dfd47e0f82136ab00f0f9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed3bb46f8,0x7ffed3bb4708,0x7ffed3bb4718
    3⤵
    PID:2096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
1838d412b5748153e35d507996b89265

SHA1
7365ce4c3b3261ee7849af9025277c8a10c8e953

SHA256
466bcd6444aa8f9338e15df503a4743cf487d32daf35c77de904253db9c71459

SHA512
ad17018f9316848af51e15941a2ff7b48689fc7d530fc661a1c2a234c2bc9d628211d0767e909750bf23bb4ba16d2858ad92d76dbd4f7caadb5eeb20b25ba075

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ec32fd900be2366f275b717e1b72fd2b

SHA1
ebf5d7725bd01b0de0d8c5e6caf80976b821b2e3

SHA256
4364ee7a945e61b4f185e8faa2bc17a4a28b9584ba8b662f0b7c25b04431d1fb

SHA512
7bf27706992e4a10c6d7c948987b37890e01d5aadbc140420721a4dc73f5f906d237373f9cda5630eb1668702e7af0bf04c0dbb45fec75fcd03fcf8954f6238b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a48388804b45d2c885b2ea053a3ce5e5

SHA1
090abe48cfa8a1f0bb30fc0be2f630189e6a61e0

SHA256
42cbad64b475c842fbe2185cd07da9dcfdf52fba2c6dd608114fa350fe7f4395

SHA512
1b46f24d1c98804c701b9cff285b352e3977458dae013d1a955dfe4fa0fcb3d5fd87955ee96b01be8f59fcaac9033397680716876f0fd89ab9145431a6e6f6eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
50cb2e11669832a59ae21b71be949056

SHA1
31e6b44ed89ebe8ba30cbe4c5f0527e5d331b39d

SHA256
40a23e250064632fa2518330ff4ae4f318250f45abffde8d89abc283b30baa74

SHA512
98bac3a94167e520fb1582db3bb62c09bd8a3c280e46d46deaf781533de6c8c1f73cd4dad656c58d01ef5abe2562848cf505a67f60adc3c5f2d8dca806ded477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
402c4b88c29d782ed0d132862d4fc885

SHA1
4f536b796cfda3ee4ec227cac35d62505d87675b

SHA256
8862bf642d7d2082bd7663dc4d24ae1109186ae6f96f77ae2e1895fbd88c0c67

SHA512
7913fdf4fef2335449cb639d1c4f2fd1dd7e077f25ffbef39e2513def55bf2f5b8da22885da1992b96d04e9cfe2645c768b60ffeaebae24aea8dc9b5db7938c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fc90.TMP

Filesize
371B

MD5
ad8d15d90c4500d27bc3d7c03eca3d67

SHA1
363fa72d8a612a1416a9ded61ab226de5392e638

SHA256
d1c3f24c4cef738286387606fb44504554e41ea8c5507404d8599e65ac065b1c

SHA512
863cdae46c37b41f0b16c507b460127f0af39f768c638029013550acab41e1f3cdd66761c66e1b0c838a97a45560fc21a12577897ce73739679f7714213c368f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1736e2079b1ed86720f19e6e8eca387e

SHA1
90c1f7c3433f2b8d953830b22a408c4ada84ea32

SHA256
19e32c621597defba5e90303f603972e0436b598967bc9c760317d393c651f06

SHA512
3f3961e9faa7fcf68ddf53a4f3ba50d8b47310b95f18425fe6f9429ccc23b5c007197ed43658c9ca0fedc7fbdb88b3c26b7ca83a2e33a12c50fafdffefcfd426

Download Submit