fc3afcc8ad55f5f9cfb55df8a0b3eed64457330cf753e133709017ed17ee4143

Analysis

max time kernel
120s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

060b851cf353528c1ac8c30ff9bd2b20N.exe
Size

353KB
MD5

060b851cf353528c1ac8c30ff9bd2b20
SHA1

ca63825c7362f5e9ceb46352e374dcac5a9e9ff2
SHA256

fc3afcc8ad55f5f9cfb55df8a0b3eed64457330cf753e133709017ed17ee4143
SHA512

8c8adc17c38ad15db8157e53400b9f717d18d0098a149843edd826a26c94246511d43c1cc476c5fb1ac04fa593d0e2ae65065d57b971d3cf6d01d26bfd8428d5
SSDEEP

6144:iXnmtWrnngnnnKnanlywwwBwwA5wwwwswww+wwwGwwwbwwwLwwwwwwwwwnwwwjwX:iWtWrnngnnnKnanxNY

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	060b851cf353528c1ac8c30ff9bd2b20N.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
972	msedge.exe
972	msedge.exe
3208	msedge.exe
3208	msedge.exe
4660	identity_helper.exe
4660	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 3208	3012	060b851cf353528c1ac8c30ff9bd2b20N.exe	92
PID 3012 wrote to memory of 3208	3012	060b851cf353528c1ac8c30ff9bd2b20N.exe	92
PID 3208 wrote to memory of 2080	3208	msedge.exe	93
PID 3208 wrote to memory of 2080	3208	msedge.exe	93
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 1688	3208	msedge.exe	94
PID 3208 wrote to memory of 972	3208	msedge.exe	95
PID 3208 wrote to memory of 972	3208	msedge.exe	95
PID 3208 wrote to memory of 3160	3208	msedge.exe	96
PID 3208 wrote to memory of 3160	3208	msedge.exe	96
PID 3208 wrote to memory of 3160	3208	msedge.exe	96
PID 3208 wrote to memory of 3160	3208	msedge.exe	96
PID 3208 wrote to memory of 3160	3208	msedge.exe	96
PID 3208 wrote to memory of 3160	3208	msedge.exe	96
PID 3208 wrote to memory of 3160	3208	msedge.exe	96
PID 3208 wrote to memory of 3160	3208	msedge.exe	96
PID 3208 wrote to memory of 3160	3208	msedge.exe	96
PID 3208 wrote to memory of 3160	3208	msedge.exe	96
PID 3208 wrote to memory of 3160	3208	msedge.exe	96
PID 3208 wrote to memory of 3160	3208	msedge.exe	96
PID 3208 wrote to memory of 3160	3208	msedge.exe	96
PID 3208 wrote to memory of 3160	3208	msedge.exe	96
PID 3208 wrote to memory of 3160	3208	msedge.exe	96
PID 3208 wrote to memory of 3160	3208	msedge.exe	96
PID 3208 wrote to memory of 3160	3208	msedge.exe	96
PID 3208 wrote to memory of 3160	3208	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\060b851cf353528c1ac8c30ff9bd2b20N.exe
"C:\Users\Admin\AppData\Local\Temp\060b851cf353528c1ac8c30ff9bd2b20N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=060b851cf353528c1ac8c30ff9bd2b20N.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xcc,0x108,0x7ffb663c46f8,0x7ffb663c4708,0x7ffb663c4718
    3⤵
    PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13079742379317422970,118662706677620772,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,13079742379317422970,118662706677620772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,13079742379317422970,118662706677620772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13079742379317422970,118662706677620772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13079742379317422970,118662706677620772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13079742379317422970,118662706677620772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13079742379317422970,118662706677620772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
    3⤵
    PID:448
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13079742379317422970,118662706677620772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13079742379317422970,118662706677620772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13079742379317422970,118662706677620772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
    3⤵
    PID:1896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13079742379317422970,118662706677620772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13079742379317422970,118662706677620772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13079742379317422970,118662706677620772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
    3⤵
    PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13079742379317422970,118662706677620772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
    3⤵
    PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=060b851cf353528c1ac8c30ff9bd2b20N.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb663c46f8,0x7ffb663c4708,0x7ffb663c4718
    3⤵
    PID:3824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
3c069dd3b50f5b81aead7565026f96bb

SHA1
0ac0cf35251ecbbf54d793d417aa9f43462a7ab1

SHA256
acf1dbf7b2bb386b92e00f48c83e5d50d5f064fa2c14d32cd534ef5f5bcd0779

SHA512
864d9556b4827d3b9bd010a55f9cafbaa58775dd53978759014e67425deee8c8f3a1d67e9ab068eab91e8e58cf428bbbbcbcbc8ecd2e01b2e5049079596f30d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
47afd0bd126513e990833d99caa46715

SHA1
cd179323c2a52a17a655f9dcc86a541cad607aec

SHA256
f8d7bcd7d387d8c095d76102e22eccb4177da43d91c1251948915671d70a0fbb

SHA512
381ba9dc377cbffea55bd764d56e8af3d2e3a8f012540acc7c5f98d9edfb383ae183d724cfcc384b37cbd8ad12e903e7a9ea5237c78e3129a8ee693edecf9e91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fe31df4fafa1b5464425e8743ab385d5

SHA1
6d56abc109151eb01d77d71f40f8e9776399d330

SHA256
fe801dd6073aae30c37666cc538506d533763d23c1642e4be8285d53283303a0

SHA512
dfb54ff3603ef9b6780390d9940a9699823e1cfb557e2239f4c666d82189307f070672a4ff0afb8c1ed26c2ef23dfe7b713ba3b56f75ab50f94bb338119d046b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
122312b6cdd10bcf400b9ade90572b7f

SHA1
f64a48476b8252daf9276c4771ddf0ead58bbbae

SHA256
13cf054ce46349575e0020dac5413e8865050b70cf63234359a03069716d123a

SHA512
98d2e163c0a48793a80d499ddd852c3e8715c472395e3edb18412478fddb5c34984d50d1e1c75c9c5807c7ec0367d88671109aa9063b584358812fd1a77d7178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
367B

MD5
bbb31ff31464db890dcc85f4378451a3

SHA1
88a4ec825e42b82cf0fe9c23ca8b5881777ba7c5

SHA256
93fc4fb33e1a332869ec1aaae010138e1a03bcc5fda68f084bafc3adc904e094

SHA512
7d625ce551349f1f7bf75caef0a5c7a49c792265c93ee97341b78bc31d5260502a772451d5d8077a43c8856878aa2980f57e9881503caca9a340cd11c933cb56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f82b.TMP

Filesize
371B

MD5
ad86ed7681baca1fcdc69fb54c153c2b

SHA1
43f81db81f6106d2b710ddfb2ffae32d5d103e49

SHA256
060e79da889328d952c6037c15e7ff4671a1053b7485aa42dfc539d34d454cef

SHA512
53595caef6f03c813a091b430c94d7482e30705ddefbe792c2701c28a4580cf09e14a4b46051e78dca9f88d3e2e4b983d217f90d29973c960bbc9f6f51381e0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c2855d754a6f33368d5327180ab47ef2

SHA1
d5db1c05913cb97f9534b21fdd32061fc5a77675

SHA256
5db793dc95eb78a0986052cff4045a38e2c3fe31cd2bdefc8d8d3e0c1f92a37d

SHA512
dc4aca2a348e0998e46617f7da50ffd500699e7a6bf30cae5a39cb3ee1125492caf2dd48af22f76fb404f0bce482322bb7d7cb2c08a73cb225fdb7d3bae8ed43

Download Submit