hxxps://itnewszone[.]com/reports/cldr-dataarchitecturee2ddownload[.]jsp

Analysis

max time kernel
283s
max time network
284s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 23:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://itnewszone.com/reports/cldr-dataarchitecturee2ddownload.jsp

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
40	api.ipify.org
41	api.ipify.org
42	ipapi.co
44	ipapi.co

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
2464	msedge.exe
2464	msedge.exe
2344	identity_helper.exe
2344	identity_helper.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 3840	2464	msedge.exe	84
PID 2464 wrote to memory of 3840	2464	msedge.exe	84
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3212	2464	msedge.exe	85
PID 2464 wrote to memory of 3096	2464	msedge.exe	86
PID 2464 wrote to memory of 3096	2464	msedge.exe	86
PID 2464 wrote to memory of 4956	2464	msedge.exe	87
PID 2464 wrote to memory of 4956	2464	msedge.exe	87
PID 2464 wrote to memory of 4956	2464	msedge.exe	87
PID 2464 wrote to memory of 4956	2464	msedge.exe	87
PID 2464 wrote to memory of 4956	2464	msedge.exe	87
PID 2464 wrote to memory of 4956	2464	msedge.exe	87
PID 2464 wrote to memory of 4956	2464	msedge.exe	87
PID 2464 wrote to memory of 4956	2464	msedge.exe	87
PID 2464 wrote to memory of 4956	2464	msedge.exe	87
PID 2464 wrote to memory of 4956	2464	msedge.exe	87
PID 2464 wrote to memory of 4956	2464	msedge.exe	87
PID 2464 wrote to memory of 4956	2464	msedge.exe	87
PID 2464 wrote to memory of 4956	2464	msedge.exe	87
PID 2464 wrote to memory of 4956	2464	msedge.exe	87
PID 2464 wrote to memory of 4956	2464	msedge.exe	87
PID 2464 wrote to memory of 4956	2464	msedge.exe	87
PID 2464 wrote to memory of 4956	2464	msedge.exe	87
PID 2464 wrote to memory of 4956	2464	msedge.exe	87
PID 2464 wrote to memory of 4956	2464	msedge.exe	87
PID 2464 wrote to memory of 4956	2464	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://itnewszone.com/reports/cldr-dataarchitecturee2ddownload.jsp
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9feca46f8,0x7ff9feca4708,0x7ff9feca4718
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17811741547955560136,7594043719828830884,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,17811741547955560136,7594043719828830884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,17811741547955560136,7594043719828830884,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17811741547955560136,7594043719828830884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17811741547955560136,7594043719828830884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17811741547955560136,7594043719828830884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17811741547955560136,7594043719828830884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17811741547955560136,7594043719828830884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17811741547955560136,7594043719828830884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17811741547955560136,7594043719828830884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17811741547955560136,7594043719828830884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17811741547955560136,7594043719828830884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2420 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17811741547955560136,7594043719828830884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17811741547955560136,7594043719828830884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2232 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17811741547955560136,7594043719828830884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17811741547955560136,7594043719828830884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17811741547955560136,7594043719828830884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17811741547955560136,7594043719828830884,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4628 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\53c5a554-16f1-49f2-958f-5e29a680aa46.tmp

Filesize
10KB

MD5
e16bbb4c1cf35ec6abdbe48a7861ea26

SHA1
74c414f86adce81c222f715f3607a7c2d5267947

SHA256
6f0274b6a80a702f24f6358415792bade20950ea01e1600f3294bd74c5db600a

SHA512
dfa1d72babdebd711c2ecf19f5d6bc3ec477178bb12a19bce50a2bc194816fda528919e5069af9e05226a93151ea58eb8dc2c78e1ebbf23b5660c4ef7931ab0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
2d3d60fe604c5b56bb9307d5d8473820

SHA1
9b6bafa5962c460282c445a366685bb949fbc28c

SHA256
85e4669e78d2ed3df862271686f81f6debc58a619a1719901f37486e2d79cc06

SHA512
969f959d69fabfcd072206e50749110612db737cd631873c9fd25d319eba519e953894f1345ff6834fd5ab8f0db85fd4cc4ee70cc8a6a05999bd132f83ff0c48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
3fe8e0192dbd77d7b0b6ab1d3ea3629c

SHA1
d3349ee7452994b4f26e8e7569975b27fe6753ee

SHA256
64f26554a44449c48b9643369774b8dd60def5b4092b4c84a89a44dd6b0accd6

SHA512
8bdde86d22b8e6a8ebe37060b51e6ad9e7686ddd43ca7ed3858951605df11a0135da4fce072ac0c454e4e14a9bf19c7123944041d2bacc86a8f7c6bbda0f783c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c3b194a34489661361f129dea1e114ae

SHA1
32b81317801fd3f1ab47d11b5760f24b4fa9a7c2

SHA256
3c39cc09446d3ab77deee2aaf2d127a135ef2780b3ff3d7bceced0d0a19c2ebb

SHA512
1c45cace439bb188effcaa4afbb5e836f786b3062399c1c1adae0f7c278ee131601ac3ed56da7eb44d230216bd313878f94852ffde02a9b1cdef8ffce36c99b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4ef43a3217a766dde9d6abeb89be51a3

SHA1
b3cb4f3e5b40a236a60a73bd1f2162c63967ad85

SHA256
89156569da93345c604f80c3bddc47507ab68383adcc048823e19270c95c9e41

SHA512
326024049adc55cf33b639aeadb515c1290ee530bf576e4e15c1cba95e36fc99817aed02ec2b693bb43f4e41fb970420395771e0d1c4b826c3ba21374c28c44c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e1f6c9ffc934a0683346492d90b2a478

SHA1
8aac817fcbda432849ea3c8a2471b9173aa2e515

SHA256
0c5fd25ccf954bcfa2b7fcc10e6e3720fc173ca41b0066e47d5dd853601351b0

SHA512
c08edbce737e5a67c41a2cbf44902c56dd4ca0191726edfe7d3ec0e9024e92ed329c54dbcf9ed4d9792b453062bfff1c30e673955ceecc15e9380b6756088798

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
76a2465d55375d70d13ddde71b0b0a86

SHA1
307fcdca1e890db7dc88e1caa549ac66221e4ffc

SHA256
f753a173705475082a1e19ddaf675f433c06555bcfa2b32e3c93180d29f70241

SHA512
61c204590511452afb31821a990159d1ccd3d7d897f133733d626569b8fc95eeeec9bb1d03ddd9901fbe86f7d8f4e5606b064ff0a7d40d7e55b459a47b0c08f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
17c4a97a3d987f1e1dfa2a716c6d4976

SHA1
6518b584b8456fd4e3841fd45a45b764beaac0b5

SHA256
6a54b8375e45817d43dfaddba2458dfa4be67117eaa658f44ac2e3b30938bb20

SHA512
2e2635e5842e595f145ec6be6ca73c45f159394cf53e525b14f4b69e1d452979100037080fe7490562364979783d9f3590573f9ce3020b385c1823c785e05d4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0130b67c4a2f00f47d6f9c9c107f8304

SHA1
ce7d5f82073ea47fbdfcc6a4c7671158c36fa44a

SHA256
0d34f4db9e2455c906944718d3e948b1ca6c68bcb531a30fa65b80ed2e476264

SHA512
978fcd2bc7fae143db502d06e4a8bbe4debdd68e56472d838fc838a12e35eb1ba61a3b24bb07fb2e1e373ce3d3b62e11a4dc4be38cd00ba32a871322dc4d54a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
bc4094e2d8b587f3d59359b7a5ac2430

SHA1
03fa9abca7fc62e3f966554fee7d26741232f4cc

SHA256
afb6b23e7193bb7075f0015ec37cef7efb95a92fa3759b048614bed925aa666a

SHA512
387947fbdaabcb992d6d32c6b0cfe51e7bfba7bc9d2df4b5b395cc8b105cbd92d795bb6241bf32734d6b82288c78150912e8553d4f44d78897e6edc6d9f4bb1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587d88.TMP

Filesize
538B

MD5
b4a5c2acdb0b23c8088798667fd38e4e

SHA1
a0cc596afcd1bbe06d983c1ec9ba2ac75fb07198

SHA256
ff56e79751553374430b3dde33fb8e01f5f17de864cab4bb03795ece1db2e1fc

SHA512
03d1558df9cd2ab6125ca686292f8645394d93fd36c3d520786ed7ab769d3385aeb71716f276381d01fce0db14a3a29323351db5c127048c0aa4c825233f5db6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit