cde4ce755c7451028bb0b9d7da0ce5baf86920b2c6a26e30b7a792183d9b5bd9

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cde4ce755c7451028bb0b9d7da0ce5baf86920b2c6a26e30b7a792183d9b5bd9.exe
Size

656KB
MD5

87ad3a0c65372bd2f8e33cdf1f35ec2e
SHA1

97711bd126f586f20965aeed3a4901bb0bafcb62
SHA256

cde4ce755c7451028bb0b9d7da0ce5baf86920b2c6a26e30b7a792183d9b5bd9
SHA512

6cfb611f2820829119d11cfef0b64c8100121282ccf848d3f79ab52e35e869a04d87bdde98b7501043b40d06e432557cfcb3c16a91f9eaea941e393291ecf4c5
SSDEEP

12288:2Jpy751DCwZhyNetOk+xLchxCkGMk0DHq50U6rq9+OsjXTVYaTJvaHCV4I:2Jw51Dn+5kqYhxFGl0DHqd6e9eXTxly8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cde4ce755c7451028bb0b9d7da0ce5baf86920b2c6a26e30b7a792183d9b5bd9.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3488	msedge.exe
3488	msedge.exe
1076	msedge.exe
1076	msedge.exe
2468	identity_helper.exe
2468	identity_helper.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 1076	4336	cde4ce755c7451028bb0b9d7da0ce5baf86920b2c6a26e30b7a792183d9b5bd9.exe	92
PID 4336 wrote to memory of 1076	4336	cde4ce755c7451028bb0b9d7da0ce5baf86920b2c6a26e30b7a792183d9b5bd9.exe	92
PID 1076 wrote to memory of 4212	1076	msedge.exe	93
PID 1076 wrote to memory of 4212	1076	msedge.exe	93
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 4796	1076	msedge.exe	94
PID 1076 wrote to memory of 3488	1076	msedge.exe	95
PID 1076 wrote to memory of 3488	1076	msedge.exe	95
PID 1076 wrote to memory of 1496	1076	msedge.exe	96
PID 1076 wrote to memory of 1496	1076	msedge.exe	96
PID 1076 wrote to memory of 1496	1076	msedge.exe	96
PID 1076 wrote to memory of 1496	1076	msedge.exe	96
PID 1076 wrote to memory of 1496	1076	msedge.exe	96
PID 1076 wrote to memory of 1496	1076	msedge.exe	96
PID 1076 wrote to memory of 1496	1076	msedge.exe	96
PID 1076 wrote to memory of 1496	1076	msedge.exe	96
PID 1076 wrote to memory of 1496	1076	msedge.exe	96
PID 1076 wrote to memory of 1496	1076	msedge.exe	96
PID 1076 wrote to memory of 1496	1076	msedge.exe	96
PID 1076 wrote to memory of 1496	1076	msedge.exe	96
PID 1076 wrote to memory of 1496	1076	msedge.exe	96
PID 1076 wrote to memory of 1496	1076	msedge.exe	96
PID 1076 wrote to memory of 1496	1076	msedge.exe	96
PID 1076 wrote to memory of 1496	1076	msedge.exe	96
PID 1076 wrote to memory of 1496	1076	msedge.exe	96
PID 1076 wrote to memory of 1496	1076	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\cde4ce755c7451028bb0b9d7da0ce5baf86920b2c6a26e30b7a792183d9b5bd9.exe
"C:\Users\Admin\AppData\Local\Temp\cde4ce755c7451028bb0b9d7da0ce5baf86920b2c6a26e30b7a792183d9b5bd9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=cde4ce755c7451028bb0b9d7da0ce5baf86920b2c6a26e30b7a792183d9b5bd9.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff992ff46f8,0x7ff992ff4708,0x7ff992ff4718
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,4434895589230074496,3799463672234900777,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,4434895589230074496,3799463672234900777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,4434895589230074496,3799463672234900777,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
    3⤵
    PID:1496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4434895589230074496,3799463672234900777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4434895589230074496,3799463672234900777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4434895589230074496,3799463672234900777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
    3⤵
    PID:1764
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,4434895589230074496,3799463672234900777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,4434895589230074496,3799463672234900777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4434895589230074496,3799463672234900777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
    3⤵
    PID:4004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4434895589230074496,3799463672234900777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
    3⤵
    PID:2176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4434895589230074496,3799463672234900777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
    3⤵
    PID:1468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4434895589230074496,3799463672234900777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4434895589230074496,3799463672234900777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4434895589230074496,3799463672234900777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
    3⤵
    PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,4434895589230074496,3799463672234900777,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=cde4ce755c7451028bb0b9d7da0ce5baf86920b2c6a26e30b7a792183d9b5bd9.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff992ff46f8,0x7ff992ff4708,0x7ff992ff4718
    3⤵
    PID:4560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
f7dd636570aab172508d7fd43bdfc351

SHA1
5c32470e0c8b9f6e02c57a2f99f936ed973982e4

SHA256
e505053103ff67896afb9c6b8bea10ab9c866c5e842c3b9687ffcba46f3710d5

SHA512
ba5ac721b30e265f90b9b2d1aa53c3e237d87f570a747cfdadedf6036f823cea2e3197f078d4fc9754716655172b4b9b3e36b7c7342c85a24e12c9cd1ca5e038

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a1e216916b038ef75bccc1158113a8ad

SHA1
bdb12630577d6e791a91a3ae154803e2ded0f966

SHA256
dfc2ffbf1f9288979cae47d95fe727491ebe28e78cf85b0f150352858cf20756

SHA512
a45704e53e4a3aaaf67b9c78f70895d699e532e2b871a6bf5b25fbce2472a08f76483456ed6a523716390e9933f2b89c2b9c1488f97f071348f2f7bcdc9293ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c2938ad5fd3ae0e3ac45559a0752d11a

SHA1
9421f171761452154eb8bf6787cbb4ea6eb0ac9c

SHA256
4ecb615ee5476ac1174bb6819477388386641a243feb0e5b71d1ae659ca0e980

SHA512
c42464febfaa0852d59db393e1a0d0ca03ee33afa6152f38885d8b56f15502f20299ed95159e0d328d0a5a6b44421dc8ea432248db05f7e78d38396c3edb29cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aa7b8af8a8e6fbc8f0d273f8a5d08ab9

SHA1
2d0eb906025d076a9fd8d78988468dce8089e337

SHA256
b6965331c24b17ed15118879bc856cf354e0874ddd7599af557d1b99a5adab1b

SHA512
0754ecc948ff996c0741236a6f19b40bdbbebd15e5044a0e37a5cea87e78231ffcce6e7718d33a17d2f5a309140d2e04c508e514044e1502b1d77a2377525e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
369B

MD5
42f35a0f5621440cc5e4cdb001952f0c

SHA1
4b90ac4b6b44a3f6d72e67755b88de0511776ddb

SHA256
4cf978bd64a1a53987d86dcef3dcdf8d42f9c95df9943e4ffceb7e0c9842b44a

SHA512
e6ac403eb37bb29415bafece5b57a8bbc6b1c4398447fd98c9a1b7e7248d50860bce14115dab03cc891321e58eddb2af9c77d147303e50598dfda177aa3f0ab3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d726.TMP

Filesize
371B

MD5
1ec82d4cf1289da39bc5ea2d130dab9f

SHA1
3c00b6d26bf0b2ca4c870e824eb9e39b778eb2c9

SHA256
4e639580bc35459e4d1e8ecb47699a9765f8c7b55b5ad3467f25e761e4bfab14

SHA512
393298b84397c3e47b7b4f695d1e8bd516457508a01bb9e932fa6e6fdd33803e18e0c4d964ec46380383dce15c70749f7017f7dee02096f05a09f21d2301bbd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b3a8c882152eded7579c75c322bac12d

SHA1
0b5e7cbc7ff6ab12751f7acbb7ffe83df5517bc2

SHA256
56854e3b0e551cc1563b8d7baa9f1e216fbc421c5b03c82fa67a09763a7cb8cf

SHA512
1967e48cd690cfca6879f951677179c4458bfbf996eef8f5d502f0e1ebfced968598121a6a65487e5c6ec268a37816a7c398ad8ce7337ee71b30230226e754d8

Download Submit