676498f292b3a47c39fadd65d8400735c92d0453aa627b1013cb4fe5a100be2d

Analysis

max time kernel
57s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe
Size

168KB
MD5

8df48db76679f51e832e0b48a89c509d
SHA1

d1f0f17e91e91cc4e1647c2aa8a7f39af2793125
SHA256

771fb65b9e55db17bca18ea3594e8e8b4d5ef060919844c0641a02d9c3326b1e
SHA512

0e387586091b5455feb19fdfd45cea73f425cf1b8cc8fdc11e68d78826e30f3d148731713c796c0106aee1e756c514fa8ecade656261edc517333245170596c8
SSDEEP

3072:ELUbqjhjDUyx4HCIRoL57WpTlbYsb+L5QgDgZFHdrLTc5wEKctIZ:h4jJ4ORWpTlbYsb+L5QgDgZFHdrLTcml

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe
1500	msedge.exe
1500	msedge.exe
1684	identity_helper.exe
1684	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 1500	3632	d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe	92
PID 3632 wrote to memory of 1500	3632	d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe	92
PID 1500 wrote to memory of 4436	1500	msedge.exe	93
PID 1500 wrote to memory of 4436	1500	msedge.exe	93
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 1092	1500	msedge.exe	95
PID 1500 wrote to memory of 1092	1500	msedge.exe	95
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe
"C:\Users\Admin\AppData\Local\Temp\d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffacee246f8,0x7ffacee24708,0x7ffacee24718
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:2296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
    3⤵
    PID:680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:3856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:1172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
    3⤵
    PID:1832
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:3220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
    3⤵
    PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
    3⤵
    PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffacee246f8,0x7ffacee24708,0x7ffacee24718
    3⤵
    PID:4752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
e289cc3df5d661c398de0e6c4a61d9b7

SHA1
798156acab2d55e8f36b6e505bc3e73281eaed7e

SHA256
41d61eb39642d170ac390a6dbb5879ef09bc3ccd81d21bbd4dff1fd20131d23e

SHA512
d25e5fab7e751bf09d201a0b4f77dbdfea1270efe63d941c009fc342a90baed4ae582690a27c9645433382a721bdb04f2426aaca980e79feb2dabf0ea22dc796

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
212242c333543ba74542de3a189c510d

SHA1
5c4d2823f0ca6b42c769e7013ed8c58f0a529b32

SHA256
eef8fe9b64f91f1e76a2c30d1ec42075c25c49379877b4492227af2f1203e610

SHA512
20c1ebaab92159716fa479bc876c321eb942942083f4c61f58da88b2353b72086d48d3615cc871d27a87a5a01dae1aff8fde0ff08ea0b1b63949e8ec62a6b8c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
35669936aa89cee8a995ab636e3cc2db

SHA1
897207cc67d1516373cb55d034a2ad9e5de857aa

SHA256
730ca45e9a23afbe106d7b1cb68324c6511c3bc362a61f3fc019c50b1a11c932

SHA512
e5963555bcadd419b201e55804701a0c10520b83f56d71644c0868ef5cb50b2ecf6a26a3e138d87982a5ba001d84651f2f1b2e5fd55515f2c599748e04fa0a43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
75e220321439a001db90787b45be422f

SHA1
1116f4e4e3ef23bd89d5c140c27675a863ed7759

SHA256
38c2693f56149d6c2172dca999c73e2db60e7a103283ca662ac26c5b5a103c66

SHA512
aa5a40bb79de167ac5198710d95cd78d81e9cce5a8fbb828e65e9339a0e65764519f40616a79ab5f5f8b028bf120320efa1c9765e26fa0146cae52f89ec30983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
334b7658c6318d3c5d4bfff011236d85

SHA1
433ef17a2f5c396309d3eea4b263010b02816e50

SHA256
a2fac487e584f6607418ede6fecc2ed7e1c67cab8294d7293e087cac754880eb

SHA512
97e23b9c9be7e4d06761fbaa749c7cffa6ec26c75f53a0f35a2de56e1ae0016cdedaf1978c5f679058e4b5b3e37d37fc9f473040086be0d60e2e247b2dc29906

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5810a5.TMP

Filesize
371B

MD5
775829c54925b52e2d154be2b4984ce0

SHA1
ccc048c556966588c688ee310c627ed8827aa901

SHA256
e908fb925560b6f0a3c4e34c60c697d9bbdf32e88e1dfdd719c119d25cf35a16

SHA512
9fb68c0b3b6552f90fb48aa6f4e15a3e8b5d33218eee22f3ef58e38cb0646339ec0626b28f1a5f78e8f064a186cdfeea3e35c28711a6edbb808bfc078b48b433

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b589c59ede3906b631e8bb7a28aa661b

SHA1
16e0637556d289854c844e9038d061d43923d92e

SHA256
2b57849eafda2f8a44dc2a5e745b7db983c16b6c860b6f5b64f752bb7b82d02b

SHA512
500b0245e919724aa0837dd3c04a756b679e3b6914600f4450c3ac36339f1c230c98d012cdd85efa4e56b813d4708678b3c9a2b82328ad5d197f6d6949547fef

Download Submit