2e242e2c1ebdde3d3d41f69872c8efb2ae55850df7f60638769733185d817808

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/09/2024, 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

COVID 19 GRANT.exe
Size

433KB
MD5

915a58be3a9c84e3a12042317da2c4e7
SHA1

de1a077b12fce49098ef9d9ba75630b0611eae8b
SHA256

2e242e2c1ebdde3d3d41f69872c8efb2ae55850df7f60638769733185d817808
SHA512

bde6d812e461eca1453c492225499c2730cf0a6270174a3ca6a76c0ae34d7a163e438cf72a8d09e5b86094ca97a712273236758aa3df184b32e24ac88c858cbd
SSDEEP

6144:oaUPSa6VEJD6Lp2dXqm8WmAnjKyDC9nUz1o+yrpjQFNHXhSVnM8:oaU96VEt6Iqm8WPjvGu1o/rpONHQt

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	COVID 19 GRANT.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
712	msedge.exe
712	msedge.exe
3100	msedge.exe
3100	msedge.exe
4968	identity_helper.exe
4968	identity_helper.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 3100	2288	COVID 19 GRANT.exe	87
PID 2288 wrote to memory of 3100	2288	COVID 19 GRANT.exe	87
PID 3100 wrote to memory of 1944	3100	msedge.exe	88
PID 3100 wrote to memory of 1944	3100	msedge.exe	88
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 712	3100	msedge.exe	90
PID 3100 wrote to memory of 712	3100	msedge.exe	90
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\COVID 19 GRANT.exe
"C:\Users\Admin\AppData\Local\Temp\COVID 19 GRANT.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=COVID 19 GRANT.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff90e1f46f8,0x7ff90e1f4708,0x7ff90e1f4718
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
    3⤵
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
    3⤵
    PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
    3⤵
    PID:2200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
    3⤵
    PID:2448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=COVID 19 GRANT.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90e1f46f8,0x7ff90e1f4708,0x7ff90e1f4718
    3⤵
    PID:2468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
b92e5110ea8e47b55ec82dace324be25

SHA1
5c0d068429dd32b403377d434d5c64f5289c31d1

SHA256
6fb02f905313e0966a853b8d004ef84322bfb44163781bb38261fbcc43150a45

SHA512
35725a0839434b70ab6a963daafea1587ba1b2539f526e2f6449a5514e5fc48578604221e0305e06ea7ff328f65a6dded7c9a59442d7cf242a1a97a02d8300a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4c7028f0fff717c83461cfc53dff4a8f

SHA1
54b0a56415c6e89c46404a4a24b09d9684a274ce

SHA256
f8994d689b9e41c9d275ad20466a165284ce453b26d9d561846274934fe2a108

SHA512
edc1e6aee7b7b084e8fcd09c34d4e53b88544b54e453465f6fbbe78aa6e43a2c11dd045ab288b146a318454df2ee967f9de5b3e11d0fa523721d51d32edcb315

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce45883a5ea93fbf1af104ac56494dd8

SHA1
ae42fa4585534dc431e7ff73e81311a9ebf659ec

SHA256
c9b3b5fb38bbd5ff99ce908bce16c2bb47590460dcf264bcd15141110878fe56

SHA512
8a796f43252da6465baa8d71c9aebe43baae1b99451815d0c57b579c7893831dd946c17f0274c3140c2fa06ca6a5aad6c96e40515ef03a9d49c5466083c96fab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dfb4f6c3a26575d3b0290a67fea3a857

SHA1
ec3e01bc7b24f6029fd6bb0c80d512dc450dcd1c

SHA256
fc0787dfa3948f5918ab7f3d2d120a0e21bde12ac4c8ee872e67d211d2856823

SHA512
bb067b1ee56392b33c9af7f48ca30d4a37a01f9557f4159e310576b3f772380119098cbb2917b194e72e231c3289255fed028cea194367b800b83a754626bb18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
f053de0d2fca1f238bf013852eee8448

SHA1
656da1cc858e9f524b8c7dfa727d170310564947

SHA256
828ba8b983f301783d8227f055ac309d7537ec3b174e7ab067780ed056476807

SHA512
9fea0d0c2ee9fb3cf6417e748c6988d23c1a6fe2fe8ae0a71f359e0796a43fad5f8ed1d171850fc48ab586d34c0f44eca140bb853e9876cf1ee6f54ccf620567

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f51e.TMP

Filesize
369B

MD5
82472181e8a4eb2a77ae0660a9b806ec

SHA1
634759f60ad6700f7ad74919463dc6e5c37acaf2

SHA256
d83364f7adaf06c2389bbb061fd1acf2caa6b38ce03fc0611f695dc8791808c4

SHA512
88976e79918e876e2961fd4e0cf8d3b24e895483e20e3f6cbf69988adb365e9dfb99dc2a6a7c9b65bf73afbf13dd780cfeb0508ca9e0ab61746e7a58c059e8d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
42287f04e9d02c39fd6cc404c073814b

SHA1
da43a867ee3aa3065417007f1a26175b915cccd5

SHA256
6810926b616abf4cfa5d8be49aefcecb66fb4bf79f0cb2c9331473241423dbb6

SHA512
d5dfa7a49c0f78424c2e9b117a28a14cea2a713128b45e59af15c27dd9ba01cd2d2611623e2ae5b4b5c2323cc226927457b4c30bdd2ae7f425c3dbf59a6592f9

Download Submit