d66577872ebf8ec7138102e46f35220fb823e502ece7a51b4989c961eb9549a3

Analysis

max time kernel
375s
max time network
376s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2024 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TGN X/bin/fpsunlocker.exe
Size

501KB
MD5

f6722f9f28173138464a22fd516c0275
SHA1

247c828444f9ed61037704b4e2b6f5431f410a73
SHA256

19f11c65f6c8dc386e9e8fdc79326fd7580395d9931a5e952feac40d26a88907
SHA512

2ddff2df9e550e6dae9b3ece908e9887e4ab4a26d056d73a6f224b0f0ad981c499819c211701f953abbc79512c821725330e35f905ea743d9aeb3f23a1646c50
SSDEEP

6144:Ry2RPslBVptHpJA5mmWRTzSVRkzyNXf6tyRqgrOEqV7DIyohcqSHP4ooXHE:FPAJJBRaVS+NXGyRq/x7noCq+w/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe
784	msedge.exe
784	msedge.exe
4400	identity_helper.exe
4400	identity_helper.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 784	1156	fpsunlocker.exe	83
PID 1156 wrote to memory of 784	1156	fpsunlocker.exe	83
PID 784 wrote to memory of 4472	784	msedge.exe	84
PID 784 wrote to memory of 4472	784	msedge.exe	84
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3620	784	msedge.exe	85
PID 784 wrote to memory of 3300	784	msedge.exe	86
PID 784 wrote to memory of 3300	784	msedge.exe	86
PID 784 wrote to memory of 3224	784	msedge.exe	87
PID 784 wrote to memory of 3224	784	msedge.exe	87
PID 784 wrote to memory of 3224	784	msedge.exe	87
PID 784 wrote to memory of 3224	784	msedge.exe	87
PID 784 wrote to memory of 3224	784	msedge.exe	87
PID 784 wrote to memory of 3224	784	msedge.exe	87
PID 784 wrote to memory of 3224	784	msedge.exe	87
PID 784 wrote to memory of 3224	784	msedge.exe	87
PID 784 wrote to memory of 3224	784	msedge.exe	87
PID 784 wrote to memory of 3224	784	msedge.exe	87
PID 784 wrote to memory of 3224	784	msedge.exe	87
PID 784 wrote to memory of 3224	784	msedge.exe	87
PID 784 wrote to memory of 3224	784	msedge.exe	87
PID 784 wrote to memory of 3224	784	msedge.exe	87
PID 784 wrote to memory of 3224	784	msedge.exe	87
PID 784 wrote to memory of 3224	784	msedge.exe	87
PID 784 wrote to memory of 3224	784	msedge.exe	87
PID 784 wrote to memory of 3224	784	msedge.exe	87

C:\Users\Admin\AppData\Local\Temp\TGN X\bin\fpsunlocker.exe
"C:\Users\Admin\AppData\Local\Temp\TGN X\bin\fpsunlocker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/axstin/rbxfpsunlocker/releases
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc28be46f8,0x7ffc28be4708,0x7ffc28be4718
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1484,12929241050190367910,14381751215560017889,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1484,12929241050190367910,14381751215560017889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1484,12929241050190367910,14381751215560017889,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1484,12929241050190367910,14381751215560017889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1484,12929241050190367910,14381751215560017889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
    3⤵
    PID:3804
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1484,12929241050190367910,14381751215560017889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1484,12929241050190367910,14381751215560017889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1484,12929241050190367910,14381751215560017889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1484,12929241050190367910,14381751215560017889,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1484,12929241050190367910,14381751215560017889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1484,12929241050190367910,14381751215560017889,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1484,12929241050190367910,14381751215560017889,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5668 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
1KB

MD5
810f3b48a6310566547ebcce0578644e

SHA1
4c31d860c54fee106ab38fb22ed576e38704b072

SHA256
8958557b0daeb46204ea6d49c78dea1547d7f963dfb1131ce2188280951c61b6

SHA512
9158777503ea3452dcc3a28afa7c6b24725df671ba0b8fe29313e2a6c3b50693fadea4df1a1bd0f945216ae9ea2ec7909b0cf364719c9d4f045b71cc02a62834

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C38AC6B0EBDA4044A36E2ADF650F8E22

Filesize
282B

MD5
b31c67a60cbeeffe4e9e60682e167652

SHA1
ebacf4cf32b829ed7cfb6b250f4334224e15be8e

SHA256
58db29d8f9a48c7fb632b1bb323024c7bf157a28154eb73384a849ec02ea478e

SHA512
e65e3599862167007b06cd168d49b37921054b2fe49aeac1b0dd2597bad8a296a8b18665776e1fb56621844c9f8505c77fb9c6104d8e87526ffc3e86c9f1b42c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

Filesize
980B

MD5
7f16bfc60c4b3589760ceebb1bb5e8f2

SHA1
dcfd565a261c3467d091d0625dcb1cb7b8edf8f1

SHA256
c828b6a58ffc4dbfe40dfdf23ebb21cfe44d763b7a4ca592a07a3169ee2982c9

SHA512
dee30e93eff65d5e541b238b6ca3c9bf61ea2d8b693637a43afa828b8ed58359c8b5c69ba524d6cd72fe90ffdc382ed21944494ee067c2e13b2a20a6f3d3c49d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
482B

MD5
344cbc5b0b8ac8e6e3a48be99bdcdf5b

SHA1
3941d488c6f9fa0e9e627c55f84aece47541ad76

SHA256
4ae4bfcdb6d8ab4e6bdce7f63243749422d963d4d96e1d6ac92bcaf87e81b606

SHA512
beb6c613bf544517c14ae0b80289b923f563fae53b86fa5909d502717f1eddaa33782e1debe8c28e8eefe923b2f7a8b8a6be02995fea020c694ce3f36e01a96b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C38AC6B0EBDA4044A36E2ADF650F8E22

Filesize
484B

MD5
62b1f2475f673c20f2f6928b38345a5b

SHA1
fd95fadebf51666ddf75156f10d3c2f18028c157

SHA256
3fdb02f65c2b661978c920bf91146a29edb6c9207c0c6b61b2ae206da9fbb421

SHA512
12f72f8e58c703c5a7b5920d80c9d7ba7e537bd2d33296ac0cfac2a5b0875cebe5a891c77d4b8d86c2cc2d0f715dd08fb113d43e7396e9cff97ba9823f8d2f46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

Filesize
480B

MD5
5c79a2aaeea2d9be0b34e687f31c0bb1

SHA1
9ab85cb5e0e456ce5e397ed43fc1971d4f2d58fa

SHA256
0103fac4ab04f833e6785c6ab1be16df10b023310b6fccf880812cbb0cb8ec2a

SHA512
e719b831dfa7e2fac1c99cbcbeef2874f5527f2f119ff66fe51ba590aa8abc141041935303aedc615a115622094041cea6860d2dda4616268e78e0928b63a1d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
653c3c2162f2ae61e22d2028e8c44d65

SHA1
8cf52baacb5c0d1e525b0c41f56006e996c0adb2

SHA256
9dd019bca157a45724b46e85c8f088c5938f387dd729304bcf02cd96d68f8e06

SHA512
b3135d12baeefeb8df84b360ba3487e0a17baf3ac39cd3914c730e56f64d5453fb5da23aa62f7783285bbfed06ab150709c9fdbdaea8b5e5178519cf72d9078f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
c55a0ff379cb32458fc626336461c1e2

SHA1
f2fbbe8ef773c99501d14af0039f1c15d1f94bbf

SHA256
4044f309101531cb3772e44d6fc770c314507eec5c37336e866b8163a54770d7

SHA512
0d7230502968d7c5a4c1c5656d856e035ebf71599b42327f3f440a0117044f101c572709d48fb7773169f0f546c4ea4af8a9e6974b14159db602f32f55948cf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4a99be8f9cb46059945d6dd93dafa46f

SHA1
14c93c6094ac5aaf51b72b32efa17212af4834c1

SHA256
ae8adf1e7294dc48ed9f5358bd26c6f15d35de44fc5555671254da1cef8012b3

SHA512
102a236b94af25f3727acb4e4ead7b6ab88f6cb788b00123f5bd73e8f19f7753468210d138b8e224435aa7e992f830826dc80889b1153b8be024263427e24db9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
226dc24df04415055d9de641ed178e36

SHA1
5cd0618442c99948f3c972601e5ef39bd8534ae0

SHA256
842e3aea73dde896a6d6525f9e900d21ce683e586daa567d838e79feb91e7fa9

SHA512
6479666333b2df65fde6d1b324487218ac1021854cd45cc81d2c26726ce124dc2dc064b2150c5a3777b1e3e6b79f3f2905e303ff97991c905315cc5cb7051e90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b1fa8788de990cc590729d65ddd88be7

SHA1
5272f96ae1ab8c056ad950dc2cbcaa34e212ba1f

SHA256
0fc7ee52e5868bbff6e099a308d58a70cbb1ce8c862b6ff047bf5e43e3649cb6

SHA512
dffb36affb7aaa1fecd8463768204f88495dd493e79c3a1eebbf4187cd3b0fbb034125aa746ef7f1f96878611190da6efa5bea95a12c8c292819ec26bfb2389c

Download Submit